Coding and solving method and device, encryption method, learning method, chip

Abstract

The application discloses a coding and decoding method and device, an encryption method, a learning method and a chip, and relates to the technical field of data processing. The coding method comprises the following steps: constructing a linear equation set based on a preset key-value table, and obtaining a coefficient matrix of the linear equation set; solving a maximum linearly independent group of the coefficient matrix, and adding preset key-value pairs corresponding to rows except linearly independent rows in the maximum linearly independent group to a linear correlation set; updating the linear equation set based on the linear correlation set, and obtaining an encoding vector based on the updated linear equation set; and decoding a query key based on the encoding vector and the linear correlation set for the query key. The method can ensure successful encoding by setting the linear correlation set, and can reduce the storage cost, thereby saving the storage cost and improving the query efficiency.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to an encoding and decoding method for inadvertent key-value storage, a method for solving small exponential elliptic curve discrete logarithms, a batch encryption method, a federated learning method based on the longitudinal XGBoost algorithm, an encoding and decoding device for inadvertent key-value storage, a device for solving small exponential elliptic curve discrete logarithms, a computer-readable storage medium, and a chip. Background Technology

[0002] OKVS (Oblivious Key-Value Stores) is a data storage paradigm that supports multi-model databases. As a privacy protection technology, OKVS typically requires multiple encryption or hashing of key-value pairs during implementation, and also requires additional storage of metadata information for decoding, such as index tables and verification parameters. This leads to a large data volume, resulting in significant storage overhead and hindering fast table lookups. Summary of the Invention

[0003] The first objective of this invention is to propose an encoding and decoding method for unintentional key-value storage, so as to save storage overhead and improve query efficiency.

[0004] The second objective of this invention is to propose a method for solving the discrete logarithm of a small exponential elliptic curve.

[0005] The third objective of this invention is to propose a batch encryption method.

[0006] The fourth objective of this invention is to propose a federated learning method based on the longitudinal XGBoost algorithm.

[0007] The fifth objective of this invention is to provide an encoding and decoding device for inadvertent key-value storage.

[0008] The sixth objective of this invention is to provide a device for solving the discrete logarithm of a small exponential elliptic curve.

[0009] The seventh object of the present invention is to provide a computer-readable storage medium.

[0010] The eighth objective of this invention is to provide a chip.

[0011] In a first aspect, embodiments of the present invention propose an encoding and decoding method for unintentional key-value storage. The method includes: constructing a system of linear equations based on a preset key-value table and obtaining a coefficient matrix of the system of linear equations; solving for a maximal linearly independent set of the coefficient matrix and adding preset key-value pairs corresponding to rows other than linearly independent rows in the maximal linearly independent set to a linearly dependent set; updating the system of linear equations based on the linearly dependent set and obtaining an encoding vector based on the updated system of linear equations; and decoding a query key based on the encoding vector and the linearly dependent set.

[0012] The unintentional key-value storage encoding / decoding method of this invention constructs a system of linear equations based on a preset key-value table and obtains the coefficient matrix of the system of linear equations; solves for the maximal linearly independent set of the coefficient matrix, and adds the preset key-value pairs corresponding to the rows in the maximal linearly independent set (excluding the linearly independent rows) to a linearly dependent set; updates the system of linear equations based on the linearly dependent set, and obtains an encoding vector based on the updated system of linear equations; for the query key, decodes the query key based on the encoding vector and the linearly dependent set. This method ensures successful encoding by setting a linearly dependent set and reduces the coefficient of storage overhead, thereby saving storage overhead and improving query efficiency.

[0013] Secondly, embodiments of the present invention propose a method for solving the discrete logarithm of a small exponential elliptic curve. The method includes: if point P is in a preset key-value table, then using the unintentional key-value storage encoding / decoding method described in the first aspect embodiment to process the key corresponding to point P. Decode the data to obtain a first decoding result; update the set R based on the first decoding result; if there exists a set R that satisfies the equation... of Then As the small exponent obtained from the solution; where points P and G are points on the elliptic curve and satisfy... .

[0014] The method for solving the discrete logarithm of a small exponential elliptic curve in this invention utilizes the unintentional key-value storage encoding / decoding method described in the first aspect embodiment above, which can reduce memory overhead and improve the solution speed.

[0015] Thirdly, embodiments of the present invention propose a batch encryption method, the method comprising: obtaining N first plaintexts and N second plaintexts, where N is an integer greater than 1; encrypting the N first plaintexts respectively using an elliptic curve cryptography algorithm to obtain N first encryption results, and encrypting the N second plaintexts respectively using an elliptic curve cryptography algorithm to obtain N second encryption results; simultaneously performing batch point addition operations on the N first encryption results and the corresponding N second encryption results, or simultaneously performing batch scalar multiplication operations on the N first encryption results and the N second encryption results to obtain target ciphertext; wherein the batch modular inverse involved in the batch point addition operation or batch scalar multiplication operation is obtained using the Montgomery technique, and the target ciphertext is decrypted using the small exponential elliptic curve discrete logarithm solution method described in the second aspect.

[0016] The batch encryption method of this invention can encrypt multiple plaintexts simultaneously, improving encryption efficiency. Furthermore, the batch modular inverse operation in batch point addition or batch scalar multiplication is performed using the Montgomery technique, which can significantly reduce the amount of computation. The decryption method using the small exponential elliptic curve discrete logarithm solution can reduce decryption time.

[0017] Fourthly, this invention proposes a federated learning method based on the vertical XGBoost algorithm for a client. The client includes a first feature of the sample and carries a label. The method includes: generating a private key and a public key, and sending the public key to a server; calculating the first-order gradient and second-order gradient of each sample based on the current tree and the label of each sample, and encrypting the first-order gradient and the second-order gradient using an elliptic curve cryptography algorithm based on the public key; sending the encrypted first-order gradient and second-order gradient to the server, so that the server performs batch point addition or batch scalar multiplication on the left subtree based on the public key, the encrypted first-order gradient, the second-order gradient, and each split point; receiving the homomorphic addition result of the left subtree sent by the server, and decrypting the homomorphic addition result of the left subtree using the small exponential elliptic curve discrete logarithm solution method described in the second aspect based on the private key to obtain the left subtree gradient; obtaining the score value of each split point based on the sum of the left subtree gradient and the sample gradient, and updating the current tree based on the split point corresponding to the maximum score value.

