Method for executing cryptographic computing and computing device

Abstract

The invention discloses a method for executing secret state calculation and calculation equipment. A first participant randomly samples and determines a first parameter in a first interval, randomly samples and determines a second parameter in a second interval for any to-be-encrypted data, multiplies the first parameter with the to-be-encrypted data, adds the multiplication result with the second parameter, and calculates the secret state of the to-be-encrypted data. Determining ciphertext data corresponding to the to-be-encrypted data, and sending the ciphertext data to a second participant; the second participant performs a plurality of rounds of encryption operation on the ciphertext data according to a preset calculation task, determines an operation result of a final round, sends the operation result to the first participant, the first participant decrypts the operation result according to a first parameter, determines a plaintext calculation result, and sends the plaintext calculation result to the second participant, and the second participant sends the plaintext calculation result to the third participant. According to the method, the homomorphic operation of the ciphertext data can be completed, the operation results of the homomorphic operation can be sorted in size under the condition that the plaintext data is not leaked, and the requirement of the cryptographic calculation requirement for the diversity of operators can be met.

Description

(19) State Intellectual Property Office (12) Invention Patent Application (10) Application Publication Number (43) Application Publication Date (21) Application Number 202511328194.2 (22) Application Date 2025.09.16 (71) Applicant Ant Blockchain Technology (Shanghai) Co., Ltd. Address Room 803, 8th Floor, No. 618 Waima Road, Huangpu District, Shanghai 200010 (72) Inventors Wang Xin, Sun Dongni, Liang Zhichuang, Lin Li, Wu Xingxing (74) Patent Agency Beijing Yiteng Intellectual Property Agency (General Partnership) 11309 Patent Attorney Zhang Jingjuan, Zhou Liangyu (51) Int.Cl. H04L 9 / 06 (2006.01) H04L 9 / 00 (2022.01) (54) Invention Title: A Method and Computing Device for Performing Encrypted Calculations (57) Abstract: A method and computing device for performing encrypted calculations, wherein a first participant randomly samples in a first interval to determine a first parameter, randomly samples in a second interval for any data to be encrypted to determine a second parameter, multiplies the first parameter with the data to be encrypted, adds the multiplication result to the second parameter to determine the ciphertext data corresponding to the data to be encrypted, and sends the ciphertext data to a second participant; the second participant performs several rounds of encrypted calculations on the ciphertext data according to a preset calculation task to determine the final round of calculation results, the encrypted calculations include size sorting and addition operations, and sends the calculation results to the first participant, the first participant decrypts the calculation results according to the first parameter to determine the plaintext calculation result, which can complete the homomorphic operation on the ciphertext data, and can also sort the results of the homomorphic operation without disclosing the plaintext data, which can meet the requirements of encrypted calculation for the diversity of operators.Claims (2 pages), Description (15 pages), Drawings (3 pages), CN 121173457 A, 2025.12.19, CN 1 21 17 34 57 A. 1. A method for performing encrypted computation, the method involving at least a first participant and a second participant, the method comprising: the first participant randomly sampling in a first interval to determine a first parameter; for any data to be encrypted in a dataset to be encrypted, randomly sampling in a second interval to determine a second parameter; multiplying the first parameter by the data to be encrypted, and adding the multiplication result to the second parameter to determine the ciphertext data corresponding to the data to be encrypted, wherein the lower limit of the first interval is greater than twice the upper limit of the second interval, and the quantitative relationship between the lower limit of the first interval and the upper limit of the second interval is determined according to a preset security coefficient; the data to be encrypted is integer data; sending multiple ciphertext data corresponding to the dataset to be encrypted to the second participant; the second participant performing several rounds of encrypted computation on the multiple ciphertext data according to a preset computation task. 1. The method of claim 1, wherein the encrypted operation of any round specifically includes: if the sum of the number of addition operations between the first ciphertext and the second ciphertext does not exceed an addition threshold, performing an addition operation on the first ciphertext and the second ciphertext to determine the operation result corresponding to the first ciphertext and the second ciphertext, wherein the first ciphertext and the second ciphertext are both ciphertext data that has not undergone encryption operation or the operation result of the previous round of the current round, and the addition threshold is determined based on the difference between the lower limit of the first interval and the upper limit of the second interval. 3. The method of claim 1, wherein decrypting the several operation results according to the first parameter to determine several plaintext operation results specifically includes: for any operation result among the several operation results, dividing the operation result by the first parameter and rounding it to determine the plaintext operation result corresponding to the operation result.4. The method as described in claim 3, wherein each piece of data to be encrypted belongs to a third interval, and the encrypted operation in which the product of the upper limit of the third interval and the upper limit of the second interval is less than the lower limit of the first interval further includes multiplication operations; the encrypted operation in any round specifically includes: performing multiplication operations on the third ciphertext and the fourth ciphertext, determining the operation result corresponding to the third ciphertext and the fourth ciphertext, and determining the ciphertext multiplication implementation count corresponding to the operation result of the third ciphertext and the fourth ciphertext based on the ciphertext multiplication implementation count of each of the third ciphertext and the fourth ciphertext, wherein the third ciphertext and the fourth ciphertext are both ciphertext data that have not undergone encryption operations or the operation result of the previous round of the current round; sending the plurality of operation results to the first participant specifically includes: sending the plurality of operation results and the number of ciphertext multiplication implementations corresponding to each operation result to the first participant; decrypting the plurality of operation results according to the first parameter to determine a plurality of plaintext calculation results specifically includes: decrypting the plurality of operation results according to the first parameter and the number of ciphertext multiplication implementations to determine a plurality of plaintext calculation results. Claims 1 / 2 Page 2 CN 121173457 A 5. The method of claim 4, wherein the plurality of operation results are decrypted according to the first parameter and the number of ciphertext multiplications to determine a plurality of plaintext calculation results, specifically including: For any operation result among the plurality of operation results, the operation result is divided by the first parameter to the power of (k+1) to determine the plaintext calculation result corresponding to the operation result, where k is the number of ciphertext multiplications corresponding to the operation result. 6. The method of claim 5, further comprising: The first participant converts each original data in the original dataset to determine a dataset to be encrypted consisting of integer data to be encrypted, wherein each original data is a fixed-point decimal data of the same dimension. 7. The method of claim 6, wherein the original data in the original dataset is converted to determine a dataset to be encrypted consisting of integer data to be encrypted, specifically including: For any original data in the original dataset, the decimal places of the original data are marked as integer places to determine the integer data to be encrypted corresponding to the original data. After determining several plaintext calculation results, the method further includes: For any plaintext calculation result, marking the last k*f bits of the plaintext calculation result as decimal places, and determining the fixed-point decimal calculation result corresponding to the plaintext calculation result, where f is the number of decimal places of each original data.8. The method as described in claim 4, wherein the encrypted operation in any round specifically includes: for the fifth and sixth ciphertexts among a plurality of unsorted ciphertexts, subtracting the fifth and sixth ciphertexts; determining the sorting result of the plaintext calculation results corresponding to the fifth and sixth ciphertexts based on the sign of the difference between the fifth and sixth ciphertexts; wherein the plurality of unsorted ciphertexts are either ciphertext data that has not undergone encryption operation or the operation results of the previous round of the current round, and the plurality of unsorted ciphertexts participate in the same number of multiplication operations between ciphertexts; and determining several operation results corresponding to the current round among the plurality of unsorted ciphertexts based on the sorting result of the plurality of plaintext calculation results corresponding to the plurality of unsorted ciphertexts. 9. A method for performing encrypted computation, the method involving at least a first participant and a second participant, the method being applied to the first participant, the method comprising: randomly sampling in a first interval to determine a first parameter; randomly sampling in a second interval for any data to be encrypted in a dataset to be encrypted to determine a second parameter; multiplying the first parameter by the data to be encrypted, and adding the multiplication result to the second parameter to determine ciphertext data corresponding to the data to be encrypted, wherein the lower limit of the first interval is greater than twice the upper limit of the second interval, and the quantitative relationship between the lower limit of the first interval and the upper limit of the second interval is determined according to a preset security coefficient; the data to be encrypted is integer data; sending multiple ciphertext data corresponding to the dataset to be encrypted to the second participant; decrypting the multiple computation results according to the first parameter to determine multiple plaintext computation results, wherein the multiple computation results are sent by the second participant, the multiple computation results are the final round of multiple computation results after the second participant performs multiple rounds of encrypted computation on the multiple ciphertext data, the multiple rounds of encrypted computation are performed according to a preset computation task, the encrypted computation including sorting and addition operations. 10. A computing device, comprising a memory and a processor, wherein executable code is stored in the memory, and the processor, when executing the executable code, implements the method as described in any one of claims 1-9. Claims 2 / 2 Page 3 CN 121173457 A A Method and Computing Device for Performing Secret Computation Technical Field

