A secure computing system

Abstract

The confidential computing system includes ordinary cryptographic components or members and core cryptographic components or members, wherein the ordinary cryptographic components or members use homomorphic encryption algorithms to encrypt data and perform ciphertext operations; the ordinary cryptographic components or members do not have keys for decrypting ciphertext numbers; the core cryptographic components or members organize ciphertext numbers, perform complex calculations on ciphertext numbers, and decrypt and securely return ciphertext numbers to legitimate users after obtaining authorization; the organization of ciphertext numbers includes changing or adjusting parameters, encryption keys, and homomorphic encryption algorithms used in encryption, decryption, and ciphertext operations; complex calculations on ciphertext numbers refer to calculations that cannot obtain expected results or cannot be completed by performing a limited number of addition and multiplication operations based on ciphertext numbers; floating factors are introduced in addition to the amplification factors to achieve ciphertext operations that approximate floating-point operations; the cryptographic operation context and encryption parameters are included in the ciphertext number data object, and programmers use the data to write programs in the usual way.

Description

Technical Field

[0001] The invention belongs to the technical field of cryptography, and in particular to a confidential computing system. Background Art

[0002] Since Google proposed federated learning, privacy computing technology for machine learning has developed rapidly in recent years. Privacy computing ensures that sensitive information of customers and users is not leaked. Through encryption computing, differential computing, and multi-party collaborative computing, it implements the training of various computing models (such as artificial neural network models) and prediction models, and realizes data analysis and processing. Homomorphic encryption technology is the most commonly used confidential computing technology for privacy computing. Homomorphic encryption technology is based on homomorphic encryption algorithms and can achieve homomorphism between ciphertext number operations and plaintext number operations: the addition and multiplication results of ciphertext numbers correspond to the encrypted results of the same operations (addition and multiplication) on the corresponding plaintext numbers. For example, x and y are two plaintext numbers, and X and Y are the corresponding ciphertext numbers after they are encrypted, that is, X = Enc(x), Y = Enc(y), and Enc() is encrypted, then:

[0003] X+Y=Enc(x)+Enc(y)=Enc(x+y) (additional homomorphism),

[0004] X×Y=Enc(x)×Enc(y)=Enc(x×y) (multiplication homomorphism)

[0005] Note that the "+" and "y" for ciphertext numbers here are not the usual addition and multiplication of "numbers", but just borrowed symbols (the same below). In addition to encryption and ciphertext operations on single plaintext numbers (i.e., single plaintext numbers), current homomorphic encryption algorithms often perform encryption and homomorphic ciphertext operations on plaintext vectors.

[0006] Suppose there is a plaintext vector x=(x1,x2,…,x n ), y=(y1,y2,…,y n ), the encrypted ciphertexts are X=Enc(x1,x2,…,x n ), Y=Enc(y1,y2,…,y n ), then:

[0007] X+Y=Enc(x)+Enc(y)=Enc(x1+y1,x2+y2,…,x n +y n )(vector plus homomorphism),

[0008] X×Y=Enc(x)×Enc(y)=Enc(x1×y1,x2×y2,…,x n ×y n )(vector multiplication homomorphism).

[0009] It should be noted that (1) the ciphertext after the plaintext vector is encrypted is not necessarily a vector. Vector encryption usually involves mapping a vector to a polynomial in a polynomial ring, and the encryption result (ciphertext) is usually also a polynomial in the polynomial ring. (2) The vector multiplication here is different from the usual vector dot multiplication (inner product). The vector multiplication here uses the multiplication of the corresponding elements (components) of the vector.

[0010] Homomorphic encryption algorithms are divided into partially homomorphic encryption algorithms and fully homomorphic encryption algorithms. Partially homomorphic encryption algorithms can only achieve homomorphism for addition or multiplication operations (such as Paillier and RSA), while fully homomorphic encryption algorithms can achieve homomorphism for addition and multiplication operations at the same time (such as BGV, BFV, and CKKS) (usually, if there is addition homomorphism, subtraction homomorphism can be achieved). From the perspective of the accuracy of the calculation results, there are approximate homomorphic encryption algorithms (obtaining approximate results, such as CKKS) and exact homomorphic encryption algorithms (obtaining exact results, such as BGV and BFV). In many applications, such as model training and data prediction, approximate homomorphic encryption algorithms are sufficient, simple and effective. In addition to being used for privacy computing such as model training and data analysis, homomorphic encryption technology can also be used in many other applications and scenarios, such as SaaS cloud computing applications and internal enterprise applications (such as financial systems).

[0011] In current privacy computing, the data used for calculation is provided by the customer or user in the form of encrypted data. Calculations using ciphertext data, such as model training, are often provided by specialized privacy computing platforms or service providers. In order to ensure the security of user data, the party that uses ciphertext data for calculation and processing (privacy computing platform or service provider) should not have the decryption key (private key of the homomorphic encryption algorithm) and should not have the ability to decrypt data. That is, the party that uses ciphertext data for calculation and processing should perform calculations entirely based on encrypted data (ciphertext numbers). However, this method of using only ciphertext numbers for operations and calculations also has certain problems, because multiplication of ciphertext numbers will cause the (LWE) noise introduced by data encryption to increase, and the ciphertext number will continue to increase. In addition, the current homomorphic encryption algorithm usually only supports integer encryption and operations. Numbers with decimals must be converted to integers by amplification. In order to improve the accuracy of the approximate homomorphic encryption algorithm, even integers must be amplified, which leads to a large ciphertext number, and the ciphertext multiplication operation further amplifies this amplification effect, which will lead to low computational efficiency and increased resource consumption, making the error of the approximate homomorphic encryption algorithm increase and the computational accuracy decrease. Therefore, homomorphic encryption usually limits the number of multiplications by setting the number of ciphertext (operation) levels (i.e., the operation depth). Each time a ciphertext number is multiplied, its ciphertext level will be reduced by one (i.e., the number of multiplication operations allowed will be reduced by one). At the same time, through ciphertext level conversion (switching) processing, such as bootstrapping and modulus switching (modulus Switching) and rescaling (rescale) are used to reduce the noise increase caused by ciphertext multiplication (ciphertext number refreshing), to reduce the multiplication effect of amplification on ciphertext number multiplication, but this brings another problem. What if the number of multiplications needs to be very large? Even infinite, such as recursive calculations? You can't increase the number of ciphertext levels of ciphertext data indefinitely, right?

[0012] The current homomorphic encryption algorithm can only perform or is designed to perform integer homomorphic ciphertext operations, while in reality, most of the numbers to be calculated and processed are real numbers with decimals. Therefore, the common practice for real number homomorphic ciphertext operations is to multiply the real number by a scaling factor γ (scaling factor, also known as scaling factor, but it usually takes a value much greater than 1, so it is usually also called a scaling factor or expansion multiple, and the symbol used by the scaling factor γ in CKKS is Δ), then round the product, and then encrypt the rounded result, so as to convert the operation on the real number into the operation on the integer, that is, convert the homomorphic ciphertext operation on the real number into the homomorphic ciphertext operation on the integer (for real numbers containing decimal parts, multiplying by the scaling factor also allows the decimal part to have enough valid digits to be retained). For approximate homomorphic encryption algorithms, it is also necessary to improve the accuracy of the ciphertext operation by multiplying the number to be encrypted (even if it is an integer) by a scaling factor. In computer technology, this practice actually converts the operation of floating-point numbers into the operation of fixed-point numbers, and this scaling factor actually determines the position of the decimal point of the fixed-point number. However, this approach still has certain problems in practical applications, because different numbers have different orders of magnitude, and numbers of different orders of magnitude must be multiplied by the same amplification factor to perform operations. For numbers of different orders of magnitude, in order to ensure that the encryption result of the data and the operation result have enough valid digits, the amplification factor may have to be very large (taking into account or taking into account very small numbers), which will cause the integers involved in the calculation to be very large, resulting in very low calculation efficiency; and in order to ensure calculation efficiency, the amplification factor cannot be too large, which will cause very small numbers to lose valid digits (bits) or even become 0. Therefore, numbers of different orders of magnitude should use different amplification factors, but this brings problems. The homomorphic encryption algorithm requires that the numbers involved in the operation use the same amplification factor. If the amplification factors used when encrypting two ciphertext numbers are different, the correct ciphertext operation result cannot be obtained (note that the modulus may be related to the amplification factor. Different amplification factors γ will result in different moduli. For example, q in the CKKS algorithm L =p L q0,q l =p l q0, p and the amplification factor γ must be almost equal. Even if the modulus is the same, the amplification factors of the two numbers in addition and subtraction operations must be the same for the operation to be performed). Therefore, if two ciphertext numbers with different amplification factors are to be operated, the amplification factors γ of the two must first be made consistent (for addition and subtraction operations, this is equivalent to aligning the decimal points), and it is usually difficult to make such adjustments based on the ciphertext numbers.

[0013] Also, due to the above reasons, some commonly used functions, such as e x , sin(x), directly use the ciphertext number to calculate (such as e X, sin(X)), the efficiency is low, and the accuracy and number of significant digits cannot be guaranteed.

[0014] In addition, due to various reasons (such as data coming from different parties or historical reasons), the data involved in confidential computing may use different homomorphic encryption algorithms, encryption parameters, and public keys. These data encrypted using different homomorphic encryption algorithms, encryption parameters, and public keys cannot be directly encrypted.

[0015] In addition, ordinary programmers do not understand homomorphic encryption algorithms (it is difficult to understand the algorithms), are not familiar with the principles and steps of using homomorphic encryption algorithms to encrypt data, and are not familiar with how to use homomorphic encryption ciphertext numbers for operations and calculations. Therefore, it is difficult to correctly and appropriately use existing homomorphic encryption libraries to write computing programs, which brings obstacles to the application of homomorphic encryption technology. Summary of the invention

[0016] The purpose of the present invention is to propose a technical solution to the problems existing in the practical application of homomorphic encryption technology so as to overcome the deficiencies of the prior art.

[0017] The technical solution proposed for the purpose of the present invention is a confidential computing system.

[0018] In the description of the present invention, unless otherwise specified, a plaintext number refers to a number (data) before encryption using a homomorphic encryption algorithm, and a number (data) obtained after decrypting a homomorphically encrypted ciphertext number, that is, it is the original number (data) to be encrypted and the final number (data) obtained by decryption, not a number (data) encoded for encryption (such as a polynomial); data with only one plaintext number is called a single plaintext number, and a vector composed of multiple plaintext numbers is called a plaintext vector; a single plaintext number and a plaintext vector are collectively referred to as a plaintext number (that is, unless otherwise specified, the present invention The plaintext number includes both a single plaintext number and a plaintext vector); the ciphertext after a single plaintext number is encrypted is called a single ciphertext number, and the ciphertext after a plaintext vector is encrypted is called a vector ciphertext number (note that vector ciphertext refers to the result of vector encryption, which is not necessarily a vector. The addition of a "number" after "vector ciphertext" is to emphasize that it can be calculated like a number); a single ciphertext number and a vector ciphertext number are collectively referred to as a ciphertext number; that is, the plaintext number in the present invention includes both a single plaintext number and a plaintext vector, and the ciphertext number includes both a single ciphertext number and a vector ciphertext number;

[0019] The encryption (operation) of data using a homomorphic encryption algorithm is referred to as homomorphic encryption. The operation during data encryption is called encryption operation, and the operation during data decryption is called decryption operation. The addition (subtraction) and multiplication operations (algebraic operations) performed on ciphertext numbers based on the homomorphic encryption algorithm are called homomorphic ciphertext operations, referred to as ciphertext operations (belonging to confidentiality operations); encryption operations, decryption operations, and ciphertext operations are collectively referred to as cryptographic operations; the calculation process for ciphertext numbers consisting of one or more ciphertext operations is called ciphertext calculation; the entire process of performing encryption operations on data to generate ciphertext numbers, performing a series of ciphertext operations on the ciphertext numbers to obtain the desired calculation results, and finally decrypting the calculation results is called confidentiality calculation (that is, confidentiality calculation is a calculation process that includes a series of processing such as data encryption, ciphertext operation, ciphertext calculation, and data decryption).