[0018] The federated learning method based on the longitudinal XGBoost algorithm in this invention uses the small exponential elliptic curve discrete logarithm solution method described in the second aspect of the invention for decryption, which can improve decryption speed and reduce memory overhead.

[0019] Fifthly, embodiments of the present invention propose an encoding and decoding apparatus for unintentional key-value storage. The apparatus includes: an encoding module, configured to construct a system of linear equations based on a preset key-value table, obtain the coefficient matrix of the system of linear equations, solve for the maximal linearly independent set of the coefficient matrix, add the preset key-value pairs corresponding to the rows in the maximal linearly independent set (excluding the linearly independent rows) to a linearly dependent set, update the system of linear equations based on the linearly dependent set, and obtain an encoding vector based on the updated system of linear equations; and a decoding module, configured to decode a query key based on the encoding vector and the linearly dependent set.

[0020] The unintentional key-value storage encoding / decoding device of this invention constructs a system of linear equations based on a preset key-value table and obtains the coefficient matrix of the system of linear equations; solves for the maximal linearly independent set of the coefficient matrix, and adds the preset key-value pairs corresponding to the rows in the maximal linearly independent set (excluding the linearly independent rows) to a linearly dependent set; updates the system of linear equations based on the linearly dependent set, and obtains an encoding vector based on the updated system of linear equations; and decodes the query key based on the encoding vector and the linearly dependent set. This device ensures successful encoding and reduces storage overhead by setting a linearly dependent set, thereby saving storage costs and improving query efficiency.

[0021] Sixthly, embodiments of the present invention propose a device for solving the discrete logarithm of a small exponential elliptic curve. The device includes a decoding unit, used to decode the key corresponding to point P based on the key value in a preset key-value table when point P is in the table, utilizing the encoding / decoding method of unintentional key-value storage described in the first aspect embodiment. Decoding is performed to obtain a first decoding result, and the set R is updated based on the first decoding result; a solution unit is used to solve for the existence of a condition satisfying the equation in the set R. of At that time, As the small exponent obtained from the solution; where points P and G are points on the elliptic curve and satisfy... .

[0022] The discrete logarithm solver for small exponential elliptic curves in this embodiment of the invention utilizes the unintentional key-value storage encoding / decoding method described in the first aspect embodiment above to solve for discrete logarithms of small exponential elliptic curves, which can reduce memory overhead and improve the solution speed.

[0023] In a seventh aspect, embodiments of the present invention provide a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, it implements the method described in at least one of the first, second, third, and fourth aspects described above.

[0024] Eighthly, embodiments of the present invention provide a chip including a memory, a processor, and a computer program stored in the memory, wherein when the computer program is executed by the processor, it implements the method described in at least one of the first, second, third, and fourth aspects described above.

[0025] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0026] Figure 1 This is a flowchart of the encoding and decoding method for unintentional key-value storage according to an embodiment of the present invention;

[0027] Figure 2 This is a flowchart of a method for solving the discrete logarithm of a small exponential elliptic curve according to an embodiment of the present invention;

[0028] Figure 3 This is a flowchart of the batch encryption method according to an embodiment of the present invention;

[0029] Figure 4 This is a flowchart of a federated learning method based on the vertical XGBoost algorithm according to an embodiment of the present invention;

[0030] Figure 5 This is a structural block diagram of the encoding and decoding device for unintentional key-value storage according to an embodiment of the present invention;

[0031] Figure 6 This is a structural block diagram of a device for solving the discrete logarithm of a small exponential elliptic curve according to an embodiment of the present invention;

[0032] Figure 7 This is a structural block diagram of a chip according to an embodiment of the present invention. Detailed Implementation

[0033] Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.

[0034] The following description, with reference to the accompanying drawings, describes the encoding / decoding and solving methods and apparatus, encryption methods, learning methods, and chips of embodiments of the present invention.

[0035] Figure 1 This is a flowchart of the encoding and decoding method for unintentional key-value storage according to an embodiment of the present invention.

[0036] like Figure 1 As shown, the encoding and decoding methods for unintentional key-value storage include:

[0037] S11, construct a system of linear equations based on a preset key value table, and obtain the coefficient matrix of the system of linear equations.

[0038] The preset key-value table consists of multiple key-value pairs.

[0039] For example, the first Each key-value pair is , Indicates key, Indicator key The corresponding values ​​are in the default key-value table. , This indicates the number of key-value pairs in the preset key-value table. It is an integer greater than 1.

[0040] Specifically, OKVS (Oblivious Key-Value Stores) is a data storage paradigm that supports multi-model databases, involving both encoding and decoding processes. For pre-defined key-value tables... The OKVS encoding process is to obtain dimensional vector ,satisfy ,in Represent each value The bit length. Therefore, a system of linear equations is constructed: ,in , ,Right now , represents the coefficient matrix of a system of linear equations. It is a function that maps binary strings of arbitrary length to length. A random function for binary strings. , Indicates that the binary storage space is finite field, This indicates the overhead required to store the preset key-value table. The coefficient representing storage overhead is the multiple of the additional storage space required to achieve the "unnoticeable" security attribute relative to the original data size.

[0041] For example, random functions According to the position function and Sure; Represents an integer of length 256 bits. ; ,express - Positional functions, where mod represents modulo operation; Indicates the first A vector with 1 at each position and 0 at all positions except the j-th position; satisfy .

[0042] As one implementation method, It can represent a base point pre-selected on the elliptic curve. Indicates the base point Adding itself i times yields a point on the elliptic curve. express The x-coordinate of the point.

[0043] In this embodiment, if the information to be stored is not a point on an elliptic curve, a mapping function can be used to map the information to be stored into a point on an elliptic curve to obtain a preset key-value table before encoding. Correspondingly, during subsequent decoding, after obtaining the decoding result, the inverse process of the mapping function needs to be executed to restore the decoded points on the elliptic curve to the original information.

[0044] S12, solve for the maximal linearly independent set of the coefficient matrix, and add the key-value pairs corresponding to the rows in the maximal linearly independent set (excluding the linearly independent rows) in the preset key-value table to the linearly dependent set.

