GSW-type multi-key fully homomorphic encryption method with efficient ciphertext expansion process

Abstract

The present invention belongs to the field of information security, and specifically relates to a GSW type multi-key fully homomorphic encryption scheme with an efficient ciphertext expansion process, comprising the following steps: 1. a key generation algorithm to generate a public key, a private key and a calculation key; 2. an encryption algorithm to encrypt plaintext data using a public key; 3. ciphertext calculation to perform secret state processing on the ciphertext using the calculation key; 4. a decryption algorithm to decrypt the ciphertext to obtain the plaintext data. Multi-key fully homomorphic encryption can realize homomorphic operations between ciphertexts of different users (keys), and the result after the operation requires the joint decryption of the keys of all participating users, thereby being able to more effectively protect the data privacy of different users, and having a very broad application prospect. The present invention is aimed at the GSW type multi-key fully homomorphic encryption scheme, which has the defects of large key scale and low efficiency required for the ciphertext expansion process.

Description

Technical Field

[0001] The present invention relates to the technical field of encryption technology, and in particular to a GSW type multi-key fully homomorphic encryption method with an efficient ciphertext expansion process. Background Art

[0002] At present, big data and cloud computing have been deeply studied by the academic community and have derived a wide range of applications. How to ensure the security of big data and cloud computing has become an important issue that needs to be broken through in this field. This demand has led to the rapid development of new computing models such as outsourced computing and secure multi-party computing. In cloud servers, how to achieve secure storage, analysis and computing of data and fully protect the personal privacy of information owners is one of the current research hotspots and important issues in the field of cloud computing.

[0003] Multi-key fully homomorphic encryption (MKFHE) supports arbitrary homomorphic operations on ciphertexts of different users. The results of the operations can be jointly decrypted by all participating users. It can solve the problem of data security computing among multiple users and is an effective way to solve the privacy and security issues of cloud computing. At the same time, most multi-key fully homomorphic encryption schemes are constructed based on difficult problems on lattices. Compared with traditional cryptographic schemes, they can better cope with the threat of quantum computers and have good application prospects in cloud computing scenarios.

[0004] López-Alt et al. first proposed multi-key fully homomorphic encryption in 2012, and gave a multi-key fully homomorphic encryption scheme LTV12 based on NTRU. After the concept of multi-key fully homomorphic encryption was proposed, a series of multi-key fully homomorphic encryption schemes based on the classical single-key fully homomorphic encryption scheme emerged. In 2013, Gentry et al. used the approximate eigenvector method to construct the fully homomorphic encryption scheme GSW13 based on the LWE problem. Clear et al. extended the GSW13 scheme to multi-key at the 2015 American Cryptography Conference and proposed the first GSW-type multi-key fully homomorphic encryption scheme CM15 with selective security under the standard model. The security of the CM15 scheme is based on the LWE problem of the standard assumption, and it has better security than the LTV12 scheme based on the non-standard assumption. Mukherjee et al. proposed the MW16 scheme at the 2016 European Cryptography Conference by optimizing the ciphertext expansion process of the CM15 scheme. The MW16 scheme supports one round of distributed decryption of multi-key ciphertexts and can construct a two-round MPC protocol. However, the MW16 scheme requires the number of users participating in the calculation to be set in advance, and new users cannot be added during the calculation process. This type of multi-key fully homomorphic encryption scheme is called a single-hop multi-key fully homomorphic encryption scheme. Peikert et al. proposed a multi-key fully homomorphic encryption scheme PS16 with multi-hop properties in the 2016 TCC. The ciphertext output by this scheme after homomorphic operation can be flexibly recalculated with the ciphertext of the new party. Brakerski et al. proposed the BP16 scheme at the 2016 US Cryptography Conference. This scheme allows new participants to dynamically participate in homomorphic calculations. The length of the extended ciphertext increases linearly with the increase in the number of participants. However, this scheme uses a bootstrap process for key expansion, and the efficiency of homomorphic calculations is low. Chen et al. proposed the CZW17 scheme in 2017. The scheme uses the GSW encryption scheme on the ring to generate the computational keys needed in the key conversion process. It supports ciphertext packing technology based on the Chinese remainder theorem and can be used to construct two-round secure multi-party computation protocols and threshold decryption protocols. It is the first BGV-type multi-hop multi-key fully homomorphic encryption scheme. Chen et al. proposed the CCS19 scheme in 2019. The scheme is based on the CGGI17 scheme and uses special GSW ciphertexts to design an efficient ciphertext expansion algorithm. The ciphertext size increases linearly with the number of users. Chen et al. optimized the relinearization process in the CKKS17 and CZW17 schemes and constructed the multi-key homomorphic encryption scheme CDKS19. Jiang et al. proposed a GSW-type multi-key fully homomorphic encryption scheme with unchanged ciphertext size under specific conditions in 2022.