[0001] The embodiments of this specification belong to the field of data processing technology, and particularly relate to a method and computing device for performing secret computation. Background Art

[0002] Privacy-Preserving Computing (PPC) is a technical system that achieves data sharing, collaborative computing, and analysis under the premise of protecting data privacy. The parties involved in privacy computing do not wish to expose their plaintext data to each other, but each party needs to utilize the data resources or computing resources of other parties to achieve its own data development goals.This creates a demand for encrypted computing.

[0003] The implementation of encrypted computing typically relies on homomorphic encryption (HE) technology. Encrypting plaintext with HE technology yields special encrypted data. Using special operators in the encrypted state to perform operations on this encrypted data results in a computational result that, after decryption, is identical to the result of performing the same type of operation directly on the plaintext data. In other words, homomorphic encryption technology allows for data computation without revealing the plaintext data.

[0004] However, existing homomorphic encryption solutions have a limited number of operators that can be implemented in the encrypted state, making it difficult to meet the data computation needs of all privacy-preserving computing scenarios.

[0005] Therefore, a technical solution for performing encrypted computing is urgently needed to at least partially solve the above-mentioned problems.

[0006] The purpose of this invention is to provide a method and computing device for performing encrypted computation, comprising:

[0007] A first aspect of this specification provides a method for performing encrypted computation, the method involving at least a first participant and a second participant, the method comprising:

[0008] The first participant randomly samples in a first interval to determine a first parameter; for any data to be encrypted in the dataset to be encrypted, randomly samples in a second interval to determine a second parameter; multiplies the first parameter with the data to be encrypted, and adds the multiplication result to the second parameter to determine the ciphertext data corresponding to the data to be encrypted, wherein the lower limit of the first interval is greater than twice the upper limit of the second interval, and the quantitative relationship between the lower limit of the first interval and the upper limit of the second interval is determined according to a preset security coefficient; the data to be encrypted is integer data; and multiple ciphertext data corresponding to the dataset to be encrypted are sent to the second participant;

[0009] The second participant performs several rounds of encrypted operations on the multiple encrypted data according to a preset calculation task, and determines several calculation results of the final round. The encrypted operations include size sorting and addition operations. The several calculation results are sent to the first participant.

[0010] The first participant decrypts the several calculation results according to the first parameter and determines several plaintext calculation results.

[0011] A second aspect of this specification provides a method for performing encrypted computation, the method involving at least a first participant and a second participant, the method being applied to the first participant, the method comprising:

[0012] randomly sampling in a first interval to determine a first parameter;

[0013] randomly sampling in a second interval for any data to be encrypted in the dataset to be encrypted to determine a second parameter;

[0014] multiplying the first parameter by the data to be encrypted, and adding the multiplication result to the second parameter to determine the ciphertext data corresponding to the data to be encrypted, wherein the lower limit of the first interval is greater than twice the upper limit of the second interval, and the quantitative relationship between the lower limit of the first interval and the upper limit of the second interval is determined according to a preset security coefficient; the data to be encrypted is integer data;

[0015] sending multiple ciphertext data corresponding to the dataset to be encrypted to the second participant;

[0016] According to the first parameter, several operation results are decrypted to determine several plaintext calculation results. The several operation results are sent by the second participant and are the final round of operation results after the second participant performs several rounds of encrypted operations on the multiple ciphertext data. The several rounds of encrypted operations are performed according to a preset calculation task. The encrypted operations include sorting and addition operations.