[0045] Finding the maximal linearly independent set (MLS) of the coefficient matrix is ​​a process of "simplifying complexity." The maximal LLS allows us to determine the most core and independent parts of the coefficient matrix, such as linear dependence, dimension, and basis. After obtaining the maximal LLS, the predefined key-value pairs corresponding to the rows in the maximal LLS (excluding linearly independent rows) are added to the linearly dependent set. For example, the maximal LLS is... Since the elements in rows 3 and 4 are both 0, rows 3 and 4 are linearly independent. At this point, rows 1 and 2 are linearly dependent, and their corresponding key-value pairs in the preset key-value table are added to the linearly dependent set I.

[0046] S13 updates the linear equation system based on the linear correlation set, and obtains the encoding vector based on the updated linear equation system.

[0047] Specifically, the corresponding rows of the linearly dependent sets in the coefficient matrix are deleted to update the coefficient matrix, and the system of linear equations is updated based on the updated coefficient matrix. The updated coefficient matrix can be denoted as... The resulting new system of linear equations is denoted as .

[0048] Alternatively, the equations in the linear equation system corresponding to the linearly dependent set can be directly deleted to obtain the updated linear equation system.

[0049] S14, for the query key, decode the query key based on the encoding vector and the linear correlation set.

[0050] In some embodiments of the present invention, decoding the query key based on the encoding vector and the linear correlation set includes: if a key-value pair containing the query key exists in the linear correlation set, then the value in the key-value pair is determined to be the decoding result; if no key-value pair containing the query key exists in the linear correlation set, then the value is determined to be the decoding result using the formula... Calculate the target value, where, Indicates the target value. Represents the encoded vector. Indicates the query key; if If the result is true, the decoding result is determined to be the target value; otherwise, the decoding is determined to have failed.

[0051] Steps S11-S13 above constitute the encoding process, which can be performed by the data provider; step S14 is the decoding process, which can be performed by the data user. The data provider can provide the encoded vector and linear correlation set obtained after encoding to the data user. Specifically, for the preset key-value table... The encoding process is to obtain the encoding vector. and linearly dependent sets The encoding process can be as follows:

[0052] 1) Order and ,in It is a constant close to 1, for example ;

[0053] 2) Generate the coefficient matrix of the linear equation system ,in It is a random function. ;

[0054] 3) Calculate the coefficient matrix For a maximal linearly independent set, record the corresponding row indices in a nonlinear set. middle;

[0055] 4) Will not Row records in the linearly dependent set In, that is ;

[0056] 5) For Delete coefficient matrix The Okay, we get a new system of linear equations. ;

[0057] 6) Solve the new system of equations to obtain the encoding vector. ;

[0058] 7) Return the encoded vector and linearly related sets .

[0059] Regarding random functions The choice, due to Because it possesses a certain degree of randomness, this invention employs a seemingly "random" method. Each point... The coordinates are a 256-bit integer, which can be divided into eight 32-bit integers, i.e. .definition - Position function is , Let represent the j-th 32-bit integer, and mod denote the modulo operation. Then, the random function... Consisting of two position functions (i.e.) , ) is determined, among which This represents the bitwise XOR operation of a 0-1 vector. Indicates the first A vector with 1 at position j and 0 at all positions except the j-th position. Regarding The choice only needs to meet the following conditions. Dissimilar (i.e., for each other) i, exist (These values ​​are all different) is sufficient. It always exists.

[0060] It should be understood that each position function (i.e. or Given a vector (where only one component is 1 and the rest are 0), two positional functions determine two such vectors. The final random function is obtained through an XOR operation. The vector output by this random function has two components that are 1, and all others that are 0.

[0061] Based on existing coding results Linearly dependent sets and The decoding process is as follows:

[0062] 1) If Return the result directly. ;

[0063] The linearly correlated set I consists of one or more key-value pairs, which can be accessed by querying the key. Find each key-value pair in the linearly correlated set I. If the query key... In a given key-value pair within the linearly dependent set I, the value in that key-value pair is taken as... return.

[0064] 2) Otherwise calculate ;

[0065] 3) If Then the returned result Otherwise return This means decoding failed.

[0066] The encoding and decoding method for the unintentional key-value store in this invention improves upon the traditional OKVS (Oblivious Key-Value Store) technology by processing linearly correlated sets separately. This ensures that the encoding will always succeed, thus reducing the coefficient of storage overhead. Reduced to 1.03, compared to existing technologies This approach saves on the storage overhead of a pre-defined key-value table; furthermore, it uses a random function with a weight of 2. The query process only requires one XOR operation, which can significantly improve query efficiency compared to existing Cuckoo hashing technologies.

[0067] Figure 2 This is a flowchart of a method for solving the discrete logarithm of a small exponential elliptic curve according to an embodiment of the present invention.

[0068] like Figure 2 As shown, the methods for solving the discrete logarithm of a small exponential elliptic curve include:

[0069] S21, If ​​point P is in the preset key value table, then for the key corresponding to point P... Decode the code to obtain the first decoding result.

[0070] Where point P is a point on the elliptic curve, key Representing the x-coordinate of point P, the encoding and decoding method of the unintentional key-value storage described in the above embodiment is used to process the key corresponding to point P. Decode it.

[0071] S22, update set R based on the first decoding result.

[0072] For example, updating set R based on the first decoding result includes: adding the first decoding result and the inverse of the first decoding result to set R.

[0073] S23, if there exists a set R that satisfies the expression of Then As the small exponent obtained from the solution.

[0074] Where point G is a point on the elliptic curve and satisfies .

[0075] In some embodiments of the present invention, the method for solving the discrete logarithm of a small exponential elliptic curve further includes: if point P lies in a preset linear table... In the middle, for each ,calculate ;like Then , Middle Satisfaction of As the small exponent obtained from the solution. .

[0076] In some embodiments of the present invention, the method for solving the discrete logarithm of a small exponential elliptic curve further includes: if Let set and calculate ;calculate And using the unintentional key-value storage encoding and decoding method of the above embodiments to... Decode the data to obtain a second decoding result, and update the set R based on the second decoding result; calculate... And using the unintentional key-value storage encoding and decoding method of the above embodiments to... Decode the data to obtain a third decoding result, and update the set R based on the third decoding result; where, for The reverse of the model.