[0005] The GSW type multi-key fully homomorphic encryption scheme has the advantages of simple homomorphic operation form and no need to generate calculation keys in advance, but this type of scheme has the problem that the size of the extended key required for ciphertext expansion is large, the ciphertext expansion process is relatively complex and has certain redundancy. In view of the above defects, this scheme optimizes the GSW ciphertext expansion algorithm, reduces the redundancy in the extended key generation process, and designs a GSW type multi-key fully homomorphic encryption scheme with a more efficient ciphertext expansion process, which greatly reduces the storage cost of the extended key and the computational overhead in the generation process. Summary of the invention

[0006] The object of the present invention is to provide a GSW type multi-key fully homomorphic encryption method with an efficient ciphertext expansion process to solve the problems in the background technology.

[0007] To achieve the above object, the present invention provides the following technical solutions:

[0008] The GSW type multi-key fully homomorphic encryption method with efficient ciphertext expansion process includes the following steps:

[0009] Step 1: Initialize the algorithm E.Setup(1 l ,1 L ): Run E.Setup(1 l ,1 L ) algorithm, modulus q = B c 2 O (Lllogl) , output parameters params = (q,n,m,c,B c ,K,B);

[0010] Step 2: Key generation algorithm E.KeyGen(params): Run the E.KeyGen(params) algorithm;

[0011] Step 3: Encryption algorithm E.Enc({pk i} i＝1,...,K , User i uniformly selects K random matrices

[0012] Step 4: Match the set [K] = {1, 2, ..., K} to the user one by one, and input the plaintext to be encrypted μ of user i i ∈{0,1}, public key pk i , i∈[K], generate the ciphertext of user i

[0013] Step 5: Generate

[0014] Step 6: Uniformly select a random matrix definition ( is the last l columns of G), calculate Define an extended key:

[0015]

[0016] User i will {pk i ,ek i ,C i}Upload to the cloud;

[0017] Decryption algorithm E.Dec(sk,C): Input ciphertext Private Key definition calculate:

[0018] Among them G -1 (·) indicates bit decomposition in the column direction and output of decryption result

[0019] Among the options: Ciphertext expansion algorithm The ciphertext expansion is introduced in two cases: whether there is a new user joining;

[0020] Case 1: E.Extend(C i ,ek i ): When there is no new user joining, take user i as an example, enter the ciphertext C of user i i , and the extended key {X j} j∈[K]\i , construct the extended ciphertext:

[0021]

[0022] Case 2:. When a new user j * When joining, Assume that the new user set is {1,2,...,K+1}, and the new user j * Corresponding to K+1, input the ciphertext C of user i i , extended key and new user j * The public key Construct extended ciphertext:

[0023]

[0024] Homomorphic operation E.Eval(C1,C2): Input two ciphertexts The homomorphic operation mode is the same as E.Eval(C1,C2).

[0025] Compared with the prior art, the present invention has the following beneficial effects:

[0026] This application analyzes the ciphertext expansion algorithm, removes some existing computational redundancy, and reduces the size of the expanded key; and based on the actual users participating in the operation, designs a hybrid solution that can flexibly select the ciphertext expansion method to achieve better homomorphic computing performance. Compared with the original MW16 solution, this algorithm reduces the computational overhead of the expanded key generation process, while reducing the storage cost of the expanded key, improving the efficiency of the ciphertext expansion process and supporting deeper homomorphic operations. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 Schematic diagram of the cloud-based homomorphic computing process in the GSW-type multi-key fully homomorphic encryption in this application.

[0028] Figure 2 Schematic diagram of the homomorphic operation process of the hybrid scheme in this application. DETAILED DESCRIPTION

[0029] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments.

