A method for additive homomorphic encryption and cryptographic accumulator calculation

Abstract

The present invention relates to a method for additive homomorphic encryption and cryptographic accumulator calculation. The present invention proposes a verifiable outsourced calculation method for graph data based on additive homomorphism and bilinear map accumulators. First, homomorphic cryptography is used to encrypt graph data instantiated by an adjacency list. Additive homomorphic encryption and obfuscation circuits are combined to implement a breadth-first Dijkstra algorithm based on a priority queue to calculate the exact shortest path on the encrypted graph data. Second, a binomial heap structure is constructed based on the encrypted graph data, and a bilinear map accumulator is used to calculate verification evidence for the encrypted shortest path result, thereby achieving verifiable correctness of the outsourced shortest path query calculation result for the encrypted graph data. In addition, the scheme also uses certificateless short signatures to ensure the authenticity and non-tamperability of the shortest path query result and verification result of the cloud server, thereby achieving probabilistic correctness verification of the outsourced calculation result of the shortest path query for encrypted graph data.

Description

Technical Field

[0001] The present invention relates to the field of data calculation and encryption technology, and specifically to a method for additive homomorphic encryption and cryptographic accumulator calculation. Background Art

[0002] In the information age, the amount of graph data is exploding and is widely used in scenarios such as social networks, email, and biological proteins. This volume far exceeds the processing capabilities of data owners and contains a significant amount of private information. This massive amount of graph-structured data far exceeds the processing capabilities of data owners, necessitating outsourced computing via cloud computing. Data stored in the cloud contains a significant amount of user privacy, making it highly vulnerable to privacy and trade secret leaks in outsourced computing scenarios. Therefore, data encryption is necessary before outsourcing. However, encryption limits data computation and usability, increases computational complexity, and prevents effective verification of the outsourced computation process and results. Therefore, a cryptographic technology is needed that can both encrypt graph data and ensure the accuracy of the outsourced computation process and results.

[0003] Homomorphic encryption technology allows specific computations to be performed on ciphertext after the original data has been ciphered, resulting in computations equivalent to those generated by computing on the plaintext data. Homomorphic encryption effectively protects the privacy and security of graph data and is a key technology for addressing data confidentiality in cloud computing. Using homomorphic encryption, users outsource the storage of ciphertext graph data to cloud servers. The cloud servers then perform computations directly on the encrypted graph using the ciphertext and return the computation results to the user in ciphertext form.

[0004] Cryptographic accumulators accumulate all elements in a set and efficiently provide proof of membership for any element, i.e., whether the element exists in the set. Cryptographic accumulators are primarily categorized into three types: static accumulators, dynamic accumulators, and universal accumulators. Static accumulators accumulate elements in a static set; dynamic accumulators further allow for the dynamic addition and removal of elements from the accumulated set; and universal accumulators support both proofs of membership and proofs of non-membership. Cryptographic accumulators have a wide range of applications, such as group signatures, ring signatures, anonymous credentials, timestamping, and outsourced data verification.

[0005] Outsourcing computation for encrypted graph data was proposed by Chase and Kamara in 2010. This scheme introduced structured encryption into symmetric searchable encryption and generalized it to graph data encryption, enabling adjacency queries and attribute graph subgraph queries. Subsequently, new schemes have been proposed based on the different outsourcing computation requirements for encrypted graph data. For example, in "SecGDB: GraphEncryption for Exact Shortest Distance Queries with Efficient Updates," Wang Qian publicly proposed a computation scheme for encrypted graph data based on additive homomorphism and obfuscated circuits for shortest path query computation. However, this scheme's fundamental assumption is that the cloud server strictly executes the user's outsourced computation requests. It does not consider computation errors caused by cloud server economics, data loss, and other factors, making it impossible to verify the correctness of the outsourced computation. Summary of the Invention

[0006] In view of the problems existing in the prior art, the present invention discloses a method for additive homomorphic encryption and cryptographic accumulator calculation, comprising the following steps:

[0007] Step 1: The authority sets the parameters. Specifically, the authority randomly selects a security parameter λ and generates pseudo-random function values k1, k2, k3←{0,1} based on the security parameter. λ , and the basic key pair (sk p ,pk p ), the two are combined to generate the client key (pk c ,sk c );

[0008] Step 2: Instantiate the adjacency table of the client graph data. Specifically, the client instantiates the adjacency table of the original graph data and uses the adjacency table to store the node and edge information of the original graph data. The adjacency table contains each node and its adjacent points, and stores the lengths of the adjacent points and their edges.