[0077] For example, updating set R based on the second decoding result includes: The sum of the second decoding result, The sum of the opposites of the second decoding result is added to set R; set R is updated based on the third decoding result, including: The sum of the third decoding result, The sum of the opposites of the third decoding result is added to set R.

[0078] For example, The calculation was performed using the Montgomery trick. The Montgomery trick can transform N1 modular inverses into 1 modular inverse + 3(N1-1) modular multiplications, which greatly reduces the computation time (the time for one modular inverse is approximately equivalent to the time for 200 modular multiplications), where N1 is the number of elements in the set Inv.

[0079] Specifically, given points on the elliptic curve and points satisfy The encoding / decoding method using the unintentional key-value storage of the above embodiments is based on a preset key-value table. Obtain the encoding result Linearly dependent sets and And a preset linear table is obtained in advance. .

[0080] The steps to solve the small exponential ECDLP (Elliptic Curve Discrete Logarithm Problem) are as follows:

[0081] 1) Let set ,in Used to store all possible results Used to store all values ​​that require modulo inverse operations;

[0082] 2) Determine the point In the preset key value table middle:

[0083] 2.1) If the decoding algorithm is used to calculate... ;

[0084] This represents the first decoding result. This describes the decoding process in the unintentional key-value storage encoding / decoding method of the above embodiments. This represents the input for the decoding process.

[0085] 2.2) Then store the results into a set. In, that is .

[0086] 3) Determine the point Not in the preset key-value table In the preset linear list middle:

[0087] 3.1) For each ,calculate ;

[0088] 3.2) If Then there must be or ,judge Is it equal to Sure for one of the;

[0089] 3.3) If all ,So .

[0090] 4) Use Montgomery's technique to calculate The reverse, that is ;

[0091] 5) For each ,calculate ;

[0092] 5.1) Calculation ;

[0093] 5.2) If a decoding algorithm is used to obtain ,So ;

[0094] in, This indicates the second decoding result. This describes the decoding process in the unintentional key-value storage encoding / decoding method of the above embodiments. This represents the input for the decoding process.

[0095] 5.3) Calculation ;

[0096] 5.4) If a decoding algorithm is used to obtain ,So .

[0097] in, This indicates the third decoding result. This describes the decoding process in the unintentional key-value storage encoding / decoding method of the above embodiments. This represents the input for the decoding process.

[0098] 6) For each ,if , then return .

[0099] The method for solving the small exponential elliptic curve discrete logarithm in this invention applies the improved OKVS to the query process of solving the small exponential ECDLP, which can improve the solution speed and reduce memory overhead, thereby improving the performance of solving the small exponential.

[0100] Figure 3 This is a flowchart of a batch encryption method according to an embodiment of the present invention.

[0101] like Figure 3 As shown, batch encryption methods include:

[0102] S31, obtain N first plaintexts and N second plaintexts, where N is an integer greater than 1.

[0103] The first plaintext and the second plaintext can be any information that needs to be encrypted (such as data in a database), and are points mapped onto an elliptic curve (such as elliptic curves in standards like secp256k1 and SM2).

[0104] S32, the N first plaintexts are encrypted using an elliptic curve encryption algorithm to obtain N first encryption results, and the N second plaintexts are encrypted using an elliptic curve encryption algorithm to obtain N second encryption results.

[0105] S33, perform batch point addition on the N first encryption results and the N corresponding second encryption results, or perform batch scalar multiplication on the N first encryption results and the N second encryption results to obtain the target ciphertext.

[0106] In this process, the batch modulo inverse involved in the batch addition or batch scalar multiplication of transport loss is obtained using the Montgomery technique, and the target ciphertext is decrypted using the small exponential elliptic curve discrete logarithm solution method described in the above embodiments.

[0107] Specifically, step S32 may include: inputting security parameters. Using key generation algorithm Output private key and the corresponding public key For each plaintext m to be encrypted (including the first plaintext and the second plaintext), based on the public key... Using encryption algorithms Output ciphertext ,in , , It is a random number.

[0108] It should be noted that if the plaintext to be encrypted is not a point on an elliptic curve, it must first be mapped onto the elliptic curve. After decryption, a reverse mapping process is then required to restore the decrypted points to the original information.

[0109] For the batch point addition operation in step S33, taking a single point addition operation as an example, encrypted addition is used. The two encryption results and Perform dot addition and output ciphertext. ,in , .

[0110] Similarly, for Point ,satisfy , , This represents a point at infinity. Batch point addition means calculating simultaneously. Add one point In batch point addition operations, the Montgomery technique is used for calculation. The inverse of the modulus, i.e. The total cost is 1 module inverse + Modular multiplication. The following calculations can then be performed:

[0111] Calculate the slope This involves Modular multiplication;

[0112] calculate -coordinate, This involves One modulus square;

[0113] calculate -coordinate, This involves Each module multiplied.

[0114] As can be seen, the batch point addition operation involves a total of 1 modular inverse +. Modular multiplication + The square of the modulus is given, so the computational cost of adding each point is... Individual Model Reverse + Modular multiplication + The square of the modulus. When When the time is large, the computational cost of each point addition operation is approximately 5 modular multiplications + 1 modular square. Since the time for one modular inverse is approximately equivalent to the time for 200 modular multiplications, the batch point addition operation of this invention can greatly reduce the computational cost.

[0115] For the batch scalar multiplication operation in step S33, taking a single scalar multiplication operation as an example, calculate the encryption result. and scalar Scalar multiplication, output ciphertext .

[0116] Similarly, for 2 Points ,satisfy Batch multiplication means calculating 2 at the same time. scalar multiplication binary expansion is The specific steps are as follows:

[0117] Input: 2 Points and 2 scalar

[0118] Output:

[0119] 1. Order

[0120] 2.for to 0 do

[0121] 3. / / Use batch multiplier calculation

[0122] 4. For each ,calculate / / Use batch dot addition operation

[0123] 5. end for

[0124] 6. return

[0125] Since the performance of batch point addition is greatly improved, and batch scalar multiplication uses batch point addition, the performance of batch scalar multiplication can also be improved to some extent.