[0030] Example 1

[0031] like Figure 1-Figure 2 As shown in the figure, a GSW-type multi-key fully homomorphic encryption method with an efficient ciphertext expansion process is proposed, in which the GSW-type MKFHE scheme with a smaller expansion key size is:

[0032] 1) Initialization algorithm E.Setup(1 l ,1 L ): Let l be the security parameter, let Parameters n = n(l)∈Z, m = nl, and bound on Z is B c The error distribution c = c(l), modulus q = B c 2 O(Lllogl) .

[0033] Assume that the upper bound of the number of participants is K, and randomly select the public matrix Output parameters params = (q,n,m,c,B c ,K,B).

[0034] 2) Key generation algorithm E.KeyGen(params): input public parameters params;

[0035] a. Random uniform selection and e←c m , calculation, definition Then there is sA=e;

[0036] b. Output private key sk:=s, public key pk:=A.

[0037] 3) Encryption algorithm E2.Enc(pk,μ): Input the plaintext to be encrypted μ∈{0,1}, the public key pk,

[0038] a. Definition Among them I n is the n×n identity matrix,

[0039] b. Uniformly select random matrices Generate ciphertext

[0040] c. Uniformly select random matrices definition ( is the last l columns of G), calculate Generate extended key Upload {pk,ek,C} to the cloud.

[0041] 4) Decryption algorithm E2.Dec(sk,C): Input ciphertext C, private key definition Calculation: v = sCG -1 (w T ). -1 (·) means to decompose the elements in the matrix in the column direction and output the decrypted result

[0042] 5) Ciphertext extension E2.Extend(C1,ek1,pk1,pk2): Taking user 1 as an example, the users participating in the calculation are 1 and 2. Enter the ciphertext C1 and extended key ek1 of user 1, as well as the public keys pk1 and pk2 of the two users, and run:

[0043] a. Define the matrix z 1,i :=(b2-b1)[i], let ξ 1→2 :={z 1,i} i∈[m] ;

[0044] b. Generate auxiliary ciphertext Input ξ 1→2 :={z 1,i} i∈[m] , and the extended key calculate:

[0045]

[0046] where g-1 (·) indicates bit decomposition of elements in column direction;

[0047] c. Constructing extended ciphertext Its corresponding decryption key When K users participate in homomorphic computing, for user k, the expanded ciphertext for:

[0048]

[0049] In the extended ciphertext In the structure diagram of , a matrix of n×m dimensions is used as a basic unit, and "the i-th row" represents the i-th row in a matrix of n×m dimensions as a basic unit. The corresponding private key definition as follows:

[0050]

[0051] satisfy:

[0052] 6) Homomorphic operation E.Eval(C1,C2): Input two ciphertexts The homomorphic operation method is the same as E.Eval(C1,C2).

[0053] Example 2

[0054] like Figure 1-Figure 2 As shown, the hybrid optimized GSW-type MKFHE scheme includes the following steps:

[0055] 1) Initialization algorithm E.Setup(1 l ,1 L ): Run E.Setup(1 l ,1 L ) algorithm, modulus q = B c 2 O(Lllogl) , output parameters params = (q,n,m,c,B c ,K,B).

[0056] 2) Key generation algorithm E.KeyGen(params): Run the E.KeyGen(params) algorithm.

[0057] 3) Encryption algorithm E.Enc({pk i} i＝1,...,K , User i uniformly selects K random matrices

[0058] a. Assign the set [K] = {1, 2, ..., K} to each user, and input the plaintext μ to be encrypted of user i. i ∈{0,1}, public key pk i , i∈[K], generate the ciphertext of user i

[0059] b. Generate

[0060] c. Uniformly select random matrices definition ( is the last l columns of G), calculate Define an extended key:

[0061]

[0062] User i will {pk i ,ek i ,C i}Upload to the cloud.