[0009] Step 3: The client encrypts the graph data. Specifically, the client obtains the vertex set V and edge set E of the original graph data G and obtains the secret hash value sk h , the client initializes array A G 、Dictionary T D and T G , traverse and obtain the node elements in the graph, and the client calculates the pseudo-random function value K of the current node u , Traverse the out-degree value deg+(u) of the current node and encrypt the length of the edge len(u,v i ),get

[0010] Set node N by judging the out-degree of the current node i The composition and its adjacent nodes D i composition;

[0011] Using random oracle model H:{0,1} * →{0,1} * XOR computing node N i Encrypt it and store it in array A G middle,

[0012] Iterate over the array and use the shared secret hash value sk h For array A G Calculate the hash of each element in to form a hash set H1=h1,h2,...,h n , where h i =H(sk h ,A G [i]);

[0013] Use the cryptographic accumulator to calculate the cumulative value of set H1

[0014] Combined with pseudorandom function and Store adjacent nodes D i In the dictionary T D Among them

[0015] The address array(N) of each head node in the array i ) encrypted and stored in dictionary T G In the example, the address of the head node is the pointer to the head of each adjacency table. Finally, the encrypted graph Ω is generated G =(A G ,T G ,T D ) and accumulator And Ω G Send to the server;

[0016] Step 4: The client generates a query token based on the query request. Specifically, the client obtains the query request q = (s, t), which includes the source point s and the destination point t;

[0017] The client calculates and generates a query token

[0018] Step 5: Cloud server ciphertext query calculation, specifically: the cloud server obtains the encrypted graph data Ω G and query token τ q ;

[0019] The cloud server resolves the query token τ q =(τ1,τ2,τ3), obtain the ciphertext query source point τ1, the ciphertext query end point τ2, and the auxiliary condition τ3;

[0020] Determine whether the ciphertext query source point τ1 and end point τ2 exist in the ciphertext graph data. If they do, continue the query; otherwise, exit the query and return NULL.

[0021] The cloud server initializes the binomial heap H, the dictionary path storing node values, and the dictionary ξ storing edge lengths;

[0022] Combine array A G and dictionary T G and T D , reconstruct the adjacency relationship of the ciphertext graph data; starting from the ciphertext query source point τ1, construct the binomial heap H until the construction is completed;

[0023] The unused nodes in the process of constructing the binomial heap H Traverse and accumulate to get acc(H other );

[0024] The breadth-first Dijkstra algorithm is used to calculate the shortest path from a complete binomial heap H. The minimum node in the heap H is extracted using a loop (ExtractMin(Heap)). This node and its edge length are stored in the dictionaries path and ξ.

[0025] If the currently obtained minimum node is the same as the tail node of the query, that is, ExtractMin(Heap)==τ2, the shortest path query ends, and the path and ciphertext length ξ calculated after reverse iteration are returned. The two constitute the encryption result D q ; The nodes in the heap that are not used to calculate the shortest path Accumulate and get acc(H useless );acc(H other ) and acc(H useless ) is the verification evidence of the shortest path of the ciphertext graph data, that is, the cumulative value acc(H2), acc(H2)=acc(H other )+acc(H useless );

[0026] The cloud server calculates the result D q Sign with verification evidence acc(H2) to generate Wit D , sign the same as D q Sent to the client together with acc(H2);

[0027] Step 6: The client verifies the cloud server signature and decryption. Specifically: The client obtains the encrypted shortest path D sent by the cloud server q , verify the evidence accumulated value acc(H2) and signature Wit D ; Perform SignVerify verification on the signature according to the identity ID of the cloud server. If the verification is successful, continue decryption, otherwise exit verification;

[0028] The shortest path result D for the ciphertext q Analyze and get D q =<D path ,D dist >, that is, the set of nodes and edge lengths of the shortest ciphertext path;

[0029] The shortest path node of the client to the ciphertext The set D dist Accumulate and calculate the cumulative value acc(H dist ); Compare the verification evidence accumulated value acc(H2) returned by the cloud server to see if it is equal to acc(H1) and acc(H dist ) difference judgment D q Correctness;

[0030] If the verification is successful, the ciphertext calculation result D q Decrypt and obtain the shortest path dist of the plaintext state path and the shortest distance dist q If the verification fails, NULL is returned.