[0126] During decryption, the ciphertext is decrypted. For example, based on the private key Using decryption algorithms calculate Then, the output of the small-exponential elliptic curve discrete logarithm solution method described in the above embodiments can be applied. .

[0127] In the above algorithms, the decryption algorithm involves a method for solving small-exponential elliptic curve discrete logarithms, which can improve decryption time. It should be noted that steps S31-S33 can be executed by the first terminal, and the target ciphertext obtained after batch encryption can be sent to the second terminal for processing, similar to isomorphic addition; after processing, the second terminal can return the ciphertext to the first terminal for decryption. The specific process can be described as the federated learning method based on the longitudinal XGBoost algorithm in the following embodiments.

[0128] The batch encryption method of this invention can encrypt multiple plaintexts simultaneously, improving encryption efficiency. Furthermore, the batch modular inverse operation in batch point addition or batch scalar multiplication is performed using the Montgomery technique, which can significantly reduce the amount of computation. The decryption method using the small exponential elliptic curve discrete logarithm solution can reduce decryption time.

[0129] Figure 4 This is a flowchart of a federated learning method based on the vertical XGBoost algorithm according to an embodiment of the present invention.

[0130] In an embodiment of the present invention, a federated learning method based on the longitudinal XGBoost algorithm is used on the client side, which includes a first feature of the sample and carries a label.

[0131] Specifically, the federated learning scenario based on the vertical XGBoost algorithm is as follows: the client possesses the first feature of the sample, the server possesses the second feature of the sample, and only the client possesses the label of the sample. Indicates the client, This indicates the server side. The number of client features is... The number of server-side features is The total number of sample features is .

[0132] For this federated learning binary classification training task, the loss function is: ,in This represents the true label of the i-th sample. Let represent the predicted label of the i-th sample, and n represent the number of samples. The first gradient of the i-th sample is... The second gradient is .

[0133] like Figure 4 As shown, federated learning methods based on the longitudinal XGBoost algorithm include:

[0134] S41, generate a private key and a public key, and send the public key to the server.

[0135] Specifically, the client can, before training, set security parameters. Using key generation algorithm Obtain the public / private key pair , public key Send to the server, where .

[0136] S42, calculate the first-order gradient and second-order gradient of each sample based on the current tree and the label of each sample, and encrypt the first-order gradient and second-order gradient respectively using the public key.

[0137] Specifically, for each tree and each layer, the client encrypts the first and second gradients of each sample containing label information using Elgamal exponentiation and sends them to the server. The encrypted first gradient is... The encrypted second-order gradient is ,in, , , , Represents a random number. This represents a base point selected on the elliptic curve.

[0138] Elgamal encryption, compared to Paillier-3072 encryption, achieves 128-bit security while reducing encryption time and ciphertext length, thereby improving the performance of the entire learning process.

[0139] It should be noted that the first and second gradients to be encrypted may not actually be points on the elliptic curve. Therefore, before actual encryption, the first and second gradients must be mapped onto the elliptic curve. After decryption, a reverse mapping process is required to restore the points to the original information.

[0140] S43 sends the encrypted first-order gradient and second-order gradient to the server so that the server can perform homomorphic addition on the left subtree based on the public key, the encrypted first-order gradient, second-order gradient, and each split point.

[0141] For example, the result of the left subtree homomorphic addition is represented by the following formula:

[0142] ,

[0143] ,

[0144] In particular, when performing homomorphic addition, the server uses the Montgomery technique to calculate the modular inverse. and It performs batch addition operations based on modular inverses. The Montgomery trick can transform n modular inverses into 1 modular inverse + 3(n-1) modular multiplications, which greatly reduces the computation time (the time of one modular inverse is approximately equivalent to the time of 200 modular multiplications).

[0145] Specifically, regarding the second feature, the server does not have plaintext data. and Only encrypted data and Therefore, the score cannot be calculated independently. The server iterates through every possible split point of each of its second features. For each split point, the server can determine whether the sample splits into the left or right subtree. Then, it can utilize the additive homomorphic property of homomorphic encryption to perform the aforementioned left subtree homomorphic addition processing, obtaining... , After that , Send it back to the client.

[0146] S44: Receive the homomorphic addition result of the left subtree sent by the server, and decrypt the homomorphic addition result of the left subtree based on the private key to obtain the gradient of the left subtree.

[0147] Specifically, the homomorphic addition result of the left subtree is decrypted using the small exponential elliptic curve discrete logarithm solution method described in the above embodiment based on the private key.

[0148] Specifically, based on the additive homomorphism, the ciphertext whose sum equals the sum of the plaintext can be obtained as follows: and r is a random number. During decryption, it can be first based on the private key. and ciphertext , Calculate separately and Then, based on the small exponential elliptic curve discrete logarithm solution method used for points P1 and P2, the gradient of the left subtree at the split point is output. and This can improve decryption speed and reduce memory consumption.

[0149] S45: The score of each split point is obtained based on the sum of the gradient of the left subtree and the gradient of the sample, and the current tree is updated based on the split point corresponding to the maximum score.

[0150] In some embodiments of the present invention, the score is obtained by the following formula:

[0151]

[0152] in, Indicates the score value. Indicates the gradient of the left subtree. Indicates the gradient of the right subtree. The sum of sample gradients can be calculated by the client. and , and , This represents the penalty coefficient.

[0153] Specifically, when the server sends the homomorphic addition result of the left subtree to the client, it also sends the feature ID and threshold ID. After obtaining the maximum score, the client determines the optimal split point based on the feature ID and threshold ID corresponding to the maximum score. If the optimal split point comes from the client's own first feature, the client knows how to split and performs the split to update the current tree, while also notifying the server: "Please split at value v based on feature F." The server then assigns the samples to left or right child nodes based on the value of its own feature F. If the optimal split point comes from the server's second feature, the client notifies the server: "Your feature F' is the optimal split point at value v. Please perform the split and tell me which side each sample is assigned to." The server performs the split based on the value of its own feature F', and then tells the client the sample partitioning results (e.g., sample ID → left / right node) to update the current tree.