[0020] If the ciphertext number is a vector ciphertext number, then the various calculations other than addition and multiplication operations of the ciphertext number (including complex calculations) in the present invention include both a method of performing the same calculation on each encrypted plaintext element in the vector ciphertext number and a method of not performing the same calculation on each encrypted plaintext element in the vector ciphertext number (see the following embodiments).

[0021] The secure computing system proposed by the present invention is specifically as follows.

[0022] The secure computing system includes common cryptographic components or members, and core cryptographic components or members, wherein:

[0023] Ordinary cryptographic components or components: use homomorphic encryption algorithms to encrypt plaintext numbers and perform algebraic operations on ciphertext numbers, i.e., ciphertext operations (such as addition and multiplication operations on ciphertext numbers); ordinary cryptographic components or components do not have a key (private key) for decrypting ciphertext numbers;

[0024] Core cryptographic components or building blocks: tidying up ciphertext numbers, performing complex calculations on ciphertext numbers, and returning ciphertext numbers to the user or owner of the decrypted data after decryption; tidying up ciphertext numbers is aimed at changes or adjustments to ciphertext numbers that are difficult or impossible to make without decrypting the ciphertext numbers to obtain their plaintext numbers, including changes or adjustments to the cryptographic operation context used in data encryption operations, data decryption operations, and ciphertext operations, i.e., cryptographic operations (such as changing the modulus, such as changing the modulus q in CKKS) L , change or modify the current modulus q l , change the polynomial modulus used in the polynomial ring, such as X N+1, change the homomorphic encryption algorithm used, etc.), change or adjust parameters related to cryptographic operations outside the cryptographic operation context (such as changing or adjusting the amplification factor γ, changing the encryption key used, i.e., the public key; in the homomorphic encryption scheme used, if the amplification factor γ selected for a certain number is fixed, then the amplification factor γ may belong to the cryptographic operation context or not, but if it is not fixed, it does not belong), and change or adjust the ciphertext level of the ciphertext number (for example, the ciphertext level has been used up, and the ciphertext number multiplication operation is required later. For another example, each time a multiplication operation is performed, the ciphertext level of a ciphertext number changes from high to low, but now the ciphertext level needs to be changed from low to high in reverse. For example, recursively calculate y i+1 =a×y i +b×u i The y in i , after a certain number of recursive calculations, it is necessary to upgrade its ciphertext level. If the algorithm does not support this, it is usually impossible to do so, but the present invention can do so); the core cryptographic component or component has a key (private key) for decrypting the ciphertext number; the key (private key) for decrypting the ciphertext number is securely protected; the core cryptographic component or component does not return sensitive data in plain text, and the sensitive data includes data decrypted from the ciphertext number, and data calculated using the data decrypted from the ciphertext number that is not allowed to be returned in plain text (which of the data calculated using the data decrypted from the ciphertext number is not allowed to be returned in plain text is determined by the implementer);

[0025] The plaintext number includes a single plaintext number and a plaintext vector, and the ciphertext number includes a ciphertext obtained by encrypting a single plaintext number, i.e., a single ciphertext number, and a ciphertext obtained by encrypting a plaintext vector, i.e., a vector ciphertext number;

[0026] The complex calculation refers to the calculation that cannot obtain the expected result due to the limitation of the number of multiplication operations allowed by the ciphertext number, that is, the limitation of the ciphertext level (for example, the e X , ln(X), sin(X) and other function calculations), or calculations that are difficult or impossible to complete using ciphertext numbers; the difficult or impossible calculations refer to calculations that cannot be completed and obtain the expected results based on ciphertext numbers within the required or specified time due to the limitations of the homomorphic encryption algorithm itself or the computing technology (for example, due to the limitations of computing and storage resources in actual calculations, the number of ciphertext levels cannot be increased infinitely, and the number of ciphertexts cannot be increased infinitely) (for example, calculations that cannot meet the calculation accuracy requirements, or calculations that cannot be completed at all due to algorithmic reasons);

[0027] The cryptographic operation context refers to the set of common parameters required for encryption operation, decryption operation and ciphertext operation, i.e., cryptographic operation, for data. The set of common parameters constitutes the basic background environment of the cryptographic operation (amplification factor, generation parameters of floating factor, which may or may not belong to the information in the small text of the cryptographic operation, they may belong to the information contained in the ciphertext data object, and the homomorphic encryption algorithm identification information, the construction parameters of the ring used in the cryptographic operation such as the polynomial ring, the modulus used in the cryptographic operation, etc. belong to the information in the small text of the cryptographic operation, and the floating factor, the current ciphertext operation modulus such as q of CKKS l or level, public key, and private key are not common parameters and therefore do not belong to the cryptographic operation context); if the confidential computing system supports different homomorphic encryption algorithms at the same time, the cryptographic operation context also includes a homomorphic encryption algorithm identifier, which is used to identify the homomorphic encryption algorithm used for data encryption operations, decryption operations, and ciphertext operations; if there is no homomorphic encryption algorithm identifier in the cryptographic operation context, the corresponding homomorphic encryption algorithm (in the cryptographic operation context) is the default algorithm;

[0028] The components in the common cryptographic components or members and the core cryptographic components or members are system components that cannot run independently (including software or hardware, such as SDK, API or cryptographic card), and the components are system components that can run independently (such as independently running programs, cryptographic servers including software and hardware, cryptographic machines, etc.); the common cryptographic components or members and the core cryptographic components or members are located in the same or different operating places (venues). If the two are located in different operating places (venues), then (when the common cryptographic components or members need to call the core cryptographic components or members) the common cryptographic components or members exchange data with the core cryptographic components or members through the network (even if they are located in the same place, but located in or belong to different computing devices, data exchange is also required through the network);

[0029] For a request for arranging a ciphertext number submitted by the common cryptographic component or component, the core cryptographic component or component decrypts the ciphertext number to be arranged, arranges the plaintext number obtained by decryption according to the requirements of the common cryptographic component or component, and then re-encrypts the arranged plaintext number using a homomorphic encryption algorithm, and then returns the re-encrypted ciphertext number;

[0030] For a request submitted by the common cryptographic component or component to perform a complex calculation on (one or more) ciphertext numbers, the core cryptographic component or component decrypts the ciphertext number, uses the (one or more) plaintext numbers obtained by decryption to perform the complex calculation required by the common cryptographic component or component, and then uses a homomorphic encryption algorithm to encrypt the calculated result, and then returns the encrypted ciphertext number;

[0031] For a request to decrypt and return a plaintext number corresponding to a ciphertext number (the request is submitted by an ordinary cryptographic component or member, or by other entities through other means), the core cryptographic component or member, after confirming the authorization of the user or owner of the requesting decrypted data, and / or the owner, manager, or controller of the core cryptographic component or member, decrypts the ciphertext number, encrypts the decrypted plaintext number with the data encryption key of the user or owner of the decrypted data (usually a public key, including an ordinary public key or a homomorphic encryption public key, or a symmetric key), and then returns the encrypted ciphertext (the ciphertext obtained by re-encrypting the decrypted plaintext number) to The user or owner of the decrypted data (usually returned to the ordinary cryptographic component or component, which then returns it to the user or owner of the decrypted data, or returns it to the user or owner of the decrypted data in other ways); thereafter, the user or owner of the decrypted data uses the data decryption key (usually a private key, including an ordinary private key or a homomorphic encryption private key, or a symmetric key) to decrypt the ciphertext returned by the core cryptographic component or component (i.e., the plaintext number after decryption and re-encryption), and finally obtains the plaintext number (there is no special restriction on the cryptographic algorithm used to encrypt the plaintext number returned to the user or owner of the decrypted data).

[0032] It should be pointed out that the cryptographic operation context, that is, the set of common parameters required for data encryption operations, data decryption operations and ciphertext operations, is usually implemented through a data structure called a cryptographic operation context or a cryptographic context or an encryption context, etc., which is used to store various common parameters required for cryptographic operations (i.e., the parameters in the cryptographic operation context). Therefore, when mentioning the cryptographic operation context, it should be determined based on the context of the text statement and narration whether the cryptographic operation context refers to the various common parameters required for cryptographic operations or a specific data structure. In the description of the invention scheme, it refers to the set of common parameters required for data encryption operations, data decryption operations and ciphertext operations.

[0033] A single plaintext number to be encrypted (including real numbers and complex numbers, real numbers correspond to integers and floating-point numbers in computers) is decomposed into the product of a floating factor β (floating factor) and a number of significant digits (the floating factor β is not the amplification factor γ in homomorphic encryption), wherein the number of significant digits refers to a number containing a desired number of significant digits, i.e., a number with sufficient significant digits (note the difference between significant digits and the number of significant digits, i.e., the number of significant digits, which refers to the number of significant digits); for a complex plaintext number, the floating factors of its real and imaginary parts are the same (if they are different, the number will be adjusted more); the floating factor is a positive number (the floating factor can be greater than 1, less than 1, or 1); the ciphertext of the significant digits is obtained by encrypting the significant digits, and the ciphertext of the significant digits and the floating factor together constitute the ciphertext of a single plaintext number, i.e., a single ciphertext number;

[0034] A plaintext vector to be encrypted (real or complex vector, the vector as a whole is regarded as a number), each element of which is decomposed into the product of the same floating factor β and a significant digit, and the significant digits of all elements (arranged in the original order of the corresponding plaintext elements) constitute a significant digit (plaintext) vector (that is, when decomposing, the floating factor of each element of the plaintext vector is the same, and the floating factor β multiplied by the significant digit vector is the original plaintext vector, just like the magnification factor γ of each element of the vector is the same; Note: taking the floating factor is the processing before multiplying the magnification factor); encrypting the significant digit vector obtains the ciphertext of the significant digit vector, i.e., the vector ciphertext number (of the significant digit vector), and the ciphertext of the significant digit vector, i.e., the vector ciphertext number, together with the floating factor, constitutes the ciphertext of the plaintext vector, i.e., the vector ciphertext number (of the plaintext vector);

[0035] The significant digits of a single plaintext number and the significant digits vector of a plaintext vector are collectively referred to as the significant digits (of the plaintext number), and the ciphertext of the significant digits of a single plaintext number, i.e., the ciphertext number, and the ciphertext of the significant digits vector of a plaintext vector, i.e., the vector ciphertext number (of the significant digits vector), are collectively referred to as the ciphertext of the significant digits or the ciphertext number of the significant digits (i.e., unless otherwise specified, the significant digits of a plaintext number described in the present invention include both the significant digits of a single plaintext number and the significant digits vector of a plaintext vector, and the ciphertext of the significant digits includes both the ciphertext of the significant digits of a single plaintext number, i.e., the ciphertext number, and the ciphertext of the significant digits vector of a plaintext vector, i.e., the vector ciphertext number);

[0036] The selection of the floating factor should be such that the homomorphic encryption algorithm is used to encrypt the effective digits in the usual way, and the encrypted result and the result of the operation based on the ciphertext number (ciphertext operation result) meet the requirements for the effective digits, calculation accuracy and calculation efficiency of the data (before and after encryption and decryption, before and after ciphertext operation) (for example, the effective digits to be encrypted itself cannot be too large, and there are sufficient accuracy and effective digits, etc., especially for the approximate homomorphic encryption algorithm); the encryption in the usual way for the effective digits refers to the encryption method used to encrypt the number to be encrypted when the floating factor is not introduced (for example, when encrypting the effective digits, the effective digits to be encrypted still need to be multiplied by the magnification factor γ);

[0037] When a system component, including a common cryptographic component or member and a core cryptographic component or member, encrypts a plaintext number, (the system component, such as the common cryptographic component or member, or the core cryptographic component or member) first decomposes the plaintext number to be encrypted into the product of a floating factor β and a valid digit, and then uses a homomorphic encryption algorithm to encrypt the valid digit in a usual manner to obtain a ciphertext (number) of the valid digit (before the valid digit is encrypted, it is also multiplied by the amplification factor γ, and the floating factor β is not encrypted), and then combines the floating factor and the ciphertext (number) of the valid digit to form a ciphertext number after the plaintext number is encrypted;

[0038] When a system component, including a core cryptographic component or component, decrypts a ciphertext number, (the system component, such as a core cryptographic component or component) first decrypts the ciphertext (number) of the significant digits in the ciphertext number to obtain the corresponding significant digits (plaintext), and then multiplies the decrypted significant digits (plaintext) by the floating factor β given in the ciphertext number to obtain the plaintext number corresponding to the ciphertext number (note that the significant digits are encrypted and decrypted according to the usual homomorphic encryption method).