[0017] A third aspect of this specification provides a computing device, including a memory and a processor. The memory stores executable code. When the processor executes the executable code, it implements the method described in the first or second aspect.

[0018] An embodiment of this specification provides a technical solution for performing encrypted calculations. This solution can not only perform homomorphic operations on ciphertext data but also sort the results of homomorphic operations without revealing the plaintext data. The sorting results can match the results of directly sorting the plaintext calculation results, thus meeting the requirements of encrypted calculations for operator diversity.

[0019] Brief Description of the Drawings: To more clearly illustrate the technical solutions of the embodiments of this specification, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 is a schematic diagram of the relationship between the parties performing encrypted computation in an embodiment of this specification;

[0021] Figure 2 is a flowchart of a method for performing encrypted computation in an embodiment of this specification;

[0022] Figure 3 is a schematic diagram of the influence of multiplication operation on the data size of encrypted data in an embodiment of this specification.Detailed Implementation Modes

[0023] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of this specification. Obviously, the described embodiments are only a part of the embodiments of this specification, rather than all the embodiments. Based on the embodiments in this specification, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the scope of protection of this specification.

[0024] Currently, existing homomorphic encryption algorithms mostly focus on implementing homomorphic operations of multiplication and addition in the encrypted state. According to the implementation of multiplication operators and addition operators in each homomorphic encryption algorithm, homomorphic encryption algorithms can be roughly divided into two categories: partial homomorphic encryption algorithms that can only implement one of the multiplication operator or the addition operator, and fully homomorphic encryption algorithms that can simultaneously implement the multiplication operator and the addition operator.

[0025] However, even fully homomorphic encryption algorithms have data operation requirements that they cannot handle. Although combining the multiplication operator and the addition operator can meet the data operation requirements in most cases, existing homomorphic encryption algorithms often destroy the relative order relationship of plaintext data during the encryption process. This means that if the plaintext data x < y, the corresponding encrypted data Enc(x) < Enc(y) does not necessarily hold. Therefore, existing homomorphic encryption methods often cannot implement sorting operators.

[0026] It should be noted that,诚然, there are encryption algorithms that can preserve the relative order relationship of plaintext data during the encryption process. Such algorithms are also called order-preserving encryption algorithms. However, the general order-preserving encryption algorithms only support sorting operators and do not support further processing of encrypted data (that is, order-preserving encryption algorithms are often not homomorphic encryption algorithms and do not support the implementation of multiplication operators and addition operators).

[0027] However, in data processing scenarios, there is a common type of requirement - after processing the original data, sort the processing results. For example, the statistical user data includes weight and height. It is necessary to calculate the Body Mass Index (BMI) based on the weight and height, and then sort the body mass index of each user; another example is that after determining each feature vector, further determine the similarity degree between each feature vector (usually need to calculate the distance between each feature vector and sort the distances). Using existing encryption algorithms cannot meet the above requirements. Therefore, this specification provides a technical solution for performing encrypted calculations, which can achieve order-preserving homomorphic encryption of ciphertext data.

[0028] FIG. 1 shows a schematic diagram of the relationship between the parties participating in performing encrypted calculations. It should be noted that the Chinese character "诚然" in the original text is directly translated as "诚然" in the English text, which is a literal translation. In English, it can be more accurately expressed as "it is true that" or "certainly". However, according to the requirements, the literal translation is retained here.As shown in the figure, the first participant is the holder of the privacy data, but the first participant is limited by computing resources and does not have the ability to directly process the data; the second participant is the holder of computing resources. The first participant needs to use the computing resources of the second participant to process its own privacy data, but the first participant does not want its own privacy data to be directly exposed to the second participant. Thus, the need for encrypted computation arises.

[0029] It should be noted that the first participant can be understood as a relevant organization with data processing needs, or as a computing device or computing node; correspondingly, the second participant can be understood as a relevant organization with data processing capabilities, or as a computing device or computing node, and this specification does not impose any restrictions here.

[0030] On the other hand, this specification does not impose any restrictions on the number of participants in encrypted computation. That is, encrypted computation can be jointly performed by several first participants and several second participants. As long as each first participant uses the same key to encrypt its own privacy data, the second participant can use the encrypted data from different first participants to perform encrypted computation.

[0031] Figure 2 shows a flowchart of a method for performing encrypted computation according to an embodiment of this specification. The method includes:

[0032] Step S201: The first participant randomly samples in a first interval to determine a first parameter; for any data to be encrypted in the dataset to be encrypted, randomly samples in a second interval to determine a second parameter; multiplies the first parameter with the data to be encrypted, and adds the multiplication result to the second parameter to determine the ciphertext data corresponding to the data to be encrypted, wherein the lower limit of the first interval is greater than twice the upper limit of the second interval, and the quantitative relationship between the lower limit of the first interval and the upper limit of the second interval is determined according to a preset security coefficient; the data to be encrypted is integer data; and multiple ciphertext data corresponding to the dataset to be encrypted are sent to the second participant.

[0033] First, the first participant determines the data to be encrypted, which consists of several data to be encrypted that it needs to calculate. Each data to be encrypted is encrypted separately. The encryption process can refer to the following formula:

[0034] c = Enc(M) = qM + r

[0035] Wherein, M represents the data to be encrypted; Enc(·) represents encryption; q represents the first parameter; r represents the second parameter; c represents the ciphertext data corresponding to the data to be encrypted. In addition, the first parameter, the second parameter, and the data to be encrypted are all positive integers.