[0154] Figure 5 This is a structural block diagram of the encoding and decoding device for unintentional key-value storage according to an embodiment of the present invention.

[0155] like Figure 5As shown, the unintentional key-value storage encoding and decoding device 400 includes an encoding module 410 and a decoding module 420.

[0156] The encoding module 410 is used to construct a linear equation system based on a preset key-value table, obtain the coefficient matrix of the linear equation system, solve the maximal linearly independent set of the coefficient matrix, add the preset key-value pairs corresponding to the rows in the maximal linearly independent set except for the linearly independent rows to the linearly dependent set, update the linear equation system based on the linearly dependent set, and obtain the encoding vector based on the updated linear equation system; the decoding module 420 is used to decode the query key based on the encoding vector and the linearly dependent set.

[0157] In some embodiments of the present invention, when updating a system of linear equations based on a set of linearly correlated elements, the encoding module 410 is specifically used to: delete the corresponding row of the set of linearly correlated elements in the coefficient matrix to update the coefficient matrix, and update the system of linear equations based on the updated coefficient matrix.

[0158] For example, the preset key-value table is The coefficient matrix is ​​represented by the following formula:

[0159]

[0160] in, Represents the coefficient matrix. This represents a base point pre-selected on the elliptic curve. Indicates the base point Adding itself i times yields a point on the elliptic curve. express Pointed coordinate; This indicates the number of key-value pairs in the preset key-value table. It is an integer greater than 1. This indicates the overhead required to store the preset key-value table. Indicates that the binary storage space is finite field, A coefficient representing the storage overhead of the preset key-value table; This represents mapping a binary string of arbitrary length to a length. A random function for binary strings, based on position functions. and Sure; Represents an integer of length 256 bits. ; express - Position functions, where mod represents modulo operation. This represents a bitwise XOR operation on a 0-1 vector. This represents a vector where the j-th position is 1 and all other positions are 0. satisfy .

[0161] In some embodiments of the present invention, when decoding the query key based on the encoding vector and the linear correlation set, the decoding module 420 is specifically used to: if there is a key-value pair containing the query key in the linear correlation set, then determine that the value in the key-value pair is the decoding result; if there is no key-value pair containing the query key in the linear correlation set, then use the formula... Calculate the target value, where, Indicates the target value. Represents the encoded vector. Indicates the query key; if If the result is true, the decoding result is determined to be the target value; otherwise, the decoding is determined to have failed.

[0162] It should be noted that for other specific embodiments of the unintentional key-value storage encoding / decoding device 400 of the present invention, please refer to the specific embodiments of the unintentional key-value storage encoding / decoding method of the above embodiments.

[0163] Figure 6 This is a structural block diagram of the discrete logarithm solver for small exponential elliptic curves according to an embodiment of the present invention.

[0164] like Figure 6 As shown, the discrete logarithm solver for small exponential elliptic curves 500 includes a decoding unit 510 and a solving unit 520.

[0165] The decoding unit 510 is used to, when point P is in a preset key-value table, utilize the encoding and decoding method of the unintentional key-value storage described in the above embodiment to decode the key based on the key corresponding to point P. Decoding is performed to obtain the first decoding result, and the set R is updated based on the first decoding result; the solution unit 520 is used to determine whether there exists a set R that satisfies the equation of At that time, As the small exponent obtained from the solution; where points P and G are points on the elliptic curve and satisfy... .

[0166] In some embodiments of the present invention, the decoding unit 510 is further configured to: when point P is in a preset linear list At that time, for each ,calculate ;exist At that time, , Middle Satisfaction of As the small exponent obtained from the solution.

[0167] In some embodiments of the present invention, the decoding unit 510 is further configured to: When, let the set and calculate ;calculate And using the unintentional key-value storage encoding and decoding method of the above embodiments to... Decode the data to obtain a second decoding result, and update the set R based on the second decoding result; calculate... And using the unintentional key-value storage encoding and decoding method of the above embodiments to... Decode the data to obtain a third decoding result, and update the set R based on the third decoding result; where, for The reverse of the model.

[0168] For example, updating set R based on the first decoding result includes: adding the first decoding result and its opposite to set R; updating set R based on the second decoding result includes: adding... The sum of the second decoding result, The sum of the opposites of the second decoding result is added to set R; set R is updated based on the third decoding result, including: The sum of the third decoding result, The sum of the opposites of the third decoding result is added to set R.

[0169] It should be noted that for other specific embodiments of the small exponential elliptic curve discrete logarithm solving device 500 of the present invention, please refer to the specific embodiments of the small exponential elliptic curve discrete logarithm solving method of the above embodiments.

[0170] The present invention also proposes a computer-readable storage medium.

[0171] In this embodiment, a computer program is stored on a computer-readable storage medium. When the computer program is executed by a processor, it implements at least one of the following embodiments: the encoding and decoding method for unintentional key-value storage, the method for solving small exponential elliptic curve discrete logarithms, and the federated learning method based on the longitudinal XGBoost algorithm.

[0172] Figure 7 This is a structural block diagram of a chip according to an embodiment of the present invention.

[0173] like Figure 7 As shown, chip 600 includes a processor 601 and a memory 603. The processor 601 and memory 603 are connected, for example, via a bus 602. Optionally, chip 600 may also include a transceiver 604. It should be noted that in practical applications, the transceiver 604 is not limited to one type, and the structure of chip 600 does not constitute a limitation on the embodiments of the present invention.

[0174] Processor 601 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this invention. Processor 601 may also be a combination that implements computational functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0175] Bus 602 may include a pathway for transmitting information between the aforementioned components. Bus 602 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. Bus 602 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 7 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0176] The memory 603 is used to store computer programs corresponding to at least one of the following embodiments of the present invention: the unintentional key-value storage encoding / decoding method, the small exponential elliptic curve discrete logarithm solution method, and the federated learning method based on the longitudinal XGBoost algorithm. These computer programs are executed under the control of the processor 601. The processor 601 executes the computer programs stored in the memory 603 to implement the content shown in the aforementioned method embodiments.

[0177] Figure 7 The chip 600 shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments of the present invention.

