Threshold access system supporting threshold decryption and NTRU type multi-party homomorphic encryption method

Abstract

The invention provides a threshold access system supporting threshold decryption and an NTRU type multi-party homomorphic encryption method, and belongs to the technical field of information security and data security. The threshold access system supporting threshold decryption comprises an initialization stage, a key generation stage, a secret share sharing stage, an encryption stage, a decryption stage, a homomorphic calculation stage and a data reconstruction stage, and a new NTRU type multi-party homomorphic encryption method is realized based on the threshold access system. Comprising an initialization stage, a key generation stage, an encryption stage, a decryption stage and a homomorphic calculation stage, so that the method can be more suitable for application scenarios of highly sensitive data processing, the dependence on a trusted third party is very small, the communication overhead and the calculation overhead are very small, the privacy of data is ensured, subdomain lattice attacks can be resisted, and the security of the data is improved. And the efficiency is relatively high.

Description

Technical Field

[0001] The present invention belongs to the technical field of information security and data security, and in particular relates to a threshold access system supporting threshold decryption and an NTRU-type multi-party homomorphic encryption method. Background Art

[0002] In a cloud computing environment, users can calculate and process large amounts of data by sharing the powerful storage resources, computing resources, and software resources in the cloud server. However, if a user's private data is directly uploaded to a public cloud server, it is easy to be stolen and used maliciously, resulting in the leakage of user privacy data. Therefore, ensuring the privacy and security of user data under the cloud computing model is a research focus in the field of information security.

[0003] Traditional homomorphic encryption methods only allow encrypted data with the same key to be calculated. When there are multiple data owners, we should consider extending traditional single-user homomorphic encryption to multiple parties, that is, multi-party homomorphic encryption, to achieve homomorphic calculation and data processing on encrypted data provided by multiple users. Existing research work can be divided into two categories: multi-key homomorphic encryption and threshold homomorphic encryption.

[0004] For highly sensitive application scenarios such as banking, finance, and medical care, it is hoped that the data calculation and processing scenarios of encrypted data under different keys of multiple data owners can be supported. Therefore, multi-key homomorphic encryption can be used to realize the calculation and data processing of encrypted data of multiple users (under different keys) under the premise of ensuring data privacy. In multi-key homomorphic encryption, each participant can use his own key to encrypt private data, and can support homomorphic calculation operations of ciphertext under different keys. All users participating in the operation can restore the data calculation results by decrypting together. On this basis, some multi-key homomorphic encryption methods can even allow new participants to join, making the entire method very flexible and supporting participants to join midway after the method is initialized. However, it is worth noting that the performance of multi-key homomorphic encryption is closely related to the number of participants. The ciphertext size and computational overhead will increase with the increase in the number of participants.

[0005] In practice, companies with highly sensitive data will have a policy that when processing sensitive information, single-user decryption cannot guarantee sufficient security, and a certain number of board members must jointly decrypt it. In order to deal with key leakage, internal rebellion, personnel absence, etc., threshold homomorphic encryption can be used to achieve a certain number of participants to jointly decrypt the secret data after homomorphic calculation under the premise of ensuring data privacy. In threshold homomorphic encryption, all participants jointly generate a public key based on their own keys, and use the public key to encrypt the data. Therefore, its homomorphic calculation process is exactly the same as single-key homomorphic encryption. When decrypting, the participants need to use their private keys to decrypt the secret data after homomorphic calculation respectively to obtain the corresponding decrypted fragments, and then a certain number of participants (not less than the threshold value) aggregate their decrypted fragments to obtain the desired data calculation results. Therefore, the encryption and decryption and homomorphic calculation processes of threshold homomorphic encryption are comparable to single-key homomorphic encryption, and can support the early exit of participants, that is, all participants do not need to wait for joint decryption together, allowing some users to go offline after the homomorphic calculation operation, and will not affect the subsequent data calculation results. However, before the threshold homomorphic encryption method is executed, the set of participants must be determined in advance. After initialization, it cannot support the midway joining of participants. Moreover, the generation of public keys requires the execution of a key generation protocol with additional communication overhead between the participants. The communication overhead generated by the interaction between users is inevitable.