[0039] Note that the plaintext number to be encrypted here can be a single plaintext number or a plaintext vector, and the ciphertext number to be decrypted can be a single ciphertext number or a vector ciphertext number; if the ciphertext number to be decrypted is a vector ciphertext number, then the ciphertext of the significant digits in the ciphertext number is the ciphertext of the significant digit vector, that is, the vector ciphertext number (of the significant digit vector), and the significant digits (plaintext) obtained by decrypting it is the significant digit (plaintext) vector. The floating factor β given in the ciphertext number is multiplied by the significant digit (plaintext) vector obtained by decryption, and the plaintext number obtained is the plaintext vector corresponding to the vector ciphertext number to be decrypted.

[0040] Different numbers can have different floating factors, and the floating factor can have β=cq j In the form of, q is a positive integer greater than 1 (q itself can be q = 2 nIn this case, the difference between two adjacent floating factors is q times (the larger one divided by the smaller one), and the floating factor can also be other than β=cq. j This form, that is, there is no fixed multiple relationship between two adjacent floating factors. The floating factor β is different from the magnification factor γ. The magnification factor γ must be greater than 1, while the floating factor can be greater than 1, less than 1, or equal to 1. β = cq j The q in is not directly related to the magnification factor γ. q reflects the granularity of the floating factor. The magnification factor γ is used to convert floating point numbers to fixed point numbers and to improve the accuracy of the approximate homomorphic encryption algorithm. If the number of valid digits is limited to integers, the introduction of the floating factor converts the homomorphic encryption and operation of real numbers into homomorphic encryption and operation for integers, that is, for the exact homomorphic encryption algorithm, the magnification factor γ can be fixed to 1 (that is, no magnification factor is used, of course, this is not necessary).

[0041] For the two ciphertext numbers (whether they are single ciphertext numbers or vector ciphertext numbers) that are added or subtracted, not only the amplification factor γ but also the floating factor β must be the same, otherwise corresponding adjustments must be made.

[0042] When it is necessary to adjust the floating factor of a ciphertext number, the common cryptographic component or member submits the ciphertext number to be adjusted to the core cryptographic component or member; the core cryptographic component or member decrypts the ciphertext number (first decrypts the ciphertext of the significant digits therein to obtain the plaintext of the significant digits, and then multiplies the plaintext by the floating factor) to obtain the plaintext number, and then automatically adjusts the floating factor of the plaintext number and the corresponding significant digits (how to automatically adjust depends on the specific implementation, and the principle of automatic adjustment is usually to retain as many significant digits as possible), or adjusts the floating factor of the plaintext number and the corresponding significant digits according to the floating factor or requirement specified in the adjustment request (for example, the significant digit requirement of the significant digits, the range limit of the significant digits, etc.), and then uses the homomorphic encryption algorithm to encrypt the adjusted significant digits, and the encryption result and the adjusted floating factor together form the adjusted ciphertext number, and then returns the adjusted ciphertext number to the common cryptographic component or member.

[0043] When adjusting the floating factor of a ciphertext number, it is also possible to adjust the cryptographic operation context (such as the homomorphic encryption algorithm, modulus, polynomial modulus of the polynomial ring, such as X N +1, number of levels) and other encryption parameters outside the cryptographic operation context (such as amplification factor, current ciphertext operation modulus, public key, current level of the ciphertext number).

[0044] The adjustment of the floating factor mentioned above includes both increasing and decreasing the floating factor, and even allows adjusting a floating factor greater than 1 to less than 1, and allows adjusting a floating factor less than 1 to greater than 1; but the adjustment of the floating factor needs to ensure that the value of the plaintext number corresponding to the ciphertext number remains unchanged (for approximate calculations, it remains unchanged within the allowable error range). Therefore, if the floating factor is increased, the corresponding number of significant digits will become smaller (the corresponding multiple), and if the floating factor is decreased, the corresponding number of significant digits will become larger (the corresponding multiple).

[0045] A way for common cryptographic components or parts to reduce the floating factor (by themselves) without the help of core cryptographic components or parts is as follows:

[0046] If it is necessary to reduce the floating factor of a ciphertext number by d times (d is usually an integer greater than 1), then reduce the floating factor of the ciphertext number to be adjusted by d times to obtain a new floating factor, and then multiply the ciphertext of the significant digits of the ciphertext number to be adjusted by the (homomorphic encryption) ciphertext number of d (the floating factor of d is 1 at this time, and it depends on the algorithm whether it needs to be multiplied by the amplification factor γ, that is, whether γ is 1) to obtain the ciphertext of the new significant digits, or, if the (adopted) homomorphic encryption algorithm supports the multiplication of ciphertext numbers by plaintext numbers, then multiply the ciphertext of the significant digits of the ciphertext number to be adjusted by the plaintext number d to obtain the ciphertext of the new significant digits; the new floating factor and the ciphertext of the new significant digits together constitute the ciphertext number with the adjusted floating factor.

[0047] For approximate homomorphic encryption algorithms, this method of adjusting the floating factor by oneself, especially the method of directly multiplying the ciphertext with the number of significant digits of the ciphertext number and the plaintext number d, will introduce certain additional errors. In specific implementation, whether the floating factor is adjusted with the help of core cryptographic components or components, or by ordinary cryptographic components or components themselves, is determined according to actual conditions. For example, when the core cryptographic components or components cannot be called for adjustment, they can only be adjusted by ordinary cryptographic components or components themselves. Alternatively, when the additional error introduced is within an acceptable range and higher computing efficiency is expected, they can be adjusted by themselves.

[0048] One way for a common cryptographic component or component to increase the floating factor without the help of a core cryptographic component or component is as follows:

[0049] If it is necessary to increase the floating factor of a ciphertext number by d times (d is usually an integer greater than 1) and 1 / d is within the representation range of the effective digits (i.e., 1 / d is the allowed effective digits, note that the floating factor of 1 / d is 1 at this time), the common cryptographic component or member increases the floating factor of the ciphertext number to be adjusted by d times to obtain a new floating factor, multiplies the ciphertext of the effective digits of the ciphertext number to be processed by 1 / d after homomorphic encryption (multiplied by the amplification factor before encryption), and obtains the ciphertext of the new effective digits. The new floating factor and the ciphertext of the new effective digits together constitute the ciphertext number with the adjusted floating factor.

[0050] When the ciphertext numbers of two numbers are multiplied, the common cryptographic component or member multiplies the ciphertexts of the effective digits of the two numbers according to the homomorphic encryption algorithm to obtain the ciphertext of the effective digits of the product, and multiplies the floating factors to obtain the floating factors of the product (the multiplication of the floating factors is the multiplication of the plaintext numbers);

[0051] When two ciphertext numbers with the same floating factor are added (including addition and subtraction), the common cryptographic component or member adds the ciphertexts of the significant digits of the two numbers according to the addition operation of the homomorphic encryption algorithm to obtain the ciphertext of the significant digits of the sum, and the floating factor remains unchanged;

[0052] When two ciphertext numbers with different floating factors are added (including addition and subtraction), the common cryptographic component or member adjusts the floating factors of the two ciphertext numbers to be consistent with each other with the help of the core cryptographic component or member or by itself, and then adds the two ciphertext numbers with the same adjusted floating factors.

[0053] Note that the ciphertext number adjusted and calculated above can be a single ciphertext number or a vector ciphertext number; if the ciphertext number is a vector ciphertext number, the ciphertext of the significant digits here is the ciphertext of the significant digit vector, that is, the vector ciphertext number (of the significant digit vector).

[0054] For floating-point operations, when two floating-point numbers with different exponents are added (including addition and subtraction), it is fixed that the exponent of the floating-point number with the smaller exponent is adjusted to the exponent of the floating-point number with the larger exponent (adjusted to the larger exponent). In this way, the floating-point number with the smaller exponent will lose significant digits (effective digits), because the mantissa of the floating-point number, i.e., the number containing the effective digits, will shift right, resulting in the loss of the tail digits. For the scheme of the present invention, when two ciphertext numbers with different floating factors are added, it is not necessary to adjust the smaller floating factor of the two ciphertext numbers to the larger floating factor. Similarly, for the scheme of the present invention, if the larger floating factor of the two ciphertext numbers is adjusted to the larger floating factor, the floating-point number with the smaller exponent will lose significant digits (effective digits). If a small floating factor is adjusted to a larger floating factor, then after the adjustment, the number of significant digits (plaintext) corresponding to the ciphertext number with the smaller floating factor will become smaller accordingly, which will result in the loss of significant digits. On the contrary, while ensuring that the encrypted plaintext number remains unchanged, it is more desirable to adjust the larger floating factor of the two ciphertext numbers to a smaller floating factor. After the adjustment, the number of significant digits (plaintext) corresponding to the ciphertext number with the larger floating factor will become larger accordingly (the product of the two remains unchanged, that is, the encrypted number itself remains unchanged), which can avoid losing significant digits, retain more significant digits, and achieve higher calculation accuracy.

[0055] The technical solution of the present invention introduces a floating factor on the basis of the usual amplification factor, wherein the amplification factor is mainly used to ensure the calculation accuracy, while taking into account the effective digits of the encrypted number (the effective digits of the effective digits), but cannot ensure the effective digits of the ciphertext operation and the ciphertext calculation result (i.e., the number of effective digits), and the floating factor is mainly used to ensure that the encrypted number (i.e., the ciphertext number), the ciphertext operation and the ciphertext calculation result have enough effective digits (have enough effective digits), so as to achieve a technical effect similar to floating-point operation and calculation. Although the introduction of the floating factor will expose the range of the absolute value of the encrypted number to some extent, considering the purpose of confidentiality (privacy) calculation, this information exposure does not pose a substantial hazard. For example, assuming that the operation and calculation process is a picture, this information exposure will not lead to the leakage of the picture content itself, and in many cases the range of the number to be calculated and processed is known in advance.

[0056] If the common cryptographic component or component requires the core cryptographic component or component to organize a ciphertext number X, and at the same time does not want to expose the plaintext number x corresponding to the ciphertext number X to the core cryptographic component or component, the common cryptographic component or component uses the homomorphic encryption algorithm and homomorphic ciphertext operation to convert the ciphertext number X into Y, where Y is the ciphertext number x-x0 (the floating factor must be consistent when reducing), that is, the plaintext number corresponding to Y is y=x-x0, x0 is a number randomly selected by the common cryptographic component or component (within the allowed range) or a number derived from the randomly selected number (x0 is not noise or error in the homomorphic encryption algorithm, x0 itself can be positive, negative or 0), and then submits the ciphertext number Y to the core cryptographic component or component. The core cryptographic component or component requests to be sorted (such as adjusting its floating factor, changing its encryption parameters, the homomorphic encryption algorithm used, etc.); the core cryptographic component or component decrypts Y to obtain the plaintext number y corresponding to Y, and then uses the plaintext number y corresponding to the ciphertext number Y to complete the sorting required by the ordinary cryptographic component or component, and then uses the homomorphic encryption algorithm to encrypt the sorted result, and returns the encrypted sorted result to the ordinary cryptographic component or component; the ordinary cryptographic component or component uses the homomorphic encryption algorithm and homomorphic ciphertext operation to add the homomorphic encrypted ciphertext number X0 of x0 to the ciphertext number returned by the core cryptographic component or component (the floating factors must be consistent during the addition operation), so as to obtain the expected sorting result for the ciphertext number X.