[0178] It should be noted that the logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be specifically implemented in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0179] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0180] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0181] In the description of this invention, it should be understood that the terms "center," "longitudinal," "lateral," "length," "width," "thickness," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," "clockwise," "counterclockwise," "axial," "radial," and "circumferential" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing this invention and simplifying the description, and are not intended to indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0182] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0183] In this invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," "linking," and "fixing," etc., should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components, unless otherwise explicitly limited. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0184] In this invention, unless otherwise explicitly specified and limited, "above" or "below" the second feature can mean that the first feature is in direct contact with the second feature, or that the first feature is in indirect contact with the second feature through an intermediate medium. Furthermore, "above," "over," and "on top" of the second feature can mean that the first feature is directly above or diagonally above the second feature, or simply that the first feature is at a higher horizontal level than the second feature. "Below," "below," and "under" the second feature can mean that the first feature is directly below or diagonally below the second feature, or simply that the first feature is at a lower horizontal level than the second feature.

[0185] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A method for encoding and decoding inadvertent key-value storage, characterized in that, Applied to data users, the method includes: For the query key, the query key is decoded based on the encoding vector and linear correlation set provided by the data provider; The encoding vector and the linear correlation set are obtained by the data provider in the following manner: A system of linear equations is constructed based on a preset key-value table, and the coefficient matrix of the system of linear equations is obtained; the maximal linearly independent set of the coefficient matrix is ​​solved, and the preset key-value pairs corresponding to the rows in the maximal linearly independent set other than the linearly independent rows are added to the linearly dependent set; the system of linear equations is updated based on the linearly dependent set, and the encoded vector is obtained based on the updated system of linear equations. Updating the system of linear equations based on the set of linear correlations includes: Delete the corresponding row of the linearly dependent set in the coefficient matrix to update the coefficient matrix, and update the system of linear equations based on the updated coefficient matrix; Decoding the query key based on the encoding vector and the linear correlation set includes: If a key-value pair containing the query key exists in the linearly correlated set, then the value in the key-value pair is determined to be the decoding result, wherein the decoding result is used for decryption.

2. The encoding and decoding method for unintentional key-value storage according to claim 1, characterized in that, The preset key-value table is as follows: The coefficient matrix is ​​represented by the following formula: in, Represents the coefficient matrix, This represents a base point pre-selected on the elliptic curve. Indicates the base point Adding the value to itself i times yields a point on the elliptic curve. express Pointed coordinate; This indicates the number of key-value pairs in the preset key-value table. It is an integer greater than 1. This indicates the overhead required to store the preset key-value table. Indicates that the binary storage space is finite field, A coefficient representing the storage overhead of the preset key-value table; This represents mapping a binary string of arbitrary length to a length. A random function for binary strings, based on position functions. and Sure; Represents an integer of length 256 bits. ; express - Position functions, where mod represents modulo operation. This represents a bitwise XOR operation on a 0-1 vector. This represents a vector where the j-th position is 1 and all other positions are 0. satisfy .

3. The encoding and decoding method for unintentional key-value storage according to claim 2, characterized in that, Decoding the query key based on the encoding vector and the linear correlation set further includes: If no key-value pair containing the query key exists in the linearly correlated set, the target value is calculated using the following formula: ， in, This represents the target value. This represents the encoded vector. This refers to the query key; like If the result is correct, the decoding result is determined to be the target value; otherwise, the decoding is determined to have failed.

4. A method for solving the discrete logarithm of a small exponential elliptic curve, characterized in that, The method for decrypting ciphertext point P includes: If point P is in the preset key-value table, then the encoding / decoding method of unintentional key-value storage as described in any one of claims 1-3 is used to process the key corresponding to point P. Decode the code to obtain the first decoding result; Update set R based on the first decoding result; If there exists a set R that satisfies the equation of Then As the small exponent obtained from the solution; Wherein, points P and G are points on the elliptic curve, and satisfy the following conditions: , , This indicates the number of key-value pairs in the preset key-value table. Indicates a preset linear list The number of elements in the middle, , It is an integer greater than 1.

5. The method for solving the discrete logarithm of a small exponential elliptic curve according to claim 4, characterized in that, The method further includes: If point P lies in a preset linear table In the middle, for each ,calculate ; like Then , Middle Satisfaction of As the small exponent obtained from the solution.

6. The method for solving the discrete logarithm of a small exponential elliptic curve according to claim 5, characterized in that, The method further includes; like Let set and calculate ; calculate And using the encoding / decoding method of unintentional key-value storage as described in any one of claims 1-3 to... Decode the data to obtain a second decoding result, and update the set R based on the second decoding result; calculate And using the encoding / decoding method of unintentional key-value storage as described in any one of claims 1-3 to... Decode the data to obtain a third decoding result, and update the set R based on the third decoding result; in, for The reverse of the model.

7. The method for solving the discrete logarithm of a small exponential elliptic curve according to claim 6, characterized in that, The update of set R based on the first decoding result includes: Add the first decoding result and its opposite to the set R; The update of set R based on the second decoding result includes: Will The sum of the second decoding result, The sum of the opposites of the second decoding result is added to the set R; The update of set R based on the third decoding result includes: Will The sum of the third decoding result, The sum of the opposites of the third decoding result is added to the set R.

8. The method for solving the discrete logarithm of a small exponential elliptic curve according to claim 6, characterized in that, It was calculated using the Montgomery technique.

9. A batch encryption method, characterized in that, The method includes: Obtain N first plaintexts and N second plaintexts, where N is an integer greater than 1; The N first plaintexts are encrypted using an elliptic curve cryptography algorithm to obtain N first encryption results, and the N second plaintexts are encrypted using an elliptic curve cryptography algorithm to obtain N second encryption results. Perform batch point addition operations on the N first encryption results and the N corresponding second encryption results, or perform batch scalar multiplication operations on the N first encryption results and the N second encryption results to obtain the target ciphertext; Wherein, the batch modular inverse involved in the batch point addition operation or batch scalar multiplication operation is obtained using the Montgomery technique, and the target ciphertext is decrypted using the small exponential elliptic curve discrete logarithm solution method as described in any one of claims 4-8.