[0036] After the encryption of each data to be encrypted in the dataset to be encrypted is completed, the encrypted ciphertext data can be transmitted to the second participant. Specification 3 / 15 page 6 CN 121173457 A

[0037] It should be noted that the data to be encrypted can be represented in various forms such as vectors and matrices.In addition, according to the characteristics of the encryption method used in this embodiment, the data types of the data to be encrypted, the first parameter, and the second parameter must be integer data to ensure that the subsequent decryption process can obtain the correct result. That is, if the data to be encrypted is a vector, each element in the vector must be an integer, and so on. Therefore, if the type of the original data collected by the first participant is not an integer, the first participant can convert the original data into an integer to obtain the corresponding data to be encrypted.

[0038] The first parameter can also be understood as a key. In one implementation of the method shown in Figure 2, different data to be encrypted correspond to the same first parameter; the second parameter can also be understood as noise. In one implementation of the method shown in Figure 2, the second parameters corresponding to different data to be encrypted are independent of each other, but each second parameter must be sampled from the same second interval. The first parameter is collected from the first interval, and the lower limit of the first interval is more than twice the upper limit of the second interval. This ensures that each second parameter is less than the first parameter, and thus ensures that the calculation result of each encrypted data after the encrypted operation can be correctly decrypted (the relationship between the correctness of the encrypted operation and the parameter range limit will be introduced in more detail later).

[0039] On the other hand, the following proves the security of the encryption method used in this embodiment.

[0040] First, the Approximate Common Divisor Assumption (ACCA) is introduced—for a given set of integers with approximate error, it is computationally infeasible to find the exact common factor without additional information—that is, it is computationally difficult to decompose large integers into prime factors. The set of integers with approximate error can be understood as n1, n2, ..., nk, where ni = d·mi + eii = 1, 2, ..., k, where d, mi, and ni are all integers, and ei << d. Finding the exact common factor is to determine the value of d based on n1, n2, ..., nk.

[0041] Referring to the encryption process in this embodiment, if the ciphertext data c is substituted into ni, even if the second participant obtains multiple ciphertext data ci, according to the approximate common factor assumption, the second participant cannot recover the first parameter q, and therefore cannot obtain the plaintext M, thus ensuring the security of the encryption method used in this embodiment.

[0042] It should be noted that in the approximate common factor assumption, ni must be a large integer. Corresponding to this embodiment, the ciphertext data c must be a large integer. Furthermore, the security of this encryption method depends on the size of the first interval and the second interval in the encryption method. Therefore, the quantitative relationship between the lower limit of the first interval and the upper limit of the second interval can be determined according to the preset security coefficient.

[0043] Wherein, the security coefficient is also called the number of security bits or security strength.For a cryptographic system, if the most effective attack method currently known requires approximately 2λ "basic operations" (for a symmetric key, one basic operation is the complete process of encryption and decryption using one key) to break the cryptographic system with a non-negligible probability, then the security coefficient of the cryptographic system is "λ-bit".

[0044] Corresponding to this embodiment, this security coefficient can be set by the executor of the method shown in Figure 2, representing the security requirements of the executor for this embodiment. Typically, λ can take values ​​such as 80, 128, 256, etc. Different values ​​correspond to different attack strengths of the attack methods that this embodiment will deal with.

[0045] Specifically, if the first interval is represented as [2η, a], a>2η, and the second interval is represented as [b, 2ρ], b<2ρ. Then, η-ρ must satisfy:

[0046] η-ρ>λ+s

[0047] Wherein, η-ρ can represent the size of the noise relative to the key. The smaller the noise is relative to the key, the more difficult it is to crack the approximate common factor assumption; the meaning of λ can be referred to above, and s represents the security margin, which can usually be set to 32.

[0048] Step S203: The second participant, according to the preset calculation task, performs several rounds of cryptographic operations on the multiple ciphertext data, and determines several operation results of the final round. The cryptographic operations include size sorting and addition operations; and sends the several operation results to the first participant.

[0049] After receiving each ciphertext data transmitted by the first participant, the second participant can perform several rounds of cryptographic operations on each ciphertext data. The preset calculation task can be determined by the first calculation party according to its own data processing needs; the calculation task can show the second participant the total number of rounds of the required encrypted operation, the type of the required encrypted operation, and the order of the required encrypted operations. Thus, the second participant can execute the data processing needs of the first calculation party according to the preset calculation task.

[0050] In this embodiment, the calculation steps when performing encrypted operations on encrypted data are the same as the calculation steps when performing the corresponding calculation type on plaintext data. That is, in this embodiment, the addition operator in the addition operation in the encrypted operation is implemented by performing addition in algebraic operations on the encrypted data. The aforementioned characteristics can be expressed as the following formula:

[0051]

[0052] Wherein, represents the addition operator in the encrypted operation, c1 and c2 can both represent encrypted data, c1 = qM1 + r1, c2 = qM2 + r2; + represents addition in algebraic operations, and other parameters can be referred to above.

[0053] On the other hand, the multiplication operator in the encrypted operation is implemented by performing algebraic multiplication on the encrypted data. The aforementioned characteristics can be expressed as the following formula:

[0054]

[0055] Wherein, represents the multiplication operator in the encrypted operation; c3 and c4 can both represent encrypted data, c3 = qM3 + r3, c4 = qM4 + r4; M3 and M4 represent plaintext data, which are integers; * represents multiplication in algebraic operation, and other parameters can be referred to the above.

[0056] In some implementations, the encrypted operation may also include subtraction on the encrypted data. The subtraction operation can be implemented by a subtraction operator. Similar to the content described above, the subtraction operator is implemented by performing algebraic subtraction on the encrypted data:

[0057]

[0058] Wherein, represents the subtraction operator in the encrypted operation; c1 and c2 represent encrypted data; - represents subtraction in algebraic operation.