[0057] Note that if the ciphertext number is a vector ciphertext number, then correspondingly, the randomly selected number or the number x0 derived from the randomly selected number described above is a plaintext vector.

[0058] If the common cryptographic component or component requires the core cryptographic component or component to use (one or more) ciphertext numbers X to complete complex calculations, and at the same time does not want to expose the plaintext number x corresponding to the ciphertext number X to the core cryptographic component or component, the common cryptographic component or component uses the homomorphic encryption algorithm and homomorphic ciphertext operation to convert the ciphertext number X into Y, where Y is the ciphertext number of x+x0 or x·x0 (· is a multiplication operation), that is, the plaintext number y corresponding to Y is x+x0 or x·x0, and x0 is a number randomly selected by the common cryptographic component or component (within the allowed range) or a number derived from the randomly selected number (note that x0 is not noise or error in the homomorphic encryption algorithm, and x0 itself can be positive, negative or 0), and then submits (one or more) ciphertext numbers Y to the core cryptographic component or component to request the completion of the specified calculation; the core cryptographic component The common cryptographic component or component decrypts Y to obtain the plaintext number y corresponding to Y, and then uses the plaintext number y corresponding to the ciphertext number Y to complete the calculation specified by the common cryptographic component or component, and then uses the homomorphic encryption algorithm to encrypt the calculation result, and returns the encrypted calculation result to the common cryptographic component or component; the common cryptographic component or component uses the ciphertext number returned by the core cryptographic component or component and x0, and uses the homomorphic encryption algorithm and homomorphic ciphertext operation to calculate the expected calculation result (the result originally expected to be calculated using X is usually -x0 or 1 / x0 or their corresponding ciphertext numbers, or the derived number of x0 or the ciphertext number of the derived number of x0, to eliminate the influence of introducing x0 on the calculation result. The premise for this to be done is that the original calculation supports this, and common algebraic calculations and function calculations support this).

[0059] Note that if the ciphertext number is a vector ciphertext number, then correspondingly, the randomly selected number or the number x0 derived from the randomly selected number described above is a plaintext vector, and this transformation calculation method is usually only used in the case where the same complex calculation is performed on each encrypted plaintext element in the vector ciphertext number.

[0060] This method of requesting the core cryptographic component or component to perform complex calculations by decomposing and transforming the ciphertext number X is not necessary. The ordinary cryptographic component or component can directly submit the ciphertext number X to the core cryptographic component or component, which decrypts the ciphertext number X to obtain its plaintext number x, uses the plaintext number x to complete the complex calculation, and then uses the same encryption algorithm to encrypt the result calculated using the plaintext number x, and returns the encrypted result. It is only necessary to use this decomposition and transformation calculation method to perform complex calculations when the plaintext number x corresponding to the ciphertext number X is very sensitive data and the core cryptographic component or component is not allowed to access the plaintext number x corresponding to the ciphertext number X according to security requirements.

[0061] For complex calculations, if the calculation rule or function (for plaintext numbers) is not a conventional calculation rule or function supported by the core cryptographic component or member, the core cryptographic component or member may complete the corresponding calculation in the following ways:

[0062] The program code for plaintext number calculation is loaded and called by the core cryptographic component or component as a trusted code (such as a digitally signed trusted code), and the trusted code completes the corresponding expected calculation (the trusted code uses plaintext numbers and returns plaintext numbers or ciphertext numbers);

[0063] Alternatively, the common cryptographic component or member submits a description (expression) of a calculation rule or function corresponding to a complex calculation, and the core cryptographic component or member completes the corresponding desired calculation by parsing the description of the calculation rule or function;

[0064] The conventional calculation rules or functions supported by the core cryptographic components or members refer to the calculation rules or functions that the core cryptographic components or members can complete the corresponding calculations without providing additional calculation rules or function description formulas (expressions) or additional program codes (i.e., the calculation rules or functions that the core cryptographic components or members already support).

[0065] For the above-mentioned confidential computing system, one way to authorize a request for decrypting a plaintext number corresponding to a ciphertext number is through authorization data; the authorization data contains the ciphertext number to be decrypted or the hash value (hash value, hash value) of the ciphertext number, and is digitally signed by the user or owner of the decrypted data, and / or the owner, manager or controller of the core cryptographic component or component (digitally signed by the user or owner of the decrypted data, and the owner, manager or controller of the core cryptographic component or component at the same time, or only by the user or owner of the decrypted data, or only by the owner, manager or controller of the core cryptographic component or component, which method is related to the application scenario and security requirements targeted by the specific implementation), and the digital signature includes a public key digital signature or a symmetric key digital signature (such as an HMAC signature);

[0066] The entity (user, program, organization) requesting to return the plaintext number corresponding to the ciphertext number, when requesting to return the plaintext number corresponding to the ciphertext number, submits the corresponding authorization data for obtaining the plaintext number corresponding to the ciphertext number; the core cryptographic component or component verifies the validity of the authorization data by verifying the digital signature of the authorization data;

[0067] If the core cryptographic component or member does not pre-store the encryption key used by the user or owner of the decrypted data for data encryption (i.e., encryption of the returned plaintext number), the authorization data contains a public key used to encrypt the returned data (plaintext number) or data used to generate and derive the encryption key (i.e., key negotiation data).

[0068] For the confidential computing system described above, the core cryptographic component or component maintains an authorizer list, the information of which includes the identification information of the authorizer, the signature verification key (public key or symmetric key) for the digital signature of the authorizer, the authorization method (for example, single entity authorization or joint authorization of multiple entities), and the encryption key (public key or symmetric key) for encrypting the plaintext number returned to the user or owner of the decrypted data after decrypting the ciphertext number; the authorizer refers to an entity that can issue authorization data, including the user or owner of the decrypted data, and the owner, manager or controller of the core cryptographic component or component.

[0069] The system or system component that issues the authorization data logs the issued authorization data.

[0070] After returning the plaintext number corresponding to the ciphertext number to the user or owner of the decrypted data (the plaintext number encrypted with the key of the user or owner of the decrypted data), the core cryptographic component or member logs the plaintext number returned by decryption. The log contains authorization data and a hash value (hash value, hash value) of the plaintext number returned (to the user or owner of the decrypted data).

[0071] For the above-mentioned confidential computing system, if the user or owner of the decrypted data holds the private key (of the homomorphic encryption algorithm) for decrypting the ciphertext number, the user or owner of the decrypted data uses the private key he holds to decrypt the ciphertext number (such as ciphertext operation, the result of ciphertext calculation).

[0072] For the above-mentioned secure computing system, a data object (in a program) used to store a ciphertext number is called a ciphertext number data object; in addition to the ciphertext number, the ciphertext number data object also stores a cryptographic operation context and parameters related to the current ciphertext number encryption and ciphertext operation outside the cryptographic operation context, or stores information for obtaining the cryptographic operation context (such as a data pointer to the cryptographic operation context, an identifier, etc.) and parameters related to the current ciphertext number encryption and ciphertext operation outside the cryptographic operation context; the parameters related to the current ciphertext number encryption and ciphertext operation outside the cryptographic operation context include a public key, an amplification factor, a current ciphertext level, and a current ciphertext operation modulus; if a floating factor is introduced into the encryption of the ciphertext number, the parameters of the floating factor used to generate the ciphertext number belong to the parameters in the cryptographic operation context, or belong to the parameters related to the current ciphertext number encryption and ciphertext operation outside the cryptographic operation context (depending on the specific implementation, such as whether they are required common parameters); the current ciphertext number refers to the ciphertext number stored in the ciphertext number data object;

[0073] The serialized data of the ciphertext data object after serialization contains a cryptographic operation context or cryptographic operation context generation parameter corresponding to the ciphertext (i.e., stored or pointed to in the data object); when reconstructing the ciphertext data object through deserialization, (the program for deserializing and reconstructing the ciphertext data object) restores or reconstructs the cryptographic operation context of the ciphertext data object (i.e., corresponding to the ciphertext) or obtains information about the cryptographic operation context (such as a data pointer pointing to the cryptographic operation context, an identifier, etc.);

[0074] When performing cryptographic operations (including data encryption operations, data decryption operations, and homomorphic ciphertext operations), the program or system component performing the cryptographic operation (for example, common cryptographic components or components, core cryptographic components and components) directly or indirectly obtains the cryptographic operation context required for the cryptographic operation and parameters related to the current ciphertext encryption and ciphertext operation outside the cryptographic operation context through the ciphertext data object;

[0075] The cryptographic operation context generation parameters refer to parameters used to generate or construct (or initialize) a cryptographic operation context (also referred to as cryptographic operation context construction parameters).

[0076] In computer programming technology, converting the data stored in a data object into a byte string for storage, transmission and reconstruction is called serialization of the data object, and the data obtained in this way is called serialized data of the data object; recovering and reconstructing the original data object from the serialized data is called deserialization; the serialization and deserialization of data objects in the present invention are consistent with the concepts of conventional serialization and deserialization technologies.

[0077] Based on the ciphertext data object of the present invention, the corresponding function or method can be called to process the ciphertext number just like calling a function or method to perform calculation processing on the plaintext number. The ciphertext parameter (i.e., the ciphertext data object containing the ciphertext data to be calculated and the processing result) can be passed to the calling function or method just like passing the plaintext parameter to the calling function or method. This makes the writing of the program more in line with the usual habits of programmers. The program (function, method) that performs calculation, computation and processing on the encrypted data can obtain the cryptographic operation context (including the homomorphic encryption algorithm adopted, various encryption parameters, etc.) required for the cryptographic operation and the cryptographic operation parameters outside the cryptographic operation context related to the current ciphertext number only based on the ciphertext data object itself. The system components or members that store the secret key (private key) for decrypting the ciphertext number, such as the core cryptographic component or member, can determine the secret key (private key) for decrypting the ciphertext number using only the information in the ciphertext number data object, and then decrypt the ciphertext number in the data object; the program that reads or receives the serialized ciphertext number data object can not only recover the ciphertext number stored in the data object, but also recover or reconstruct the same cryptographic operation context used for cryptographic operation and the parameters related to the current ciphertext number encryption and ciphertext operation outside the cryptographic operation context, for subsequent cryptographic operations and calculations.

[0078] For the above-mentioned ciphertext data object, we can further do the following:

[0079] The ciphertext data object includes an integer type ciphertext data object and a floating point type ciphertext data object, respectively referred to as an integer ciphertext data object and a floating point ciphertext data object;

[0080] For an integer type ciphertext data object, after decrypting the ciphertext, the core cryptographic component or member converts the absolute value of the non-integer plaintext obtained by decryption to the nearest integer (rounded to the nearest integer) and into an integer, with the sign unchanged, thereby obtaining an integer plaintext number, and then returns the integer type plaintext number, or uses the integer plaintext number for operation, calculation or processing (if the decrypted plaintext number itself is an integer plaintext number, of course, no further conversion is required); if the ciphertext number stored in the integer type ciphertext data object is a vector ciphertext number, then after decrypting the ciphertext number, the absolute value of each non-integer element in the decrypted plaintext vector is rounded to the nearest integer (rounded to the nearest integer) and converted to an integer, with the sign unchanged, to obtain an integer plaintext vector;

[0081] For a ciphertext data object of a floating number type, the core cryptographic component or member returns a plaintext number of a floating point type after decrypting the ciphertext number, or uses the floating point plaintext number for operation, calculation or processing.