[0006] Existing multi-party homomorphic encryption is mainly constructed based on the (R)LWE assumption or the NTRU assumption. The multi-party homomorphic encryption method based on the (R)LWE assumption relies on the provable security of the (R)LWE assumption. Under reasonable parameter selection, it is easy to achieve quantum security. However, the encryption process will have an expansion of the ciphertext, and usually a relinearization operation is required to realize the multiplication of the ciphertext. The relinearization algorithm is relatively cumbersome and occupies a large proportion in the execution of the entire method, which will make the computational overhead of the entire method large. In addition, the homomorphic encryption method based on the (R)LWE assumption also needs to add an additional ciphertext expansion process to achieve the expansion to multi-key homomorphic encryption. Therefore, most research work on homomorphic encryption based on the (R)LWE assumption focuses on improving efficiency by optimizing the relinearization algorithm, optimizing homomorphic multiplication, and optimizing the ciphertext expansion method. In contrast, the multi-party homomorphic encryption based on the NTRU assumption has a simpler form and a smaller ciphertext size, and its homomorphic multiplication can be directly implemented using polynomial multiplication, which can omit complex operations such as relinearization. Therefore, the method based on the NTRU assumption requires less communication overhead during transmission, lower space complexity required for storage, and faster computing operations. At the same time, NTRU-type homomorphic encryption methods naturally support the extension of multi-key homomorphic encryption, and the process of extending single-key NTRU-type homomorphic encryption methods to multi-key methods is relatively simple.

[0007] However, there is no comprehensive research work on NTRU multi-party homomorphic encryption. The main reasons are as follows: (1) Under the difficulty assumption of the DSPR problem, almost all NTRU multi-party homomorphic encryption requires a small key size, but this will make it possible to recover the private key in polynomial time using a subdomain lattice attack, which makes the difficulty assumption of NTRU multi-party homomorphic encryption invalid and the entire method cannot resist subdomain lattice attacks; (2) The decryption process of NTRU multi-party homomorphic encryption requires the ciphertext to be multiplied by the private keys of all participants, and the private keys of the participants cannot be directly transmitted publicly. They need to be implemented through interaction, but there is currently no secure and efficient joint decryption protocol to implement this process; (3) The existing research work on NTRU threshold homomorphic encryption can better solve the above two problems. A layer of RLWE encryption is used to wrap the NTRU private key to resist subdomain lattice attacks; a distributed decryption protocol is proposed to avoid the transmission of the private key. However, it is worth noting that the reconstruction process reconstructs the RLWE private key, so a certain number of malicious participants can jointly recover the RLWE private key, thereby recovering the NTRU private key, which in turn leads to the leakage of plaintext data. Therefore, this process must be assisted by a trusted third party, which makes the method have certain limitations.

[0008] Therefore, the main challenges in designing a secure and efficient NTRU-type multi-party homomorphic encryption method are to reduce communication overhead, resist subdomain lattice attacks, and reduce or even eliminate dependence on trusted third parties.

[0009] The present invention is aimed at the scenario of safe and efficient processing of sensitive data, especially for the NTRU type multi-party homomorphic encryption method, and proposes a threshold access system method that supports threshold decryption, which has low communication overhead and computing overhead, and can resist subdomain grid attacks. The NTRU type multi-party homomorphic encryption technology proposed in the present invention provides an effective solution to the existing problems and challenges mentioned above. Summary of the invention

[0010] In order to solve the problems existing in the application of existing NTRU multi-party homomorphic encryption to sensitive data processing scenarios, and make NTRU multi-party homomorphic encryption technology more suitable for application scenarios of highly sensitive data processing, the present invention designs a threshold access system that supports threshold decryption, and based on the threshold access system, implements a new NTRU multi-party homomorphic encryption method. This method can be well used for multi-party secure calculation and processing of polynomial data, and this method has higher efficiency and wider application in the application scenario of secure and efficient processing of sensitive data.