[0059] Based on the subtraction operator, this embodiment can implement a sorting operator to sort the ciphertext data by size. For the ciphertext data c5 and c6, the sorting operator is performed on c5 and c6, that is, firstly, the subtraction operator is performed on c5 and c6, and the result of the operation is then compared with 0. If the result is greater than the data M5 to be encrypted corresponding to c5, then the data M6 to be encrypted corresponding to c6 is greater than the data M6 to be encrypted corresponding to c6; otherwise, the data M5 to be encrypted corresponding to c5 is less than the data M6 to be encrypted corresponding to c6.

[0060] It should be noted that in step S203, the second participant can perform several rounds of encrypted state operations on the multiple ciphertext data. This also means that the size sorting of the operation results obtained after processing the ciphertext data by the addition or multiplication operator can still be achieved normally. In other words, after sorting the size of each operation result, the sorting result obtained can correctly reflect the size relationship between the plaintext calculation results corresponding to each operation result.

[0061] In some implementations, in step S203 as shown in FIG2, for the fifth ciphertext and the sixth ciphertext among the multiple unsorted ciphertexts, the difference between the fifth ciphertext and the sixth ciphertext is calculated. Based on the sign of the difference between the fifth ciphertext and the sixth ciphertext, the sorting result of the plaintext calculation results corresponding to the fifth ciphertext and the sixth ciphertext is determined. Among them, the multiple unsorted ciphertexts are all ciphertext data that has not undergone encryption operation or the operation result of the previous round of the current round. The multiple unsorted ciphertexts participate in the same number of multiplication operations between ciphertexts. Based on the sorting result of the multiple plaintext calculation results corresponding to the multiple unsorted ciphertexts, several operation results corresponding to the current round are determined among the multiple unsorted ciphertexts.

[0062] This characteristic of the encryption method provided in this embodiment can also be called the order preservation property after homomorphic operation. Various encryption methods in the prior art are unable to solve the related problems mentioned above, such as using ciphertext data to sort plaintext data by distance, precisely because they do not possess this characteristic.

[0063] On the other hand, since the encryption method provided in this embodiment possesses the order preservation property after homomorphic operation, if the operation results of each round of ciphertext operation are substituted into the formulas mentioned above as ciphertext data for calculation, the formulas will still be valid. For the sake of completeness and coherence of the embodiment description, this specification will prove the correctness of the encryption method provided in this embodiment in the following text, and then prove the order preservation property.

[0064] Hereinafter, taking the calculation task as "determining the data to be encrypted that is closest to the data to be encrypted M1" as an example, this embodiment gives the implementation method of performing several rounds of ciphertext operation according to the calculation task.

[0065] In order to realize this calculation task, it is first necessary to calculate the distance between each ciphertext data and the ciphertext data c1 (the ciphertext data corresponding to the plaintext data M1). For two encrypted data, for example, denoted as c1 and c2, the distance can be calculated using common distance calculation formulas, such as Euclidean distance calculation and Manhattan distance calculation. Here, we will take Euclidean distance calculation as an example. For encrypted data c1 and c2, their Euclidean distance can be expressed as: Of course, the square root operation is still difficult to implement in this embodiment. However, if it is necessary to compare the magnitudes of the Euclidean distances, the comparison result after calculating (c1-c2)2 is the same as the comparison result after further square root.

[0066] Therefore, the first round of iterative calculation can execute the subtraction operator, and perform a subtraction operation on encrypted data c1 and each encrypted data other than c1. Taking encrypted data c1 and c2 as an example, the subtraction operation on c1 and c2 can obtain the operation result or one of the two.

[0067] Subsequently, the second round of iterative calculation can execute a multiplication operator, exponentiating the result of each subtraction operation (i.e., multiplying the result of each subtraction operation by itself). Taking encrypted data c1 and c2 as an example, the calculated result can represent the distance between c1 and c2.

[0068] In the final round, that is, the third round of iterative calculation, a sorting operator can be executed, where c1,i represents the distance between ciphertext data c1 and ciphertext data ci. The calculation results of the second round have determined the calculation results c1,2, c1,3, c1,4, etc. The sorting operator is executed on each calculation result to determine the value of i in c1,i with the smallest value. Then, the ci with the corresponding label is the ciphertext data closest to c1. Accordingly, the Mi corresponding to this ci is the data to be encrypted that is closest to M1.

[0069] Thus, the calculation task of “determining the data to be encrypted that is closest to the data to be encrypted M1” can be completed by using the operators corresponding to the encrypted state operation in this embodiment.

[0070] It should be noted that the above content is only to illustrate how to implement a preset calculation task by using the method shown in Figure 2. Regarding the specific content of the calculation task, this specification does not limit it here. The preset calculation task can be set by the user according to their own needs. For example, it can be "clustering each encrypted data to determine several clustering centers", "using each encrypted data for model training, etc.". If the calculation process in a calculation task can be implemented by each operator supported in this embodiment, then this embodiment can implement this calculation task.

[0071] After completing the ciphertext operations in the final round, the second participant can send several operation results of the final round to the first participant.

[0072] It should be noted that according to the differences in the calculation tasks, when the ciphertext operation corresponding to the final round is sorting, the operation results corresponding to the final round can be several ciphertext data screened according to the sorting results (or the operation results of the previous round screened according to the sorting results), or can directly be the sorting results, and the sorting results show the arrangement order of the ciphertext data. When the operation result of the final round is the sorting result, after the second participant sends the sorting result to the first participant, the first participant can determine the arrangement order of the data to be encrypted according to the correspondence between the ciphertext data and the data to be encrypted without decrypting.

[0073] Step S205: The first participant decrypts the several operation results according to the first parameter to determine several plaintext calculation results.

[0074] After the first participant receives the several operation results transmitted by the second participant, it can decrypt each operation result, and then can determine the plaintext calculation result corresponding to each operation result.

[0075] In some implementation manners, for any one of the several operation results, divide the operation result by the first parameter and take the integer to determine the plaintext calculation result corresponding to the operation result.