[0082] No matter it is an integer type ciphertext data object or a floating point type ciphertext data object, the encryption processing of plaintext numbers is the same as the usual encryption processing for integers and floating point numbers, and there is no difference (usually the encryption processing for integers and floating point numbers is the same or similar, for example, they are first multiplied by the magnification factor, rounded, and then the rounded result is encrypted), and the ciphertext operation on the ciphertext number is also the same as the usual ciphertext operation processing on the ciphertext number, and there is no difference. The only difference is that after decrypting the ciphertext number, the processing of the decrypted plaintext number may be different (for integer type, the decrypted plaintext number needs to be rounded).

[0083] For the above-mentioned ciphertext data object, we can further do the following:

[0084] The ciphertext data object also includes a complex type ciphertext data object, referred to as a complex ciphertext data object (the present invention does not assume that the homomorphic encryption algorithm itself supports direct encryption of complex numbers and homomorphic ciphertext operations on complex ciphertext numbers. Some homomorphic encryption algorithms, such as CKKS, support complex encryption and operations);

[0085] If the homomorphic encryption algorithm does not support complex encryption and complex ciphertext operations, the complex ciphertext number data object simultaneously stores the real ciphertext and imaginary ciphertext of the complex ciphertext number. When the ordinary cryptographic component or member, or the core cryptographic component or member, performs ciphertext operations or ciphertext calculations on the complex type of ciphertext data object, the real ciphertext number and the imaginary ciphertext number are taken out from the complex ciphertext data object, and the real or imaginary ciphertext number is used to perform ciphertext operations or ciphertext calculations according to the complex operation or calculation rules to obtain the corresponding ciphertext operation or calculation results (if the homomorphic encryption algorithm itself supports complex encryption and ciphertext operations, this is not necessary).

[0086] The approach of the present invention is a data object-centric approach, and the implementation of the cryptographic algorithm is merely a tool for realizing data operations and computational processing. Programmers write operations and computational programs for ciphertext data in the same way as they usually write operations and computational programs for plaintext data. However, existing confidential computing technologies are usually cryptographic algorithm-centric, and are centered on realizing the processing of data by cryptographic algorithms. Data objects are merely computational processing objects targeted by cryptographic programs. Programmers cannot write programs in the same way as they usually write computational and processing programs for plaintext data, and they must be familiar with the cryptographic operations and computational processes.

[0087] For the above-mentioned secure computing system, in order to reduce the difficulty for ordinary programmers to write computing programs using homomorphically encrypted ciphertext numbers, the secure computing system provides auxiliary computing programs and / or auxiliary compilation tools, wherein:

[0088] The auxiliary computing program receives (one or more) ciphertext data objects and description information of the calculation formula and / or the calculation process, parses the description information of the calculation formula and / or the calculation process, uses the ciphertext data objects and calls ordinary cryptographic components or members to complete corresponding calculations according to the calculation formula and / or the calculation process description information (the programmer does not need to care about how to call ordinary cryptographic components or members and core cryptographic components or members);

[0089] The auxiliary compilation tool converts the program code that uses operators (such as +, -, *, / , etc.) to perform operations on ciphertext data objects in the source program code into program code that uses ciphertext data objects to call operation functions or methods corresponding to the operators provided by common cryptographic components or members (such as functions or methods for addition, subtraction, multiplication, and division operations corresponding to the +, -, *, / operators) based on the programmer's comments in the source program code or based on the data types of the data objects that appear in the calculation formulas in the source program (for example, data objects belonging to the ciphertext data class or data objects of its subclasses), and converts the program code that uses common calculation functions (such as natural exponential functions, natural logarithmic functions, trigonometric functions, square root functions, etc.) provided by the programming language to perform calculations on ciphertext data objects in the source program code into program code that uses ciphertext data objects to call corresponding conventional calculation functions provided by common cryptographic components or members (such as natural exponential functions, natural logarithmic functions, trigonometric functions, square root functions, etc. for ciphertext numbers provided by common cryptographic components or members) to perform corresponding calculations, or, for a program that does not support operator overloading but provides For programming languages ​​with reflection mechanisms or functions (such as reflection mechanisms or tools of Java, Golang, and C#), auxiliary compilation tools convert program codes that use operators to perform operations on data objects in the source program code into program codes that call operation functions or methods corresponding to the operators provided by common cryptographic components or members for operations according to the programmer's comments in the source program code, and convert program codes that call common calculation functions provided by programming languages ​​to perform calculations on data objects in the source program code into program codes that call corresponding conventional calculation functions provided by common cryptographic components or members for corresponding calculations on data objects, operation functions or methods corresponding to the operators provided by common cryptographic components or members, and conventional calculation functions provided by common cryptographic components or members. During the execution process, the type (what type of data, such as integer, floating point, double precision floating point or other type of data object) and kind (whether it is a ciphertext data object) of the data objects involved in the operation or calculation are determined through reflection, and then corresponding operation or calculation processing is performed according to the type and kind of the data object.

[0090] For programming languages ​​(such as C++) that support operator overloading (such as +, -, *, / , etc.), the confidential computing system provides operator overloading for ciphertext number data objects, and ordinary programmers write calculation programs for ciphertext number data objects in the same way as they write calculation programs for plaintext numbers (such as integers, floating-point numbers); the ordinary programmers refer to those who use ordinary cryptographic components or modules to write programs.

[0091] From the above scheme description, it can be seen that based on the scheme of the present invention, in the process of operation and calculation of ciphertext numbers, the core cryptographic components or components can organize the ciphertext numbers, avoiding the limitations brought by the ciphertext number operation level, and solving the problem that ciphertext numbers encrypted by different homomorphic encryption algorithms, encryption parameters, and keys cannot interoperate; the core cryptographic components or components complete complex calculations, including the calculation of complex functions, which not only solves the problem of performing various complex calculations, but also can ensure the calculation accuracy and efficiency; on the basis of the amplification factor, a floating factor is further introduced to ensure that the numbers encrypted and involved in the operation have sufficient effective digits, so that the calculation results are more accurate and have sufficient effective digits, and for the precision that is only applicable to integers, the ... encrypted numbers involved in the operation have sufficient effective digits, and the calculation results are more accurate and have sufficient effective digits, and for the precision that is only applicable to integers, the floating factor is further introduced to ensure that the encrypted numbers involved in the operation have sufficient effective digits, and the calculation results are more accurate and have sufficient effective digits, and for the precision that is only applicable to integers, the floating factor is further introduced to ensure that the encrypted numbers involved in the operation have sufficient effective digits, and the calculation results are more accurate and have sufficient effective digits, and for the precision that is only applicable to integers, the floating factor is further introduced to For a homomorphic encryption algorithm, the amplification factor γ can be fixed to 1, the number of valid digits can be limited to integers, and the real number encryption and ciphertext operations can be easily implemented on the basis of this type of algorithm through the adjustment of the floating point factor combined with the floating factor (this type of algorithm is difficult to implement mixed operations of ciphertext addition and multiplication using only the amplification factor γ because it is an exact algorithm); the core cryptographic component or component will only return the ciphertext number encrypted by the homomorphic encryption algorithm, and will not directly return the plaintext number. Only when sufficient authorization is obtained, the core cryptographic component or component will return the plaintext number decrypted from the ciphertext number, and the returned plaintext number is encrypted with the key of the user or owner of the decrypted data, ensuring that only authorized users, institutions, and systems can obtain the final plaintext number; in a specific In the implementation, the core cryptographic component or component is a secure and trusted component or component (such as a cryptographic card, a cryptographic server or a cryptographic machine), which provides a secure and trusted cryptographic operation environment, and provides protection that meets security requirements for sensitive data and decryption keys (private keys) in the operation and calculation process; the user of the ciphertext number, the user of the core cryptographic component or component, and the owner, manager, and controller of the core cryptographic component or component can belong to different organizations, and the owner and user of sensitive and confidential data, the user of the ciphertext number, and the user of the core cryptographic component or component can belong to different organizations, so that the organization that uses the ciphertext number for data processing and operation, that is, the user of the ciphertext number (such as a public computing service platform), does not have There are core cryptographic components or members, and they cannot be controlled technically. Only after obtaining sufficient authorization, the core cryptographic components or members will return the decrypted plaintext numbers to the users or owners of the decrypted data in the form of ciphertext data that can be decrypted by the users or owners of the decrypted data (they will then decrypt the final plaintext numbers themselves), thereby avoiding the situation where the institutions that use ciphertext numbers for data processing and calculation (such as public computing service platforms) act as both athletes (using ciphertext numbers for calculation and calculation) and referees (having the ability to decrypt ciphertext numbers), thereby effectively preventing the risk of institutions that use ciphertext numbers for data processing and calculation obtaining users' sensitive data by cheating to decrypt ciphertext numbers;Based on the ciphertext data object of the present invention, programmers can call the function or method that processes the ciphertext number in the usual way of calling the function or method and submitting the calling parameters to calculate and process the data, without directly calling the function or method involving the cryptographic function, and without submitting the parameters involving the cryptographic function (such as the cryptographic operation context) to the calling function or method. Based on the auxiliary calculation program of the present invention, programmers do not need to write program codes that use ciphertext numbers for calculation. Based on the auxiliary compilation tool of the present invention, programmers can write calculation programs in the usual way of using operators and common functions to write calculation programs for plaintext numbers, without considering the difference between writing ciphertext calculation programs and writing plaintext calculation programs. All of these reduce the difficulty for ordinary programmers to write calculation programs using homomorphic encryption algorithms and technologies. ; BRIEF DESCRIPTION OF THE DRAWINGS

[0092] Figure 1 Schematic diagram of the system of the present invention.

[0093] Figure 2 The figure is a schematic diagram of the application of the system of the present invention in enterprise applications.

[0094] Figure 3 The figure is a schematic diagram of the application of the system of the present invention in the SaaS platform.

[0095] Figure 4 The diagram is a schematic diagram of the application of the system of the present invention in a data processing / model calculation platform and data decryption.

[0096] Figure 5 The diagram is an application of the system of the present invention in a data processing / model calculation platform and another data decryption schematic diagram. DETAILED DESCRIPTION

[0097] The following is a description of the specific implementation of the present invention. The following content is only a description of possible implementations of the present invention and is not intended to limit the scope of protection of the present invention.

[0098] The specific implementation of the present invention involves a homomorphic encryption algorithm, and the present invention does not particularly limit the homomorphic encryption algorithm used in the implementation. If the specific application targeted by the implementation only involves addition (subtraction) operations, only the additive homomorphic encryption algorithm can be used. If the specific application targeted by the implementation only involves multiplication operations, only the multiplication homomorphic encryption algorithm can be used. Of course, these two situations can also use a fully homomorphic encryption algorithm. If the specific application targeted by the implementation involves both addition (subtraction) and multiplication operations, a fully homomorphic encryption algorithm is used, where the homomorphic encryption algorithm can be either an approximate homomorphic encryption algorithm or a non-approximate homomorphic encryption algorithm (i.e., an exact homomorphic encryption algorithm).

[0099] In specific implementation applications, for different data processing objects, the homomorphic encryption algorithm used in the encryption calculation process, the polynomial modulus in the polynomial ring (such as X N +1), cryptographic operation modulus (such as q in CKKS L ,q l ), public key, amplification factor (such as Δ in CKKS), etc. may be different, that is, the cryptographic operation context and other related encryption parameters may be different. When ciphertext numbers with different cryptographic operation contexts and other related encryption parameters need to be operated, the core cryptographic components or components need to sort the ciphertext numbers involved in the operation so that their cryptographic operation contexts and other related encryption parameters remain consistent.

[0100] Introducing a floating factor is a method of the present invention to ensure that the encrypted ciphertext number and the ciphertext operation result have sufficient effective digits. The implementation of the floating factor is described below with an example.