[0011] In order to achieve the above objectives, the present invention provides a threshold access system supporting threshold decryption, which includes seven parts: initialization phase, key generation phase, secret share sharing phase, encryption phase, decryption phase, homomorphic computing phase, and data reconstruction phase.

[0012] (1) Initialization phase: This phase determines the public parameters by defining security parameters, polynomial ring, modulus, number of participants, threshold value and other parameters.

[0013] (2) Key generation phase: In this phase, the public key polynomial corresponding to the private key is calculated according to the properties of the Lagrange interpolation polynomial, thereby obtaining the public-private key pair (pk, sk).

[0014] (3) Secret share sharing stage: This stage requires the participation of a trusted third party. The trusted third party needs to make the public key public to each participant and secretly distribute the private key to the corresponding participants, thereby achieving key distribution and secret share sharing. The trusted third party and the participants are independent and non-inclusive groups.

[0015] (4) Encryption phase: This phase requires the introduction of random quantities, which involves polynomial addition and multiplication operations. All participants encrypt the plaintext polynomials to obtain ciphertext polynomials. The addition of small integer polynomials ensures the randomness of the algorithm.

[0016] (5) Homomorphic computation phase: This phase mainly includes two contents, homomorphic addition and homomorphic multiplication. Homomorphic addition is defined as the sum of ciphertext polynomials under a modular polynomial ring; homomorphic multiplication is defined as the product of ciphertext polynomials under a modular polynomial ring. It is worth noting that the operations defined in this phase all guarantee the homomorphic property.

[0017] A modular polynomial is a subring of a polynomial ring, which is obtained by dividing the polynomial ring by a congruence equivalence relation. A ciphertext polynomial is an element of a modular polynomial (ring), and the two are in an inclusion relationship, so it can be said that homomorphic operations on ciphertext polynomials are operations under modular polynomial rings.

[0018] (6) Decryption phase: This phase involves polynomial addition and multiplication operations. A threshold number of participants decrypt the ciphertext separately to obtain plaintext fragments.

[0019] (7) Data reconstruction phase: This phase is mainly implemented using Lagrange interpolation. Participants with a number of not less than the threshold value combine their decrypted fragments (plaintext fragments) to reconstruct the plaintext. Lagrange interpolation ensures the correctness of the threshold decryption and supports all participants to verify the reconstruction results.

[0020] Based on the above-mentioned threshold access system, the present invention also provides an NTRU-type multi-party homomorphic encryption method, which is implemented on the basis of NTRU-type multi-key homomorphic encryption and includes five parts: initialization stage, key generation stage, encryption stage, decryption stage, and homomorphic calculation stage.

[0021] (1) Initialization phase: This phase determines the public parameters by defining security parameters, polynomial ring, modulus, number of participants, threshold value, error distribution and other parameters.

[0022] (2) Key generation phase: This phase mainly includes two steps. All participants execute the key generation procedure of the multi-key NTRU to obtain their own public-private key pairs; the trusted third party executes the key generation procedure of the threshold access system to obtain the public-private key pairs, and then executes the secret share sharing procedure of the threshold access system to disclose the public key to all participants and secretly distribute the private key to the corresponding participants.

[0023] (3) Encryption phase: This phase mainly includes two steps. The participants execute the multi-key NTRU encryption program to encrypt the plaintext data they own and obtain the ciphertext polynomial; and execute the encryption program of the threshold access system to encrypt the user's ciphertext and private key to obtain the ciphertext polynomial pair.

[0024] (4) Homomorphic computation phase: This phase mainly includes two contents, homomorphic addition and homomorphic multiplication. Homomorphic addition is defined as the sum of ciphertext polynomials under a modular polynomial ring; homomorphic multiplication is defined as the product of ciphertext polynomials under a modular polynomial ring. It is worth noting that the operations defined in this phase all guarantee the homomorphic property.

[0025] (5) Decryption phase: In this phase, the encrypted key must first be multiplied to obtain the auxiliary decryption key. Then, a threshold number of participants must decrypt the ciphertext to obtain decrypted fragments, and execute the data reconstruction procedure of the threshold access system to restore the plaintext.