[0076] Specifically, the decryption method can refer to the following formula:

[0077]

[0078] Among them, Dec(·) represents decryption; represents rounding towards zero, that is, discarding the fractional part of the elements within, for example C represents the operation result; M represents the plaintext calculation result corresponding to the operation result C; the interpretations of other parameters can refer to the previous text.

[0079] The following gives the correctness proof of this encryption process.

[0080] Since M is an integer, so and because r < q, In summary, Dec(c) = M naturally holds, and this decryption process can correctly decrypt to obtain the data to be encrypted corresponding to the ciphertext data.

[0081] Of course, the above proof of the correctness of the decryption process is not rigorous. In the decryption process, the operation result is equated to the ciphertext data. In fact, the operation result may also be obtained after the ciphertext data undergoes several rounds of ciphertext operations.

[0082] The following uses the first ciphertext c′1 and the second ciphertext c′2 as examples to prove the correctness of the result of the addition operation after decryption. It should be noted that the first ciphertext, the second ciphertext, and the third, fourth, fifth, and sixth ciphertexts mentioned later can all be encrypted data or the result of any round of encrypted operation. This will not be elaborated on in the following text.

[0083] First,

[0084] c′1=qM′1+r′1, c′2=qM′2+r′2

[0085] For the result of the addition operation of c′1 and c′2—

[0086]

[0087] Thus,

[0088]

[0089] As mentioned above, the second parameter of each ciphertext data is less than the first parameter. Therefore, it can be proved that the decrypted value of the result of the addition operation of the ciphertext data is exactly the same as the value of the data to be encrypted directly added to the corresponding ciphertext data.

[0090] It should be noted that since the first ciphertext may be the result of any round of encrypted operation, if the first ciphertext (page 7 / 15, CN 121173457 A) is the result of multiple ciphertext data after addition, then r′1 may be greater than q. Since the correctness of the decryption process depends on the establishment of r′1, that is, on the total noise being less than q, if this is not restricted, the total noise may be greater than q, which may lead to the decryption process failing to obtain the correct result.

[0091] Therefore, in some implementations, in step S203 as shown in FIG2, if the sum of the number of addition operations between the first ciphertext and the second ciphertext does not exceed the addition threshold, the first ciphertext and the second ciphertext are added to determine the operation result corresponding to the first ciphertext and the second ciphertext. Here, the first ciphertext and the second ciphertext are both ciphertext data that have not undergone encryption operation or the operation result of the previous round of the current round. The addition threshold is determined according to the difference between the lower limit of the first interval and the upper limit of the second interval.

[0092] First, the meaning of the addition threshold is explained here. Taking the first ciphertext M′1 as an example, it is easy to understand that if M′1 is ciphertext data that has not undergone encryption, then the number of times M′1 participates in the addition operation between ciphertexts is 0. If M′1 is the result of the operation in the previous round, taking the encryption operation performed in the previous round as adding the seventh ciphertext M′7 and the eighth ciphertext M′8 as an example, then M′1 can be expressed as M′1=M′7+M′8. Furthermore, the seventh and eighth ciphertexts can still be further split until the first ciphertext is split into the sum of several ciphertext data that have not undergone encryption. Thus, the number of times the first ciphertext participates in the addition operation between ciphertexts can be determined. When the first ciphertext can be divided into the sum of n′ ciphertext data that have not undergone encryption, then the number of times the first ciphertext participates in the addition operation between ciphertexts is n′-1.

[0093] The setting of the addition threshold is further described below.

[0094] Among them, the first interval can be expressed as, for example:

[0095] [2η,a], a>2η

[0096] The second interval can be expressed as, for example:

[0097] [b,2ρ], b<2p

[0098] where both ρ and η are integers, and ρ<η. Then the addition threshold can be set to 2η - ρ - 2.

[0099] It is easy to understand that under the conditions of the above first interval and second interval, r<2ρ, q>2η. From this, it can be obtained that by transforming the previous formula, that is, for any ciphertext data, the second parameter of this ciphertext data must satisfy that after sequentially performing addition operations on n ciphertext data (which is also equivalent to adding these n ciphertext data), the total noise in the obtained operation result is denoted as rn (here n is a superscript and does not represent exponentiation), then to ensure rn<q, it is necessary to satisfy n<2η - ρ.

[0100] Substitute the first ciphertext and the second ciphertext for understanding. If performing an addition operation on the first ciphertext and the second ciphertext is equivalent to adding n ciphertext data, then the sum of the number of times the first ciphertext and the second ciphertext participate in the addition operation between ciphertexts is n - 2. It has been deduced from the previous text that n<2η - ρ, and further,

[0101] n - 2<2η - ρ - 2

[0102] From this, it can be determined that the addition threshold is 2η - ρ - 2.

[0103] The proof process of the correctness of the operation result after the subtraction operation after encryption is similar to the previous text and will not be elaborated here.

[0104]

[0105] It should be noted that the decryption method of the operation result after the multiplication operation is different from the decryption method of the operation result without the multiplication operation. For the decryption method of the operation result after the multiplication operation, in addition to the first parameter, it also depends on the number of times of ciphertext multiplication implementation of this operation result. DESCRIPTION 8 / 15 pages 11 CN 121173457 A

[0106] Thus, in some implementation manners, in step S203 shown in FIG. 2, a multiplication operation is performed on the third ciphertext and the fourth ciphertext to determine the operation result corresponding to the third ciphertext and the fourth ciphertext, and according to the number of times of ciphertext multiplication implementation of the third ciphertext and the fourth ciphertext respectively, determine the number of times of ciphertext multiplication implementation corresponding to the operation result of the third ciphertext and the fourth ciphertext, where the third ciphertext and the fourth ciphertext are both ciphertext data that have not undergone encryption operations or the operation results of the previous round of the current round; further, after the first participation method determines a plurality of operation results of the final round, it can also send the plurality of operation results and the number of times of ciphertext multiplication implementation corresponding to each operation result to the first participant; finally, in step S205 shown in FIG. 2, the first participant decrypts the plurality of operation results according to the first parameter and the number of times of ciphertext multiplication implementation to determine a plurality of plaintext calculation results.