[0063] 4) Decryption algorithm E.Dec(sk,C): Input ciphertext Private Key definition k∈[K], calculate:

[0064] Among them G -1 (·) indicates bit decomposition in the column direction and output of decryption result

[0065] 5) Ciphertext extension algorithm E.Extend(C i ,ek i ,ek j* ,pk i ,pk j* ): Ciphertext expansion is divided into two situations: whether there is a new user joining:

[0066] aEExtend(C i ,ek i ): When there is no new user joining, take user i as an example, enter the ciphertext C of user i i , and the extended key {X j} j∈[K]\i , construct the extended ciphertext:

[0067]

[0068] b. When a new user j * When joining, Assume that the new user set is {1,2,...,K+1}, and the new user j * Corresponding to K+1, input the ciphertext C of user i i , extended key and new user j * The public key Construct extended ciphertext:

[0069]

[0070] 6) Homomorphic operation E.Eval(C1,C2): Input two ciphertexts The homomorphic operation mode is the same as E.Eval(C1,C2).

[0071] In view of the problems existing in the GSW-type MKFHE scheme MW16, this scheme optimizes the algorithm as follows: (1) In the ciphertext expansion algorithm of the MW16 scheme, the auxiliary ciphertext is Because Z i,j There are a lot of 0 elements in the calculation, and only V is actually used in the calculation. i,j The last l columns and Z i,j The last line of , so there is a lot of redundancy in the process of generating auxiliary ciphertext X. The size of the extended key can be reduced by removing certain redundancies, thereby reducing the storage overhead of the scheme. Its disadvantage is that it cannot reduce the number of extended keys; (2) Another way to optimize the ciphertext expansion algorithm is to directly encrypt the random matrix R to generate auxiliary ciphertext. This method can greatly reduce the amount of keys required for ciphertext expansion. Its disadvantage is that when a new user needs to join, the original user needs to regenerate the auxiliary ciphertext for the new user. Combine the optimization method of removing redundancy in (1) with the optimization method of directly encrypting the random matrix, and flexibly select different ciphertext expansion methods according to different actual conditions: when there are no new users joining, the optimization method of directly encrypting the random matrix is ​​used, and the scheme with a smaller number of extended keys is used; when a new user joins, the scheme with a smaller extended key size in (1) is used, thereby combining the advantages of the two methods to achieve better performance in different application scenarios, and after the user uploads the ciphertext, public key and extended key to the cloud, it supports users to go offline;

[0072] The efficiency analysis comparison between the hybrid optimization scheme and the MW16 scheme is shown in the following table:

[0073]

[0074] The above is only a specific implementation of the present disclosure, but the protection scope of the present disclosure is not limited thereto. Any person skilled in the art who is familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present disclosure, which should be included in the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be based on the protection scope of the claims.

Claims

1. A GSW-type multi-key fully homomorphic encryption method with an efficient ciphertext expansion process, characterized in that: The following steps are involved: Step 1: Initialize the algorithm E.Setup(1 l ,1 L ): Run E.Setup(1 l ,1 L ) algorithm, modulus q = B c 2 O(Lllogl) , output parameters params = (q,n,m,c,B c ,K,B); Step 2: Key generation algorithm E.KeyGen(params): Run the E.KeyGen(params) algorithm; Step 3: Encryption algorithm E.Enc({pk i } i＝1,...,K , User i uniformly selects K random matrices Step 4: Match the set [K] = {1, 2, ..., K} to the user one by one, and input the plaintext to be encrypted μ of user i i ∈{0,1}, public key pk i , i∈[K], generate the ciphertext of user i Step 5: Generate Step 6: Uniformly select a random matrix definition For the last l columns of G, calculate x∈[m], y∈[m], define the extended key: User i will {pk i ,ek i ,C i }Upload to the cloud; Decryption algorithm E.Dec(sk,C): Input ciphertext Private Key definition k∈[K], calculate: Among them G -1 (·) indicates bit decomposition in the column direction and output of decryption result Ciphertext expansion algorithm The ciphertext expansion is introduced in two cases: whether there is a new user joining; Case 1: E.Extend(C i ,ek i ): When there is no new user joining, take user i as an example, enter the ciphertext C of user i i , and the extended key {X j } j∈[K]\i , construct the extended ciphertext: Case 2:. When a new user j * When joining, Assume that the new user set is {1,2,...,K+1}, and the new user j * Corresponding to K+1, input the ciphertext C of user i i , extended key and new user j * The public key Construct extended ciphertext: Homomorphic operation E.Eval(C1,C2): Input two ciphertexts k∈[K], the homomorphic operation mode is the same as E.Eval(C1,C2).

Images