10. A federated learning method based on the longitudinal XGBoost algorithm, characterized in that, For a client, the client includes a first feature of the sample and carries a label; the method includes: Generate a private key and a public key, and send the public key to the server; The first-order gradient and second-order gradient of each sample are calculated based on the current tree and the label of each sample, and the first-order gradient and the second-order gradient are encrypted respectively using the elliptic curve cryptography algorithm based on the public key; The encrypted first-order gradient and second-order gradient are sent to the server so that the server can perform homomorphic addition on the left subtree based on the public key, the encrypted first-order gradient, second-order gradient, and each split point. The left subtree homomorphic addition result sent by the server is received, and the left subtree homomorphic addition result is decrypted based on the private key using the small exponential elliptic curve discrete logarithm solution method as described in any one of claims 4-8, to obtain the left subtree gradient; The score of each split point is obtained based on the sum of the gradient of the left subtree and the gradient of the sample, and the current tree is updated based on the split point corresponding to the maximum score.

11. The federated learning method based on the longitudinal XGBoost algorithm according to claim 10, characterized in that, The score is obtained using the following formula: ， in, This represents the score value. This represents the gradient of the left subtree. Indicates the gradient of the right subtree. This represents the sum of the gradients of the samples, and and , This represents the penalty coefficient.

12. The federated learning method based on the longitudinal XGBoost algorithm according to claim 10, characterized in that, The result of the left subtree homomorphic addition is expressed by the following formula: ， ， Specifically, when performing homomorphic addition, the server uses the Montgomery technique to calculate the modular inverse. and And perform batch point addition operations based on the modulus inverse.

13. An encoding / decoding device for inadvertent key-value storage, characterized in that, For use by data users, the device includes: The decoding module is used to decode the query key based on the encoding vector and linear correlation set provided by the data provider. The encoded vector and the linear correlation set are obtained by the data provider through an encoding module, which is used for: A linear equation system is constructed based on a preset key-value table, and the coefficient matrix of the linear equation system is obtained. The maximal linearly independent set of the coefficient matrix is ​​solved, and the preset key-value pairs corresponding to the rows in the maximal linearly independent set other than the linearly independent rows are added to the linearly dependent set. The linear equation system is updated based on the linearly dependent set, and the encoding vector is obtained based on the updated linear equation system. When updating the system of linear equations based on the set of linear correlations, the encoding module is specifically used for: Delete the corresponding row of the linearly dependent set in the coefficient matrix to update the coefficient matrix, and update the system of linear equations based on the updated coefficient matrix; When the decoding module decodes the query key based on the encoding vector and the linear correlation set, it is specifically used for: If a key-value pair containing the query key exists in the linearly correlated set, then the value in the key-value pair is determined to be the decoding result, wherein the decoding result is used for decryption.

14. The encoding / decoding apparatus for unintentional key-value storage according to claim 13, characterized in that, The preset key-value table is as follows: The coefficient matrix is ​​represented by the following formula: in, Represents the coefficient matrix, This represents a base point pre-selected on the elliptic curve. Indicates the base point Adding the value to itself i times yields a point on the elliptic curve. express Pointed coordinate; This indicates the number of key-value pairs in the preset key-value table. It is an integer greater than 1. This indicates the overhead required to store the preset key-value table. Indicates that the binary storage space is finite field, A coefficient representing the storage overhead of the preset key-value table; This represents mapping a binary string of arbitrary length to a length. A random function for binary strings, based on position functions. and Sure; Represents an integer of length 256 bits. ; express - Position functions, where mod represents modulo operation. This represents a bitwise XOR operation on a 0-1 vector. This represents a vector where the j-th position is 1 and all other positions are 0. satisfy .

15. The encoding / decoding apparatus for unintentional key-value storage according to claim 14, characterized in that, When the decoding module decodes the query key based on the encoding vector and the linear correlation set, it is further configured to: If no key-value pair containing the query key exists in the linearly correlated set, the target value is calculated using the following formula: ， in, This represents the target value. This represents the encoded vector. This refers to the query key; like If the result is correct, the decoding result is determined to be the target value; otherwise, the decoding is determined to have failed.

16. A device for solving the discrete logarithm of a small exponential elliptic curve, characterized in that, The apparatus for decrypting ciphertext point P includes: The decoding unit is used to, when point P is in a preset key-value table, use the encoding and decoding method of unintentional key-value storage as described in any one of claims 1-3 to decode the key corresponding to point P. Decode the data to obtain a first decoding result, and update the set R based on the first decoding result; Solving unit, used to determine if there exists a set R that satisfies the equation of At that time, As the small exponent obtained from the solution; Wherein, points P and G are points on the elliptic curve, and satisfy the following conditions: , , This indicates the number of key-value pairs in the preset key-value table. Indicates a preset linear list The number of elements in the middle, , It is an integer greater than 1.

17. The apparatus for solving the discrete logarithm of a small exponential elliptic curve according to claim 16, characterized in that, The decoding unit is also used for: At point P in the preset linear table At that time, for each ,calculate ; exist At that time, , Middle Satisfaction of As the small exponent obtained from the solution.

18. The apparatus for solving the discrete logarithm of a small exponential elliptic curve according to claim 17, characterized in that, The decoding unit is also used for; exist When, let the set and calculate ; calculate And using the encoding / decoding method of unintentional key-value storage as described in any one of claims 1-3 to... Decode the data to obtain a second decoding result, and update the set R based on the second decoding result; calculate And using the encoding / decoding method of unintentional key-value storage as described in any one of claims 1-3 to... Decode the data to obtain a third decoding result, and update the set R based on the third decoding result; in, for The reverse of the model.

19. The apparatus for solving the discrete logarithm of a small exponential elliptic curve according to claim 18, characterized in that, The update of set R based on the first decoding result includes: Add the first decoding result and its opposite to the set R; The update of set R based on the second decoding result includes: Will The sum of the second decoding result, The sum of the opposites of the second decoding result is added to the set R; The update of set R based on the third decoding result includes: Will The sum of the third decoding result, The sum of the opposites of the third decoding result is added to the set R.

20. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1-12.

21. A chip, characterized in that, It includes a memory, a processor, and a computer program stored on the memory, which, when executed by the processor, implements the method as described in any one of claims 1-12.

Images