[0107] Taking the third ciphertext c′3 and the fourth ciphertext c′4 as an example, the result of the multiplication operation of c′3 and c′4 can be recorded as the decryption method. The following formula can be used as a reference:

[0108]

[0109] Where M′ is the corresponding plaintext calculation result; k is the corresponding number of ciphertext multiplications. The number of ciphertext multiplications for the calculation result is the sum of the number of ciphertext multiplications of c′3 and the number of ciphertext multiplications of c′4 plus 1. For example, if the number of ciphertext multiplications corresponding to c′3 is 0 and the number of ciphertext multiplications corresponding to c′4 is 0, then the number of ciphertext multiplications is 0+0+1=1 times.

[0110] First,

[0111] c′3=qM′3+r′3, c′2=qM′4+r′4

[0112] For the result of the addition operation of c′3 and c′4——

[0113]

[0114] Obviously, the correctness of the decryption method depends on this. If it is necessary to ensure that the result of the multiplication operation can be correctly decrypted, then the numerical range of the data to be encrypted—the third interval—needs to be introduced to further limit the size relationship between the first interval and the second interval. That is, the product of the upper limit of the third interval and the upper limit of the second interval is not greater than 1 / 2 of the lower limit of the first interval. Thus, it can be guaranteed that, in the end, we can obtain,

[0115]

[0116] that is, the result of the multiplication operation of the third ciphertext and the fourth ciphertext after decryption is the same as the result obtained by directly multiplying the plaintext calculation result corresponding to the third ciphertext and the fourth ciphertext.

[0117] It should be noted that the length of an element in the data to be encrypted is usually no more than 128 bits, that is, the upper limit of the third interval is usually 2128. Continuing with the first interval [2η,a] and the second interval [b,2ρ] in the previous example, the statement "the product of the upper limit of the third interval and the upper limit of the second interval is not greater than 1 / 2 of the lower limit of the first interval" can be written as ρ+128<η-1.

[0118] In the method shown in Figure 2, the upper and lower limits of the first interval, the second interval, and the third interval can all be set by the first participant, as described on page 9 / 15 of the specification, CN 121173457 A.

[0119] It should be noted that in the above proof process, c′3 and c′4 are substituted into the calculation as ciphertext data that has not undergone multiplication, and the correctness of the decryption method is finally proven. It is easy to see that if c′3 and c′4 are the result of multiplication operations rather than ciphertext data without multiplication operations, under the same parameter conditions, by using the above proof process to recursively prove that the decryption method is still correct.

[0120] The following proves the order preservation property of the encryption method provided in this embodiment.

[0121] First, the order preservation property after addition is proved. Taking the ciphertext data c1, c2, c3 and c4 as an example,

[0122] c1 = qM1 + r1, c2 = qM2 + r2, c3 = qM3 + r3, c4 = qM4 + r4

[0123] If

[0124] M1 + M2 > M3 + M4

[0125] then the result of the addition operation of the ciphertext data is:

[0126]

[0127] Sort the result of the addition operation by size:

[0128]

[0129] Wherein, because M1 + M2 > M3 + M4, so M1 + M2 - (M3 + M4) > 0, and since M1, M2, M3 and M4 are all integers, we can get q(M1 + M2 - (M3 + M4)) > q.

[0130] On the other hand, since the lower limit of the first interval is greater than twice the upper limit of the second interval, and further -(r3+r4)>-q, and r1 and r2 are both positive integers, then r`1+r2-(r3+r4)>-q. In summary, it can be deduced that:

[0131] q(M1+M2-(M3+M4))+r`1+r2-(r3+r4)>0

[0132] Thus, under the condition that M1+M2>M3+M4, it can be proved that

[0133] Since both are the results of addition operations, and the corresponding plaintext calculation result is M1+M2, and the corresponding plaintext calculation result is M3+M4. Thus, it can be concluded that the sorting result of the size sorting of the encryption operation result is the same as the result of directly sorting the plaintext calculation result corresponding to the operation result, that is, the encryption method in this embodiment has order preservation after the addition operation.

[0134] Next, we will prove the order preservation property after multiplication, still taking the ciphertext data c1, c2, c3 and c4 as examples.

[0135] If

[0136] M1M2>M3M4

[0137] then the result of the multiplication operation of the ciphertext data is:

[0138]

[0139] Sort the result of the multiplication operation by size:

[0140]

[0141] Further expansion yields:

[0142]

[0143] Wherein, since M1M2>M3M4 and M1, M2, M3 and M4 are all integers, we can obtain q2(M1M2-M3M4)>q2.On the other hand, according to page 10 / 15 of the specification, CN 121173457 A, since the lower limit of the first interval is greater than twice the upper limit of the second interval, and consequently, if necessary, it is necessary to further limit the size relationship between the third interval, the second interval and the first interval, so that when the product of the upper limit of the third interval and the upper limit of the second interval is not greater than the lower limit of the first interval, and r3M4+r4M3>0, that is, when the product of the upper limit of the third interval and the upper limit of the second interval is not greater than the lower limit of the first interval, the encryption method in this embodiment has order preservation after multiplication.

[0144] Using the first interval [2η,a], the second interval [b,2ρ] and the upper limit of the third interval 2128 in the previous example, "the product of the upper limit of the third interval and the upper limit of the second interval is not greater than the lower limit of the first interval" can be written as ρ+128.