[0026] On this basis, the present invention also provides a complete and efficient method for realizing the secure processing of sensitive data using multi-party homomorphic encryption technology, which mainly includes the following steps:

[0027] (1) A trusted third party generates a public-private key pair that meets the requirements and distributes it to all participants;

[0028] (2) Each participant uses its own key to perform NTRU encryption on the private data to obtain a ciphertext polynomial. Then, the public key received from the trusted third party is used to encrypt the secret private data and private key to obtain the corresponding ciphertext polynomial. All participants upload the final secret data information to the cloud server;

[0029] (3) The cloud server performs a pre-specified homomorphic computation on the data received from each participant, obtains the homomorphic computation result, and sends it to all participants;

[0030] (4) The participants obtain the homomorphic computing results from the cloud server and use the encrypted key to convert the results to obtain another form of ciphertext;

[0031] (5) Participants, no less than a threshold number, decrypt the converted ciphertext to obtain the corresponding decrypted fragments, and then reconstruct the desired plaintext calculation results.

[0032] Therefore, compared with the prior art, the present invention has at least the following advantages and beneficial effects:

[0033] (1) The present invention designs a threshold access system that supports threshold decryption, and instantiates it on the multi-key NTRU method, which can better implement NTRU-type multi-party homomorphic encryption that supports threshold decryption;

[0034] (2) The present invention solves the existing problems of NTRU-type multi-party homomorphic encryption technology, has low communication and computational overheads, can resist subdomain lattice attacks, and greatly reduces dependence on trusted third parties;

[0035] (3) The NTRU multi-party homomorphic encryption technology provided by the present invention is more suitable for application scenarios where sensitive data is processed securely and efficiently. The communication overhead and computing overhead of the entire process are relatively small, and it has quantum security, high efficiency and wider application. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The exemplary embodiments of the present invention may be more easily understood by referring to the following drawings, in which:

[0037] Figure 1 The figure is a schematic diagram of the entire process of securely processing sensitive data using the threshold access system and NTRU multi-party homomorphic encryption technology of the present invention. DETAILED DESCRIPTION

[0038] Embodiments of the present invention are described in detail below. The embodiments described herein are exemplary and are intended to be used to explain the present invention, but are not to be construed as limiting the present invention. It should also be noted that the following detailed descriptions are all exemplary and are intended to provide further explanation of the present invention. Unless otherwise specified, all scientific terms and techniques used in the present invention have the same meanings as those generally understood by those of ordinary skill in the art to which the present invention belongs.

[0039] The following will be combined with the attached Figure 1 A specific implementation method for securely and efficiently processing sensitive data using the threshold access system and NTRU-type multi-party homomorphic encryption technology of the present invention is introduced in detail.

[0040] The embodiment of the present invention provides a threshold access system that supports threshold decryption, and is instantiated on the NTRU-type multi-party homomorphic encryption method, realizing a secure and efficient processing method for sensitive data. The method has little reliance on trusted third parties, has low computational overhead and communication overhead, and ensures the privacy of data. It solves the existing problems of NTRU-type multi-party homomorphic encryption, namely, it can resist subdomain lattice attacks, has a wider range of applicability, and has strong usability and high efficiency.

[0041] First, an embodiment of a threshold access system supporting threshold decryption is given.

[0042] 1. Initialization phase

[0043] For the security parameter λ, define a polynomial ring Where n = n(λ) is a prime number. Let q 1 =q 1 (λ),q 2 =q 2 (λ) are two large prime numbers, let Q = q 1 q 2 , define the polynomial ring N is the number of participants, t is the threshold value (also the highest degree of the plaintext polynomial, i.e. ), output common parameters

[0044] 2. Key generation phase

[0045] A trusted third party randomly and secretly selects two different integers Make s i -s j (i≠j,1≤i,j≤N) and If all are reversible, reselect until all are reversible, and calculate the polynomial K according to Lagrange interpolation. 1 (x) and K 0 (x), public key pk=(K 1 (x),K 0 (x)) and private key sk = (s 1 ,s 2 ,…,s N ). Trusted third parties and participating parties are independent and non-inclusive groups.