[0101] Consider the following binary integer (integer represented by floating point):

[0102] 1.001100011010101100001000000011110010100001 2 85 (· represents multiplication),

[0103] Suppose that before a number is homomorphically encrypted, it is multiplied by a large amplification factor γ, for example, γ = 2 40 If we directly perform homomorphic encryption on this number and multiply it by the amplification factor γ, the number involved in the cryptographic operation will be very large, consuming a lot of storage resources and computing resources, and the computing efficiency will be low. If we introduce a floating factor, if the floating factor of this number is β = 2 50 , the number of significant digits of this number is:

[0104] 1.001100011010101100001000000011110010100001 2 35 ,

[0105] After the significant digits are multiplied by the magnification factor γ, there are still enough significant digits (the number of significant digits), and the encrypted result still has enough significant digits and calculation accuracy. However, the significant digits and the number obtained after multiplying the magnification factor γ are much smaller than the number obtained by directly multiplying the number to be encrypted by the magnification factor. At this time, encryption and cryptographic operations on the significant digits consume much less storage resources and computing resources, and the computing efficiency is much higher.

[0106] Consider the following binary decimal (a decimal represented by a floating point number):

[0107] 1.001100011010101100001000000011110010100001 2 -65 ,

[0108] According to the usual practice, if you want to keep enough valid digits after encrypting this number, you need to multiply it by a large amplification factor γ. If you use this number directly for homomorphic encryption, the amplification factor γ is very large (the modulus is like q in CKKS). L ,q l It will also be very large), consuming a lot of storage resources and computing resources, and the computing efficiency is low. In addition, considering that other numbers for data encryption and ciphertext operations may be large integers, this large magnification factor γ will make the integers for data encryption and ciphertext operations very large. If a floating factor is introduced, if the floating factor of this number is β = 2 -50 , the number of significant digits of this number is:

[0109] 1.001100011010101100001000000011110010100001 2 -15 ,

[0110] This significant digit is much larger than the original number, and can be multiplied by a smaller magnification factor γ, such as γ = 2 40 , encrypting the significant digits consumes much less storage resources and computing resources, and the computing efficiency is much higher. Using this magnification factor γ, the significant digits will be lost after rounding by multiplying γ. If you want to keep more significant digits after rounding, you can take a smaller floating factor such as β = 2 -60 , or take a larger magnification factor such as γ = 2 60 Of course, the floating factor of this decimal can be β = 2 -100 , the number of valid digits of this number is (integer):

[0111] 1.001100011010101100001000000011110010100001 2 35 ,

[0112] This valid digit is encrypted using a homomorphic encryption algorithm. Alternatively, a smaller amplification factor γ can be used while ensuring sufficient valid digits, calculation accuracy, and calculation efficiency, such as γ = 2. 40 (Compared to the floating factor β = 2 -50 , the same magnification factor γ = 2 40 When data is encrypted, the number of significant digits is multiplied by the amplification factor γ and rounded to have more significant digits, that is, more significant digits).

[0113] For the exact homomorphic encryption algorithm, if the number of valid digits is an integer, according to the corresponding algorithm, the amplification factor γ can even be fixed to 1 (the floating factor and the number of valid digits are processed before being multiplied by the amplification factor).

[0114] For the above two numbers, one large and one small, if we need to calculate their product, if the magnification factor γ is 2 40 , which will result in the final calculation result being 0 (because the result of multiplying a very small number by γ and rounding it to 0 is 0), which is obviously incorrect; if, in order to ensure that there are enough significant digits, a very large magnification factor γ is taken, such as 2 80 , the numbers and moduli involved in the operation (such as polynomial coefficients, q of CKKS L ,q l ) will be very large, which will lead to high resource consumption and low computational efficiency. If a floating factor β is introduced, the floating factor of a very large number is β = 2 50 , the floating factor of a very small number is β = 2 -100 , the amplification factor γ is 2 40 (Or take a slightly larger value, such as 2 50 ), we can obtain the expected calculation results while ensuring sufficient effective digits, calculation accuracy, and calculation efficiency.

[0115] It is not necessary to express the floating factor β as a power of 2. It is just because the numbers in the computer are binary numbers, and using powers of 2 can better correspond to the significant digits, effective digits, and decimal points of binary numbers. Real numbers are represented by binary floating point numbers in computers. The number represented by floating point numbers in computers is f = m × 2 e , where m is the mantissa, e is the exponent (m, e can be positive, negative, or zero), the mantissa corresponds to the binary valid digit (the highest bit of the mantissa of a non-zero number is 1, and the mantissa can be positive, negative, or zero), the exponent corresponds to the power (exponent) of 2, and the floating point number is the product of the mantissa m and the exponent e of 2. In a computer, a floating point number only needs to store m and e. It can be seen that the floating factor of the present invention corresponds to the 2 of the floating point number. e (2 to the power of e), the number of significant digits of the present invention corresponds to the mantissa of the floating point number (of course, the two are not completely equivalent), therefore, in order to facilitate the mantissa and the number of significant digits, 2 e (or exponent e) and a floating factor, the floating factor is usually preferably a power of 2 (a positive or negative integer power of 2 or a power of 0), so that the floating factor can be directly obtained by the exponent e of the floating point number (including its value and sign). The general implementation principles for selecting the floating factor and converting the floating point number into the product of the significant digits and the floating factor given below fully reflect this point.

[0116] The floating factor is β = cq j =2n×j The form of q = 2 n , n is a selected positive integer (constant), j is an integer (non-constant), c = 2 u , u is a constant integer (can be positive, negative or 0), in this case, the ciphertext data object only needs to save the exponent k = u + n × j, and the multiplication of floating factors becomes a simple addition of exponent k (similar to the multiplication of floating point numbers and the addition of exponents). Assume that the floating point number f in the computer is f = m × 2 e The number of significant digits after the decimal point of the mantissa m is L (L is a positive integer), that is, excluding the normalized digits before the decimal point, the number of significant digits after the decimal point of the mantissa m is L, that is, when e=L, f is exactly an integer (that is, when e=L-1, f has 1 decimal place, and when e=L, f is an integer). In the case where the magnification factor γ has been selected, if the floating point number f=m×2 e When the exponent e of is within L+[a,b] (i.e., within [L+a,L+b], the exponent is a signed integer), where a and b are integers and ba≥n, the homomorphic encryption algorithm and the amplification factor γ are used to encrypt the floating-point number and the ciphertext operation can obtain the desired number of effective digits, calculation accuracy, and calculation efficiency. Then: for any floating-point number f=m×2 e , and its order code e is expressed as e = u + L + t + n × j, where t is an integer in (a, b) (unless there are special circumstances, the constant u is taken as 0 as much as possible), then the floating factor β corresponding to f is 2 u+n×j =cq j , where q = 2 n , c = 2 u , the number of effective digits is v = m × 2 L+t , that is, the floating point number corresponding to the number of significant digits, whose exponent is an integer in L+[a,b], and any plaintext floating point number is represented by such a number of significant digits and a floating factor β=cq j =2 u+n×j If a ≥ 0, then for the exact homomorphic encryption algorithm, the amplification factor γ is allowed to be fixed to 1 (of course, this is not necessary).

[0117] The key to the above implementation principle is to first determine a floating point number f = m × 2 e The interval L+[a,b] of the exponent e is L+[a,b], as long as the homomorphic encryption scheme adopted (including the selected algorithm, amplification factor, modulus, etc.) is for the floating point number f=m×2 with exponent e in L+[a,b]. e The encryption and ciphertext number operation can meet the requirements of effective number of digits, calculation accuracy and calculation efficiency. Then, by implementing the floating factor of the present invention, for any floating point number f=m×2 eThe encryption and ciphertext number operations can meet the requirements of effective digits and calculation accuracy. However, for any arbitrary n, the calculation efficiency may not meet the requirements. Generally, the smaller the interval between adjacent floating factors β, that is, the smaller the ratio of the larger to the smaller of the two adjacent floating factors, for example, β = cq j , q = 2 n When q is smaller, that is, the interval n between the exponents of two adjacent floating factors is smaller, that is, the granularity of the floating factors is smaller, the operation on the ciphertext number is closer to the floating point operation (n=1 is equivalent to the floating point operation), and the effect of retaining the effective digits is better, but the number of floating factor adjustments in the calculation process will increase (the frequency will increase), the floating factor adjustment will become frequent, and the calculation efficiency will decrease. On the contrary, the larger the interval between adjacent floating factors, the fewer the number of floating factor adjustments in the calculation process (the frequency will decrease), the calculation efficiency will increase, but the effect of retaining the effective digits may deteriorate. In the specific implementation, how to select the floating factors and intervals should also comprehensively consider the requirements for the effective digits, calculation accuracy and calculation efficiency.

[0118] It should be pointed out here that for β = cq j , q is usually much smaller than γ. q reflects the granularity of the floating factor, not the number of significant digits of the plaintext or ciphertext (significant digits), i.e., q = 2 n The n in the formula does not reflect the number of significant digits in the binary number of the plaintext or ciphertext, but is used to determine the granularity of the floating factor, β = cq j =c×2 n×j The |u+n×j| in the formula does not reflect the number of significant digits of the binary numbers of the plaintext and ciphertext. The number of significant digits retained after the encryption is the significant digit of the ciphertext, and the number of significant digits still retained after the ciphertext operation is the significant digit of the ciphertext operation result. The number of significant digits retained after the encryption is related to the number of significant digits retained after the amplification factor γ is multiplied by the significant digit (after rounding) when the significant digit is encrypted, and is related to the accuracy of the homomorphic encryption algorithm. If the accuracy of the homomorphic encryption algorithm is high enough, then the number of significant digits of the ciphertext and the ciphertext operation result mainly depends on the number of significant digits retained after the amplification factor γ is multiplied by the significant digit when the significant digit is encrypted and rounded. Therefore, when the selected amplification factor γ can ensure sufficient calculation accuracy, the number of significant digits retained after the amplification factor γ is multiplied by the significant digit when the significant digit is encrypted and rounded can be used as (or approximately as) the number of significant digits of the ciphertext and the ciphertext operation result. Note that the calculation accuracy is also related to the amplification factor γ. For real numbers (floating point numbers), the larger the amplification factor γ is, the higher the calculation accuracy of data encryption and ciphertext operations is. That is to say, the effective digits and calculation accuracy are related to the amplification factor γ.

[0119] The key to selecting the floating factor and converting the floating point number into the product of the effective digit and the floating factor mentioned above is to first determine a floating point number f = m × 2 e The order code e is L+[a,b], but it does not give how to select [a,b]. In fact, in order to facilitate the calculation of t and ensure the uniqueness of t, the selection of [a,b] is related to n, such as limiting |a|+|b|≤2n. However, n determines the granularity of the floating factor q=2 n , and the selection of the granularity of the floating factor, that is, the selection of n, is related to the magnification factor γ (γ affects the number of effective digits for encryption, ciphertext operation, calculation accuracy, and calculation efficiency), and is related to the calculation efficiency, that is, the adjustment frequency requirement of the floating factor. How to consider these factors when selecting n? The following are some possible selections of the magnification factor γ and the granularity of the floating factor q = 2 n approach, taking these factors into consideration.

[0120] If all plaintext numbers involved in the operation and calculation have e ≥ L (i.e., although they are expressed as floating point numbers, they are all integers), the granularity of the floating factor q = 2 is determined as follows n , constant c:

[0121] Take n = 1;

[0122] Take an amplification factor γ, and make the selected amplification factor for any f = m × 2 L+t The number has the effective number of digits, calculation accuracy and calculation efficiency that meet the requirements of data encryption and ciphertext operation, where t is an integer in [0, n] (if it is an exact homomorphic encryption algorithm, the amplification factor γ can be fixed to 1, but it is not necessary);

[0123] For any floating point number f=m×2 in the test sample data e , take its effective digits as v = m × 2 L +t , where t = (eL) mod n, e = L + t + n × j, j is an integer, and the floating factor β = 2 n×j =q j , q = 2 n (At this time c = 1);

[0124] For a certain number of test sample data, simulate the actual calculation process (such as simulating model training) and test the adjustment frequency of the floating factor when n takes the current value. The adjustment frequency of the floating factor refers to the ratio of the number of adjustments of the floating factor during the ciphertext operation to the total number of ciphertext operations. The ciphertext operation includes ciphertext number addition (subtraction) operation and ciphertext number multiplication operation (in fact, only addition operation may cause floating factor adjustment);

[0125] If the adjustment frequency of the floating factor meets the requirement (for example, not exceeding 20%) when n takes the current value, then select this n, and the granularity of the floating factor is q = 2 n , c = 1; otherwise, increment n by 1 and repeat the above until the adjustment frequency of the floating factor meets the requirement;

[0126] If a password operation overflow occurs (exceeding the range allowed for data encryption and ciphertext number operations) when n takes a certain value, then adjust the encryption parameters (such as the modulus, etc.), or if the adjustment frequency of the floating factor meets the requirement, but the password operation precision at this time cannot meet the requirement, then adjust the encryption parameters, such as increasing the amplification factor γ (for example, multiplying the original amplification factor γ by 2 as the new amplification factor), and then start from n = 1 and recalculate and statistically analyze the test sample data until the adjustment frequency of the floating factor meets the requirement, no password operation overflow occurs, and the password operation precision meets the requirement.