Claims

1. A method of performing a secure computation, the method involving at least a first party and a second party, the method comprising: the first party randomly sampling a first parameter in a first interval, for any to-be-encrypted data in a to-be-encrypted data set, randomly sampling a second parameter in a second interval, multiplying the first parameter with the to-be-encrypted data, and adding the multiplication result with the second parameter to determine a ciphertext corresponding to the to-be-encrypted data, wherein a lower limit of the first interval is greater than twice of an upper limit of the second interval, and a quantitative relationship between the lower limit of the first interval and the upper limit of the second interval is determined according to a preset security coefficient, the to-be-encrypted data is integer type data, and a plurality of ciphertexts corresponding to the to-be-encrypted data set are sent to the second party; the second party performing a plurality of rounds of secure computation on the plurality of ciphertexts according to a preset computation task to determine a plurality of computation results of a final round, the secure computation including size sorting and addition operation, and sending the plurality of computation results to the first party; and the first party decrypting the plurality of computation results according to the first parameter to determine a plurality of plaintext computation results. 2.The method of claim 1, wherein the secure computation of any round specifically includes: if a sum of a number of times that a first ciphertext and a second ciphertext participate in an addition operation between the ciphertexts does not exceed an addition threshold, performing the addition operation on the first ciphertext and the second ciphertext to determine an operation result corresponding to the first ciphertext and the second ciphertext, wherein the first ciphertext and the second ciphertext are ciphertext data that has not undergone an encryption operation or an operation result of a previous round of a current round, and the addition threshold is determined according to a difference between the lower limit of the first interval and the upper limit of the second interval. 3.The method of claim 1, wherein decrypting the plurality of computation results according to the first parameter to determine a plurality of plaintext computation results specifically includes: for any computation result in the plurality of computation results, dividing the computation result by the first parameter and taking an integer to determine a plaintext computation result corresponding to the computation result. The secure computation further includes multiplication operation. The secure computation of any round specifically includes: performing multiplication operation on a third ciphertext and a fourth ciphertext to determine an operation result corresponding to the third ciphertext and the fourth ciphertext, and determining a ciphertext multiplication implementation count corresponding to the operation result of the third ciphertext and the fourth ciphertext according to a respective ciphertext multiplication implementation count of the third ciphertext and the fourth ciphertext, wherein the third ciphertext and the fourth ciphertext are ciphertext data that has not undergone an encryption operation or an operation result of a previous round of a current round. The sending of the plurality of computation results to the first party specifically includes: sending the plurality of computation results and a ciphertext multiplication implementation count corresponding to each computation result to the first party. The decrypting of the plurality of computation results according to the first parameter to determine a plurality of plaintext computation results specifically includes:

4. The method of claim 3, wherein, Each of the data to be encrypted belongs to a third interval, the product of the upper limit of the third interval and the upper limit of the second interval being less than the lower limit of the first interval decrypting the plurality of computation results according to the first parameter and the respective ciphertext multiplication implementation counts to determine a plurality of plaintext computation results. ​ ​ ​ ​ ​ ​ 5. The method of claim 4, wherein the plurality of operation results are decrypted according to the first parameter and the number of times of ciphertext multiplication implementation to determine a plurality of plaintext calculation results, and the method specifically comprises: for any operation result in the plurality of operation results, the operation result is divided by the (k+1)th power of the first parameter to determine a plaintext calculation result corresponding to the operation result, wherein k is the number of times of ciphertext multiplication implementation corresponding to the operation result.

6. The method of claim 5, further comprising: the first participant converts each original data in an original data set to determine an encrypted data set composed of integer type encrypted data, wherein each original data is fixed-point type decimal data with the same dimension.

7. The method of claim 6, wherein the conversion of each original data in the original data set to determine the encrypted data set composed of integer type encrypted data specifically comprises: for any original data in the original data set, the decimal places of the original data are identified as integer places to determine integer type encrypted data corresponding to the original data. After determining the plurality of plaintext calculation results, the method further comprises: for any plaintext calculation result, the last k*f places of the plaintext calculation result are identified as decimal places to determine fixed-point type decimal calculation result corresponding to the plaintext calculation result, wherein f is the number of decimal places of each original data.

8. The method of claim 4, wherein the ciphertext operation of any round specifically comprises: for the fifth ciphertext and the sixth ciphertext in the plurality of ciphertexts to be sorted, the fifth ciphertext and the sixth ciphertext are subtracted to determine the sorting result of the plaintext calculation results corresponding to the fifth ciphertext and the sixth ciphertext according to the positive and negative signs of the difference between the fifth ciphertext and the sixth ciphertext, wherein the plurality of ciphertexts to be sorted are all ciphertext data not subjected to encrypted operation or operation results of the previous round of the current round, and the plurality of ciphertexts to be sorted are subjected to multiplication operation for the same number of times; the plurality of operation results corresponding to the current round are determined from the sorting results of the plurality of plaintext calculation results corresponding to the plurality of ciphertexts to be sorted.

9. A method for performing a ciphertext calculation, the method involving at least a first participant and a second participant, the method being applied to the first participant, and the method comprising: randomly sampling a first parameter in a first interval; for any encrypted data in an encrypted data set, randomly sampling a second parameter in a second interval; multiplying the first parameter and the encrypted data, and adding the multiplication result and the second parameter to determine ciphertext data corresponding to the encrypted data, wherein the lower limit of the first interval is greater than twice the upper limit of the second interval, and the quantity relationship between the lower limit of the first interval and the upper limit of the second interval is determined according to a preset security coefficient; and the encrypted data is integer type data; sending the plurality of ciphertext data corresponding to the encrypted data set to the second participant. According to the first parameter, the plurality of operation results are decrypted to determine a plurality of plaintext calculation results, wherein the plurality of operation results are sent by the second participant, the plurality of operation results are a plurality of operation results of a final round after the second participant performs a plurality of rounds of secret state operation on the plurality of ciphertext data, the plurality of rounds of secret state operation are performed according to a preset calculation task, and the secret state operation includes size sorting and addition operation.

10. A computing device comprising a memory and a processor, the memory having stored therein executable code, the processor executing the executable code implementing the method of any one of claims 1-9.

Images