[0046] 3. Secret share sharing stage

[0047] The trusted third party publishes the public key pk and secretly sends the private key sk to each participant. i (1≤i≤N) get the private key ski =s i , satisfying K 1 (s i )=1 and K 0 (s i )=0.

[0048] 4. Encryption phase

[0049] For plaintext polynomial Randomly and uniformly select a small integer polynomial The encryption process outputs c(x) = (m(x)K 1 (x)+r(x)K 0 (x))mod Q.

[0050] 5. Homomorphic computing stage

[0051] The homomorphic computation phase mainly includes homomorphic addition and homomorphic multiplication. Let c 1 (x) and c 2 (x) are two ciphertexts obtained using the threshold access system of the present invention, and homomorphic addition is defined as c add (x)=(c 1 (x)+c 2 (x)) mod Q; homomorphic multiplication is defined as c mult =(c 1 (x)·c 2 (x))mod Q.

[0052] 6. Decryption phase

[0053] For a given ciphertext polynomial c(x), each participant can use their own private key to decrypt it, that is, the private key sk i =s i Substitute into the ciphertext polynomial c(x) and get the corresponding decrypted fragment m(s i ).

[0054] 7. Data reconstruction phase

[0055] At least t participants aggregate the decrypted fragments to reconstruct the plaintext, that is,

[0056]

[0057] On this basis, all participants can verify the reconstructed plaintext calculation results, that is, any participant brings in his private key sk i =s i , are the same as the decrypted fragments obtained previously.

[0058] Then, an embodiment of the NTRU multi-party homomorphic encryption technology supporting threshold decryption is given using the above threshold access system.

[0059] 1. Initialization phase

[0060] For the security parameter λ, define the polynomial ring Where n = n(λ) is a prime number. Let q = q(λ), q 1 =q 1 (λ),q 2 =q 2 (λ) are three large prime numbers, let Q = q 1 q 2 , define the polynomial ring Define a polynomial ring The error distribution of B(λ) is bounded by χ=χ(λ)(B<<q), that is, The number of participants is N, and the threshold value of the corresponding threshold access system is t. Define the polynomial ring Output common parameters

[0061] 2. Key generation phase

[0062] Participant P i (1≤i≤N) Run the key generation procedure of multi-key NTRU and get (h i ,f i ), the trusted third party runs the key generation program of the threshold access system and obtains ((K 1 (x),K 0 (x)),s i ), and then execute the secret share sharing procedure of the threshold access system, that is, to make K 1 (x) and K 0 (x), and s i Secretly distributed to participant P i .

[0063] 3. Encryption phase

[0064] Participant P i First run the multi-key NTRU encryption program on the plaintext polynomial Encrypt and get c i , and then run the encryption program of the threshold access system to c i and the private key f of the multi-key NTRU i Encrypt and get d i ,k i Each participant outputs the ciphertext d i .

[0065] 4. Homomorphic computing stage

[0066] The homomorphic computation phase mainly includes homomorphic addition and homomorphic multiplication. Let d 1 (x) and d 2 (x) are two ciphertexts obtained using the threshold access system of the present invention, and homomorphic addition is defined as d add (x)=(d 1 (x)+d 2 (x)) mod Q, homomorphic multiplication is defined as d mult =(d 1 (x)·d 2 (x))mod Q.

[0067] 5. Decryption phase

[0068] Calculate k(x)=(k 1 k 2 …k N )mod Q, for the ciphertext to be decrypted Each participant calculates m i =d(s i )·k(s i )mod t, get the decrypted plaintext fragment Then the plaintext is reconstructed, that is, no less than t participants execute the data reconstruction procedure of the threshold access system to obtain m.

[0069] Finally, an implementation example is given for achieving secure and efficient processing of sensitive data based on the above-mentioned NTRU-type multi-party homomorphic encryption technology. Figure 1 The specific process of using the NTRU-type multi-party homomorphic encryption technology of the present invention to achieve secure processing of sensitive data is described in detail.