[0031] The authority mentioned in step 1 refers to a digital certificate certification authority, also known as an e-commerce certification center or e-commerce certification authority. It is an authority responsible for issuing and managing digital certificates. As a trusted third party in e-commerce transactions, it is responsible for verifying the legitimacy of public keys in the public key system.

[0032] Beneficial effects of the present invention: The present invention proposes a verifiable outsourced calculation method for graph data based on additive homomorphism and bilinear map accumulator. First, the graph data instantiated by the adjacency list is encrypted using homomorphic encryption, and the breadth-first Dijkstra algorithm is implemented based on the priority queue in combination with additive homomorphic encryption and obfuscation circuits to calculate the exact shortest path on the encrypted graph data; secondly, a binomial heap structure is constructed based on the encrypted graph data and the verification evidence of the encrypted shortest path result is calculated using the bilinear map accumulator, so that the correctness of the outsourced shortest path query calculation result of the encrypted graph data can be verified; in addition, the scheme also uses certificateless short signatures to ensure the authenticity and non-tamperability of the shortest path query results and verification results of the cloud server.

[0033] During the outsourced computation of encrypted graph data, this method utilizes a precise shortest distance query mechanism for encrypted graph data based on homomorphic encryption and obfuscated circuits. This mechanism supports privacy-preserving outsourced shortest path query computation for encrypted graph data, thereby protecting the privacy and security of graph data. During the verification of outsourced computation, a verifiable outsourced computation scheme for shortest path query computation for encrypted graph data based on cryptographic accumulators is employed. During the cloud service outsourced computation, this scheme constructs a binomial heap structure based on the encrypted graph data and utilizes a bilinear map accumulator to calculate verification evidence for the encrypted shortest path result, thereby achieving probabilistic correctness verification of the outsourced computation results for the encrypted graph data shortest path query. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 Schematic diagram of the calculation process of the present invention. DETAILED DESCRIPTION

[0035] Example 1

[0036] like Figure 1 As shown, the method of additive homomorphic encryption and cryptographic accumulator calculation described in the present invention includes the steps of setting parameters for an authority, instantiating a graph data adjacency table on a client, encrypting graph data on the client, generating a query token based on a query request on the client, performing ciphertext query calculation on a cloud server, and verifying the signature and decryption of the cloud server on the client. The specific implementation steps are as follows:

[0037] Step 1: The authority sets the parameters. Specifically, the authority randomly selects a security parameter λ and generates pseudo-random function values k1, k2, k3←{0,1} based on the security parameter. λ , and the basic key pair (sk p ,pk p ), the two are combined to generate the client key (pk c ,sk c );

[0038] Step 2: Instantiate the adjacency table of the client graph data. Specifically, the client instantiates the adjacency table of the original graph data and uses the adjacency table to store the node and edge information of the original graph data. The adjacency table contains each node and its adjacent points, and stores the lengths of the adjacent points and their edges.

[0039] Step 3: The client encrypts the graph data. Specifically, the client obtains the vertex set V and edge set E of the original graph data G and obtains the secret hash value sk h , the client initializes array A G 、Dictionary T D and T G , traverse and obtain the node elements in the graph, and the client calculates the pseudo-random function value K of the current node u , Traverse the out-degree value deg+(u) of the current node and encrypt the length of the edge len(u,v i ),get

[0040] Set node N by judging the out-degree of the current node i The composition and its adjacent nodes D i composition;

[0041] Using random oracle model H:{0,1} * →{0,1} * XOR computing node N i Encrypt it and store it in array A G middle,

[0042] Iterate over the array and use the shared secret hash value sk h For array A G Calculate the hash of each element in to form a hash set H1=h1,h2,...,h n , where h i =H(sk h ,A G [i]);

[0043] Use the cryptographic accumulator to calculate the cumulative value of set H1

[0044] Combined with pseudorandom function and Store adjacent nodes D i In the dictionary T D Among them