[0127] Alternatively, if there is a case where there is a number e < L among the plaintext numbers participating in the operation and calculation (i.e., there is a case with a decimal), then determine the granularity q = 2 of the floating factor in the following way n , constant c:

[0128] Take n = 1;

[0129] Take an amplification factor such that the selected amplification factor has the required number of significant digits, calculation precision, and calculation efficiency for data encryption and ciphertext operations for any number f = m×2 L+t , where t is an integer within [0, 2n] (if it is an exact homomorphic encryption algorithm, the amplification factor γ can be fixed at 1, but it is not necessary);

[0130] For any floating-point number f = m×2 in the test sample data e , take its number of significant digits as v = m×2 L +n+t , where t is an integer within (-n, n), the absolute value of t is |(e - L - n)| mod n, the sign of t is the same as the sign of e - L - n, e = L + n + t + n×j, j is an integer, and the floating factor is β = 2 n×j = q j , q = 2 n (at this time c = 1);

[0131] For a certain number of test sample data, simulate the actual calculation process (such as model training) and test the adjustment frequency of the floating factor when n takes the current value;

[0132] If the adjustment frequency of the floating factor meets the requirement (for example, not exceeding 20%) when n takes the current value, then select this n, and the granularity of the floating factor is q = 2 n, c = 1; otherwise, increment n by 1 and repeat the above until the adjustment frequency of the floating factor meets the requirements;

[0133] If a cryptographic operation overflow occurs when n takes a certain value (exceeding the range allowed for data encryption and ciphertext number operations), then adjust the encryption parameters (such as the modulus), or if the adjustment frequency of the floating factor meets the requirements, but the cryptographic operation precision at this time cannot meet the requirements, then adjust the encryption parameters, such as increasing the amplification factor γ (for example, multiplying the original amplification factor γ by 2 as the new amplification factor), and then start from n = 1 and recalculate and statistically analyze the sample data until the adjustment frequency of the floating factor meets the requirements, no cryptographic operation overflow occurs, and the cryptographic operation precision meets the requirements.

[0134] Or, if there is a case where e < L among the plaintext numbers participating in the operation and calculation (i.e., there is a case with a decimal), then determine the granularity q of the floating factor as q = 2 in the following way n , constant c:

[0135] Take n = 1;

[0136] Take an amplification factor γ ≥ 2 n , and ensure that the selected amplification factor has the required number of significant digits, calculation precision, and calculation efficiency for data encryption and ciphertext operations for any number f = m × 2 L+t , where t is an integer in the interval [-n, n];

[0137] For any floating-point number f = m × 2 in the test sample data e , take its number of significant digits as v = m × 2 L +t , where t is an integer in (-n, n), the absolute value of t is |(e - L)| mod n, the sign of t is the same as the sign of e - L, e = L + t + n × j, j is an integer, and the floating factor is β = 2 n×j = q j , q = 2 n (at this time c = 1);

[0138] For a certain number of test sample data, simulate the actual calculation process (such as model training) and test the adjustment frequency of the floating factor when n takes the current value;

[0139] If the adjustment frequency of the floating factor meets the requirements (such as not exceeding 20%) when n takes the current value, then select this n, and the granularity of the floating factor is q = 2 n , c = 1; otherwise, increment n by 1 and repeat the above until the adjustment frequency of the floating factor meets the requirements;

[0140] If a cryptographic operation overflow occurs when n takes a certain value (exceeding the range allowed for data encryption and ciphertext number operations), the encryption parameters (such as the modulus) are adjusted. Or, although the adjustment frequency of the floating factor meets the requirements, the cryptographic operation accuracy at this time cannot meet the requirements, the encryption parameters are adjusted, such as increasing the amplification factor γ (for example, multiplying the original amplification factor γ by 2 as the new amplification factor), and then starting from n=1, recalculate and count the sample data until the adjustment frequency of the floating factor meets the requirements, no cryptographic operation overflow occurs, and the cryptographic operation accuracy meets the requirements.

[0141] The certain number of test sample data here comes from: (1) sample data randomly selected from actual data; (2) the actual data values ​​satisfy a certain random distribution model, and the random distribution model satisfied by the actual data values ​​is used to generate randomly generated sample data; (3) the (estimated) maximum and minimum values ​​of the actual data are known, and it is assumed that the actual data is uniformly distributed between the maximum and minimum values, and data is randomly selected from the maximum and minimum values ​​according to the uniform distribution.

[0142] The following method for selecting the amplification factor and floating factor granularity does not require testing using sample data.

[0143] If the floating point numbers of most of the plaintext numbers involved in the operation and calculation (e.g. more than 80%) have exponents within [L, L+n], then:

[0144] Take an amplification factor γ, and make the selected amplification factor for any f = m × 2 L+t (i.e. the exponent e is fixed to L) has the required data encryption and ciphertext operation accuracy, where t is an integer in [0, n] (if it is an exact homomorphic encryption algorithm, the amplification factor γ can be fixed to 1, but it is not necessary);

[0145] The granularity of the floating factor is q = 2 n ;

[0146] For any floating point number f = m × 2 e , take its effective digits as v = m × 2 L+t , where t = (eL) mod n, e = L + t + n × j, j is an integer, and the floating factor β = 2 n×j =q j , q = 2 n (At this time c=1).

[0147] Alternatively, if the exponent of the floating-point numbers of the vast majority of the actual data (e.g., more than 80%) in the plaintext numbers involved in the operation and calculation is within [L, L+2n], then:

[0148] Take an amplification factor γ, and make the selected amplification factor for any f = m × 2L+t The number has the number of effective digits, calculation accuracy and calculation efficiency that meet the requirements of data encryption and ciphertext operation, where t is an integer in [0,2n];

[0149] Take the floating factor granularity q = 2 n :

[0150] For any floating point number f = m × 2 e , take its effective digits as v = m × 2 L+n+t , where t is an integer in the interval (-n, n), the absolute value of t is |(eLn)|mod n, the sign of t is the same as that of eLn, e=L+n+t+n×j, j is an integer, and the floating factor β=2 n×j =q j , q = 2 n (At this time c=1) (The floating factor of most numbers is 1).

[0151] If the exponent of the floating-point numbers of most of the actual data (e.g., more than 80%) in the plaintext numbers involved in the operation and calculation is within [Ln, L+n] (i.e., within L+[-n, n]), then:

[0152] Take an amplification factor γ ≥ 2 n , and the selected magnification factor is such that for any f = m × 2 L+t The number has the number of effective digits, calculation accuracy and calculation efficiency that meet the requirements of data encryption and ciphertext operation, where t is an integer in [-n, n];

[0153] Take the granularity of the floating factor as q=2 n :

[0154] For any floating point number f = m × 2 e , take its effective digits as v = m × 2 L+t , where t is an integer in the interval (-n, n), the absolute value of t is |(eL)| mod n, the sign of t is the same as the sign of eL, e = L + t + n × j, j is an integer, and the floating factor β = 2 n×j =q j , q = 2 n (At this time c=1) (The floating factor of most numbers is 1).

[0155] Or, if the floating point number corresponding to the actual sample data is f = m × 2 e If most (e.g., more than 80%) of the values ​​of the exponent e are in the range [a, b], where a and b are integers, the amplification factor and the floating factor (the granularity of) can be selected as follows (the [a, b] here is different from the [a, b] in the general principle above):

[0156] Take the amplification factor γ≥2 n , where n = [(ba) / 2], where [] is rounded up (e.g. 1.5 is rounded to 2, -1.5 is rounded to -1), and the selected magnification factor is for any f = m × 2 L+t The number has the number of effective digits, calculation accuracy and calculation efficiency that meet the requirements of data encryption and ciphertext operation, where t is an integer in [-n, n];

[0157] For any floating point number f = m × 2 e , take its effective digits as v = m × 2 L+t , where t is an integer in the interval (-n, n), the absolute value of t is |e-[(a+b) / 2]|mod n, the sign of t is the same as e-[(a+b) / 2], e=[(a+b) / 2]+t+n×j, j is an integer, and the floating factor is β=2 -L+[(a+b) / 2]+n×j =cq j , the granularity of the floating factor is q = 2 n , constant c = 2 -L+[(a+b) / 2] (The floating factors of most numbers are the same, that is, j=0 in most cases).

[0158] Or, if the floating point number corresponding to the actual sample data is f = m × 2 e If most (e.g., more than 80%) of the values ​​of the exponent e are in the range [a, b], where a and b are integers, the amplification factor and the floating factor (the granularity of) can be selected as follows:

[0159] Take the magnification factor γ so that the selected magnification factor is L+t The number has the number of effective digits, calculation accuracy and calculation efficiency that meet the requirements of data encryption and ciphertext operation, where t is an integer in [0,2n], n = [(ba) / 2], [] is rounded up (for example, 0.5 is 1, 1.5 is 2, and -1.5 is -1) (If it is an exact homomorphic encryption algorithm, the amplification factor γ can be fixed to 1, but it is not necessary);

[0160] For any floating point number f = m × 2 e , take its effective digits as v = m × 2 L+n+t , where t is an integer in the interval (-n, n), the absolute value of t is |en-[(a+b) / 2]|mod n, the sign of t is the same as en-[(a+b) / 2], e=[(a+b) / 2]+n+t+n×j, j is an integer, and the floating factor is β=2 -L+[(a+b) / 2]+n×j =cq j , the granularity of the floating factor is q = 2 n , constant c = 2 -L+[(a+b) / 2](The floating factors of most numbers are the same, i.e., j=0 in most cases);

[0161] Alternatively, take the magnification factor γ, and make the selected magnification factor for any f = m × 2 L+t The number has the number of effective digits, calculation accuracy and calculation efficiency that meet the requirements of data encryption and ciphertext operation, where t is an integer in [-n,n], n=ba;

[0162] For any floating point number f = m × 2 e , take its effective digits as v = m × 2 L+t , where t is an integer in the interval (-n, n), the absolute value of t is |ea| mod n, the sign of t is the same as the sign of ea, e = a + t + n × j, j is an integer, and the floating factor is β = 2 -L+a+n×j =cq j , the granularity of the floating factor is q = 2 n , constant c = 2 -L+a (The floating factors of most numbers are the same, i.e., j=0 in most cases);

[0163] The above scheme takes [0,n], the interval of the effective digit t is [0,n) integer, and t=(ea)mod n is also acceptable;

[0164] Alternatively, select an integer j0 that satisfies the following conditions: [L+n×j0, L+n×(j0+2)] covers (includes) [a,b], where n=ba (i.e., [L+n×j0, L+n×(j0+2)] includes the exponents of most numbers);

[0165] Take the amplification factor γ≥2 n , and the selected magnification factor is such that for any f = m × 2 L+t The number has the number of effective digits, calculation accuracy and calculation efficiency that meet the requirements of data encryption and ciphertext operation, where t is an integer in the interval [-n,n];

[0166] For any floating point number f = m × 2 e , take its effective digits as v = m × 2 L+t , where t is an integer in the interval (-n, n), the absolute value of t is |eL|mod n, the sign of t is the same as the sign of eL, e=L+t+n×j, j is an integer, and the floating factor is β=2 n×j =q j , the granularity of the floating factor is q = 2 n , constant c = 1 (the floating factors of most numbers are the same, that is, in most cases j = j0 + 1);

[0167] Alternatively, select an integer j0 that satisfies the following conditions: [L+n×j0, L+n×(j0+2)] covers (includes) [a,b], where n=ba (i.e., [L+n×j0, L+n×(j0+2)] includes the exponents of most numbers);

[0168] Take the magnification factor γ, and make the selected magnification factor for any f = m × 2 L+t The number has the effective number of digits, calculation accuracy and calculation efficiency that meet the requirements of data encryption and ciphertext operation, where t is an integer in [0,2n] (if it is an exact homomorphic encryption algorithm, the amplification factor γ can be fixed to 1, but it is not necessary);

[0169] For any floating point number f = m × 2 e , take its effective digits as v = m × 2 L+n+t , where t is an integer in the interval (-n, n), the absolute value of t is |eLn|mod n, the sign of t is the same as the sign of eLn, e=L+n+t+n×j, j is an integer, and the floating factor is β=2 n×j =q j , the granularity of the floating factor is q = 2 n , c=1 (the floating factors of most numbers are the same, that is, j=j0 in most cases).