[0070] Figure 1 The detailed process can be described as follows:

[0071] (1) A trusted third party generates a public-private key pair that meets the requirements and distributes it to all participants;

[0072] (2) Each participant uses its own key to perform NTRU encryption on the private data m(i) to obtain the ciphertext polynomial c(i);

[0073] (3) The participants use the public key received from the trusted third party to encrypt the secret private data c(i) and the private key respectively, and obtain the corresponding ciphertext polynomials d(i) and k(i). All participants upload the final secret data information d(i) to the cloud server;

[0074] (4) The cloud server performs a pre-specified homomorphic computation f on the data received from each participant, obtains the homomorphic computation result D, and sends it to all participants;

[0075] (5) The participant obtains the homomorphic computing result D from the cloud server, and uses the encrypted key k(i) to transform the result to obtain the transformed secret computing result C;

[0076] (6) The participant uses the private key received from the trusted third party to decrypt the converted ciphertext C and obtain the decrypted fragment;

[0077] (7) No fewer than t participants can reconstruct the calculation result f(m(1), m(2), …, m(N-1), m(N)).

[0078] The above embodiments are partial implementation methods of the present invention, but the implementation methods of the present invention are not limited to the above embodiments. Any other changes, modifications, substitutions, combinations, and simplifications that do not deviate from the spirit and principles of the present invention should be equivalent replacement methods and are included in the protection scope of the present invention.

Claims

1. A threshold access system supporting threshold decryption, characterized in that: include: The threshold access system includes an initialization phase, a key generation phase, a secret share sharing phase, an encryption phase, a decryption phase, a homomorphic computing phase, and a data reconstruction phase; Initialization phase: Determine public parameters by defining security parameters, polynomial rings, moduli, number of participants, and thresholds; Key generation stage: according to the properties of Lagrange interpolation polynomial, the public key polynomial corresponding to the private key is calculated to obtain a public-private key pair, where the private key satisfies the Lagrange interpolation polynomial; Secret share sharing stage: A trusted third party will disclose the public key to each participant and secretly distribute the private key to the corresponding participants; Encryption phase: All participants introduce random quantities and encrypt the plaintext polynomial by randomly and uniformly selecting a small integer polynomial to obtain the ciphertext polynomial. Homomorphic calculation stage: performing homomorphic addition and homomorphic multiplication operations on the ciphertext polynomials under the modular polynomials, wherein the homomorphic addition is defined as the sum of the ciphertext polynomials under the modular polynomial ring, and the homomorphic multiplication is defined as the product of the ciphertext polynomials under the modular polynomial ring; Decryption phase: For a given ciphertext polynomial, all participants can use their own private keys to decrypt it, bring the private key into the ciphertext polynomial for decryption, and obtain plaintext fragments. The number of participants is not less than the threshold number; During the data reconstruction phase, Lagrange interpolation is used to reconstruct the plaintext. All participants combine their decrypted plaintext fragments to reconstruct the plaintext, and all participants are supported to verify the reconstructed plaintext.

2. A NTRU type multi-party homomorphic encryption method, characterized in that: The method is used in the threshold access system of claim 1, comprising: Initialization phase, key generation phase, encryption phase, decryption phase and homomorphic computing phase; Initialization phase: define security parameters, polynomial ring, modulus, number of participants, threshold value and error distribution, and determine public parameters; Key generation phase: The participants run the key generation program of the multi-key NTRU to obtain their respective public and private key pairs; the trusted third party runs the key generation program of the threshold access system and performs the secret share sharing program. The trusted third party and the participants are independent and non-inclusive groups; Encryption phase: The participants first run the encryption program of the multi-key NTRU to encrypt the plaintext polynomial to obtain the ciphertext polynomial, and then run the encryption program of the threshold access system to encrypt the ciphertext polynomial and the private key of the multi-key NTRU to obtain a ciphertext polynomial pair; Homomorphic calculation stage: perform homomorphic addition and homomorphic multiplication operations on the ciphertext polynomial under the modular polynomial; Decryption phase: perform multiplication on the encrypted key to obtain the auxiliary decryption key, the participating party decrypts the ciphertext to obtain the decrypted fragment, and executes the data reconstruction program of the threshold access system to obtain the reconstructed plaintext.

Images