[0045] The address array(N) of each head node in the array i ) encrypted and stored in dictionary T G In the example, the address of the head node is the pointer to the head of each adjacency table. Finally, the encrypted graph Ω is generated G =(A G ,T G ,T D ) and accumulator And Ω G Send to the server;

[0046] Step 4: The client generates a query token based on the query request. Specifically, the client obtains the query request q = (s, t), which includes the source point s and the destination point t;

[0047] The client calculates and generates a query token

[0048] Step 5: Cloud server ciphertext query calculation, specifically: the cloud server obtains the encrypted graph data Ω G and query token τ q ;

[0049] The cloud server resolves the query token τ q =(τ1,τ2,τ3), obtain the ciphertext query source point τ1, the ciphertext query end point τ2, and the auxiliary condition τ3;

[0050] Determine whether the ciphertext query source point τ1 and end point τ2 exist in the ciphertext graph data. If they do, continue the query; otherwise, exit the query and return NULL.

[0051] The cloud server initializes the binomial heap H, the dictionary path storing node values, and the dictionary ξ storing edge lengths;

[0052] Combine array A G and dictionary T G and T D , reconstruct the adjacency relationship of the ciphertext graph data; starting from the ciphertext query source point τ1, construct the binomial heap H until the construction is completed;

[0053] The nodes h that are not used in the process of constructing the binomial heap H are iother Traverse and accumulate to get acc(H other );

[0054] The breadth-first Dijkstra algorithm is used to calculate the shortest path from a complete binomial heap H. The minimum node in the heap H is extracted using a loop (ExtractMin(Heap)). This node and its edge length are stored in the dictionaries path and ξ.

[0055] If the currently obtained minimum node is the same as the tail node of the query, that is, ExtractMin(Heap)==τ2, the shortest path query ends, and the path and ciphertext length ξ calculated after reverse iteration are returned. The two constitute the encryption result D q ; The node h in the heap that is not used to calculate the shortest path iuseless Accumulate and get acc(H useless );acc(H other ) and acc(H useless ) is the verification evidence of the shortest path of the ciphertext graph data, that is, the cumulative value acc(H2), acc(H2)=acc(H other )+acc(H useless );

[0056] The cloud server calculates the result D q Sign with verification evidence acc(H2) to generate Wit D , sign the same as Dq Sent to the client together with acc(H2);

[0057] Step 6: The client verifies the cloud server signature and decryption. Specifically: The client obtains the encrypted shortest path D sent by the cloud server q , verify the evidence accumulated value acc(H2) and signature Wit D ; Perform SignVerify verification on the signature according to the identity ID of the cloud server. If the verification is successful, continue decryption, otherwise exit verification;

[0058] The shortest path result D for the ciphertext q Analyze and get D q =<D path ,D dist >, that is, the set of nodes and edge lengths of the shortest ciphertext path;

[0059] The client's shortest path node h for the ciphertext idist The set D dist Accumulate and calculate the cumulative value acc(H dist ); Compare the verification evidence accumulated value acc(H2) returned by the cloud server to see if it is equal to acc(H1) and acc(H dist ) difference judgment D q Correctness;

[0060] If the verification is successful, the ciphertext calculation result D q Decrypt and obtain the shortest path dist of the plaintext state path and the shortest distance dist q If the verification fails, NULL is returned.

[0061] The authority mentioned in step 1 refers to a digital certificate certification authority, also known as an e-commerce certification center or e-commerce certification authority. It is an authority responsible for issuing and managing digital certificates. As a trusted third party in e-commerce transactions, it is responsible for verifying the legitimacy of public keys in the public key system.

[0062] Any portion not described in detail herein is prior art.

[0063] Although the specific embodiments of the present invention have been described in detail above, the present invention is not limited to the above embodiments. Within the scope of knowledge possessed by ordinary technicians in this field, various changes can be made without departing from the purpose of the present invention. Modifications or deformations that do not involve creative work are still within the scope of protection of the present invention.

Claims

1. A method for additive homomorphic encryption and cryptographic accumulator calculation, characterized in that: The steps are as follows: Step 1: The authority sets the parameters. Specifically, the authority randomly selects a security parameter λ and generates pseudo-random function values k1, k2, k3←{0,1} based on the security parameter. λ , and the basic key pair (sk p ,pk p ), the two are combined to generate the client key (pk c ,sk c ); Step 2: Instantiate the adjacency table of the client graph data. Specifically, the client instantiates the adjacency table of the original graph data and uses the adjacency table to store the node and edge information of the original graph data. The adjacency table contains each node and its adjacent points, and stores the lengths of the adjacent points and their edges. Step 3: The client encrypts the graph data. Specifically, the client obtains the vertex set V and edge set E of the original graph data G and obtains the secret hash value sk h , the client initializes array A G 、Dictionary T D and T G , traverse and obtain the node elements in the graph, and the client calculates the pseudo-random function value K of the current node u , Traverse the out-degree value of the current node deg+(u), and encrypt the length of the edge len(u,v i ),get Set node N by judging the out-degree of the current node i The composition and its adjacent nodes D i composition; Using random oracle model H:{0,1} * →{0,1} * XOR computing node N i Encrypt it and store it in array A G middle, Iterate over the array and use the shared secret hash value sk h For array A G Calculate the hash of each element in to form a hash set H1=h1,h2,...,h n , where h i =H(sk h ,A G [i]); Use the cryptographic accumulator to calculate the cumulative value of set H1 Combined with pseudorandom function and Store adjacent nodes D i In the dictionary T D Among them The address array(N) of each head node in the array i ) encrypted and stored in dictionary T G In the example, the address of the head node is the pointer to the head of each adjacency table. Finally, the encrypted graph Ω is generated G =(A G ,T G ,T D ) and accumulator And Ω G Send to the server; Step 4: The client generates a query token based on the query request. Specifically, the client obtains the query request q = (s, t), which includes the source point s and the destination point t; The client calculates and generates a query token Step 5: Cloud server ciphertext query calculation, specifically: the cloud server obtains the encrypted graph data Ω G and query token τ q ; The cloud server resolves the query token τ q =(τ1,τ2,τ3), obtain the ciphertext query source point τ1, the ciphertext query end point τ2, and the auxiliary condition τ3; Determine whether the ciphertext query source point τ1 and end point τ2 exist in the ciphertext graph data. If they do, continue the query; otherwise, exit the query and return NULL. The cloud server initializes the binomial heap H, the dictionary path storing node values, and the dictionary ξ storing edge lengths; Combine array A G and dictionary T G and T D , reconstruct the adjacency relationship of the ciphertext graph data; starting from the ciphertext query source point τ1, construct the binomial heap H until the construction is completed; The unused nodes in the process of constructing the binomial heap H will be Traverse and accumulate to get acc(H other ); The breadth-first Dijkstra algorithm is used to calculate the shortest path from a complete binomial heap H. The minimum node in the heap H is extracted using a loop (ExtractMin(Heap)). This node and its edge length are stored in the dictionaries path and ξ. If the currently obtained minimum node is the same as the tail node of the query, that is, ExtractMin(Heap)==τ2, the shortest path query ends, and the path and ciphertext length ξ calculated after reverse iteration are returned. The two constitute the encryption result D q ; The nodes in the heap that are not used to calculate the shortest path Accumulate and get acc(H useless );acc(H other ) and acc(H useless ) is the verification evidence of the shortest path of the ciphertext graph data, that is, the cumulative value acc(H2), acc(H2)=acc(H other )+acc(H useless ); The cloud server calculates the result D q Sign with verification evidence acc(H2) to generate Wit D , sign the same as D q Sent to the client together with acc(H2); Step 6: The client verifies the cloud server signature and decrypts the signature, specifically: The client obtains the encrypted shortest path D sent by the cloud server q , verify the evidence accumulated value acc(H2) and signature Wit D ; Perform SignVerify verification on the signature according to the identity ID of the cloud server. If the verification is successful, continue decryption, otherwise exit verification; The shortest path result D for the ciphertext q Analyze and get D q =<D path ,D dist >, that is, the set of nodes and edge lengths of the shortest ciphertext path; The shortest path node of the client to the ciphertext The set D dist Accumulate and calculate the ciphertext shortest path cumulative value acc(H dist ); Compare the verification evidence accumulated value acc(H2) returned by the cloud server to see if it is equal to acc(H1) and acc(H dist ) difference judgment D q Correctness; If the verification is successful, the ciphertext calculation result D q Decrypt and obtain the shortest path dist of the plaintext state path and the shortest distance dist q If the verification fails, NULL is returned.

Images