[0170] A simple method to select an integer j0 that satisfies: [L+n×j0, L+n×(j0+2)] covers (includes) [a,b], where n=ab, is: j0=(aL) / n rounded down (such as 1.5 is taken as 1, -1.5 is taken as -2).

[0171] If the sample data in the actual calculation comes from two categories (or multiple categories) of data, and these two categories (or multiple categories) of data are mainly used for multiplication operations, then these two categories (or multiple categories) of data can independently select floating factors and the granularity of floating factors (or even independently select amplification factors, depending on whether the specific algorithm allows it).

[0172] The above only describes the selection of floating factors for a single real plaintext number (floating point number). For a complex plaintext number, the floating factors of the real part and the imaginary part can be respectively selected in the above manner. If the floating factors are inconsistent, one of them is selected as the floating factor of the complex number by agreement, such as a large or small floating factor. The number of significant digits of the real part and the imaginary part under this floating factor constitutes the number of significant digits of the complex number (if the real part and the imaginary part are regarded as two types of data, the granularity q of the floating factors of the real part and the imaginary part, that is, n, and the constant c do not have to be the same. If the same is required, and q and c selected in the above manner are different, they can be made the same by agreement, for example, c is fixed to 1, and q, that is, n, is taken as a large one); for a plaintext vector, the above manner can be used to select the floating factors of the real part and the imaginary part respectively. A floating factor is selected for each plaintext element (elements of a vector are usually of the same type). If the floating factors of all plaintext elements of the plaintext vector are the same, then this floating factor is used as the floating factor of the plaintext vector. If the floating factors of the plaintext elements of the plaintext vector are different, then a floating factor is selected as the floating factor of the plaintext vector according to the agreement. For example, the smallest floating factor, the largest floating factor, or a floating factor of an intermediate size is used as the floating factor of the vector, and then the selected floating factor is used as the floating factor of the plaintext vector. The significant digits of each plaintext element under this floating factor constitute a significant digit vector (selected for testing and then tested). In addition, each element of the plaintext vector may be a complex number.

[0173] It should be pointed out here that the significant digits of a plaintext number are not necessarily integers. The selection of significant digits mentioned above is for the selection of significant digits when a plaintext number is encrypted. After ciphertext operation and ciphertext calculation, the significant digits obtained by decrypting the ciphertext of the significant digits are what they are, and do not necessarily fall within the range of the significant digits selected for the plaintext number encryption, that is, they do not necessarily conform to the selection of the significant digits when the plaintext number is encrypted. For example, when the floating factor is readjusted according to a given floating factor, the significant digits obtained by decrypting the ciphertext of the significant digits, and the number obtained after the floating factor adjustment processing on the decrypted significant digits does not necessarily fall within the range of the significant digits selected for the plaintext number encryption, that is, it does not necessarily conform to the selection of the significant digits when the plaintext number is encrypted, but at this time, the number obtained after decryption and processing and to be re-encrypted is still regarded as or treated as the significant digits.

[0174] In a specific implementation, if the floating point number f in the computer is f=m×2 e The decimal point of the last digit m is L m If there are 100 significant digits, but only L digits are actually needed, then L digits can be taken and the remaining significant digits can be discarded.

[0175] In specific implementations, if the floating factor β is fixed to 1 to meet the calculation requirements for the specific data object to be calculated and processed, then the floating factor β can be fixed to 1 (in theory, as long as the amplification factor γ is large enough and the ciphertext operation levels are sufficient, the requirements of accuracy and effective digits can be met without using a floating factor, that is, the floating factor β is fixed to 1, but the calculation efficiency may be reduced and more resources will be occupied).

[0176] The above-mentioned selection methods of the magnification factor, floating factor, and number of significant digits are not all possible implementation methods. In practical applications, for a set of specific data, the above-mentioned magnification factor, floating factor, and number of significant digits selection methods can be comprehensively applied to select a selection with a better comprehensive calculation effect, or other methods can be used. The above-mentioned parameters n, a, b, etc. are parameters of the floating factor used to generate the ciphertext number.

[0177] In the actual calculation process, for the base ciphertext number in the ciphertext addition operation, that is, the ciphertext number with which the floating factors of other addends are to be aligned, such as the intermediate calculation result in the recursive calculation using the previous calculation result (for example, the recursive calculation of y i+1 =a×y i +b×u i The y in i , where a and b are constants), can be decrypted by the core cryptographic component or member at any time to obtain its plaintext number, and then the number of valid digits that complies with regulations and agreements can be re-determined.

[0178] In the implementation of the present invention, when two ciphertext numbers with different floating factors are added (including addition and subtraction), the larger floating factor can be adjusted to a smaller floating factor (the corresponding number of significant digits increases accordingly), or the smaller floating factor can be adjusted to a larger floating factor (the corresponding number of significant digits decreases accordingly). In addition, when the numbers involved in the operation will not overflow, the former is preferred because it will not lose significant digits, retain more significant digits, and have higher calculation accuracy.

[0179] The principle of adjusting the floating factor is that if it is not necessary to adjust, then do not adjust; if it can be adjusted by ordinary cryptographic components or components, then adjust it by ordinary cryptographic components or components.

[0180] The following is an example to illustrate the implementation of the complex calculations described in the present invention.

[0181] Suppose now we need to calculate e for a single ciphertext number X X, sin(X), cos(X), ln(X), sqrt(X) (square root), if the ciphertext number X is used directly for calculation, the calculation will be complex, inefficient and of poor precision. In this case, the common cryptographic component or component can submit the ciphertext number X to the core cryptographic component or component, which decrypts the ciphertext number X to obtain its corresponding plaintext number x, and calculates e x , sin(x), cos(x), ln(x), sqrt(x), and then encrypt the calculated values ​​using the homomorphic encryption algorithm to obtain e X , sin(X), cos(X), ln(X), sqrt(X) values ​​(which are ciphertext numbers).

[0182] Assume that for a single plaintext number x, there is the following function f(x):

[0183] f(x)=4x 2 , x ≥ 2

[0184] f(x)=8x,x<2

[0185] Now, the ciphertext number X of x is known, and f(X) needs to be calculated. Obviously, it is difficult to complete this calculation without knowing the plaintext value of X (unless the homomorphic encryption algorithm used is also an order-preserving encryption algorithm). In this regard, the ordinary cryptographic component or component submits the ciphertext number X to the core cryptographic component or component, and the core cryptographic component or component decrypts the ciphertext number X to obtain its plaintext number x, and then uses x to calculate the value of f(x) according to the above function rules, and then uses the homomorphic encryption algorithm to encrypt the calculated value, and then returns the encrypted value (i.e. f(X)) to the ordinary cryptographic component or component.

[0186] Assume that for a single plaintext number x, y, there is the following function f(x, y):

[0187] f(x,y)=x-1 / y 2 , x ≥ 1 / y 2

[0188] f(x,y)=x(1 / y 2 -x), x<1 / y 2

[0189] Now we know the ciphertext numbers X and Y of x and y, and we need to calculate f(X,Y). Obviously, it is difficult to complete this calculation without knowing the plaintext values ​​of X and Y. In this regard, the ordinary cryptographic component or component submits the ciphertext numbers X and Y to the core cryptographic component or component, which decrypts X and Y to obtain their plaintext numbers x and y, and then uses x and y to calculate the value of f(x,y) according to the above function rules, and then uses the homomorphic encryption algorithm to encrypt the calculated value, and then returns the encrypted value (i.e. f(X,Y)) to the ordinary cryptographic component or component.

[0190] Assume that the ciphertext number X of a single integer x is known, and the ciphertext number (encrypted value) of the modulo n remainder of the plaintext number x corresponding to X is to be calculated, where n is an arbitrary integer greater than 1, not necessarily a prime number. Based on the present invention, the calculation can be completed in the following manner.

[0191] The common cryptographic component or component submits the ciphertext number X to the core cryptographic component or component, and the core cryptographic component or component decrypts X to obtain its corresponding plaintext number x; if an approximate homomorphic encryption algorithm is used, the absolute value of the decrypted plaintext number is rounded to the nearest integer, and the sign remains unchanged (rounded to the nearest integer) to obtain the integer plaintext x corresponding to the ciphertext number X; then the core cryptographic component or component calculates the modulo-n remainder of x, and then uses the homomorphic encryption algorithm to encrypt the calculated modulo-n remainder of x, and then returns the encrypted value to the common cryptographic component or component.

[0192] Of course, if an approximate homomorphic encryption algorithm is used, the final ciphertext number is also an approximation of the ciphertext of the modulo-n remainder of x. However, as long as there is sufficient computational accuracy, the ciphertext number can be decrypted and the absolute value of the decrypted plaintext number can be rounded to the nearest integer, while keeping the sign unchanged (rounding to the nearest integer). Then, the exact value of the modulo-n remainder of x can be restored.

[0193] Assume again that the ciphertext number X of a single integer x is known, and the encrypted value of the modulo n multiplicative inverse of x is to be calculated, where n is an optional prime number greater than 1. Based on the present invention, the calculation can be completed in the following manner.

[0194] The common cryptographic component or component submits the ciphertext number X to the core cryptographic component or component, and the core cryptographic component or component decrypts the ciphertext number X to obtain its plaintext number x; if an approximate homomorphic encryption algorithm is used, the absolute value of the decrypted plaintext number is rounded off and the sign remains unchanged to obtain the integer plaintext x corresponding to the ciphertext number X; then the core cryptographic component or component calculates the modulo-n multiplicative inverse of x, and then uses the homomorphic encryption algorithm to encrypt the calculated modulo-n multiplicative inverse of x, and then returns the encrypted value to the common cryptographic component or component.

[0195] Similarly, if an approximate homomorphic encryption algorithm is used, the final ciphertext number is also a large approximation of the ciphertext modulo-n multiplicative inverse of x. However, as long as there is sufficient computational accuracy, the ciphertext number is then decrypted, the absolute value of the decrypted plaintext number is rounded off, and the sign remains unchanged, the exact value of the modulo-n multiplicative inverse of x can be restored.

[0196] If X in the above-mentioned complex calculation is a vector ciphertext number and the same complex calculation is required to be performed on each encrypted plaintext element (component) in the vector ciphertext number, then the above-mentioned complex calculation of the ciphertext X for a single plaintext number is also applicable. Accordingly, the core cryptographic component or component decrypts the vector ciphertext number X to obtain its plaintext vector x, and then performs the same complex calculation on each element of the plaintext vector x, and then encrypts the result to obtain the vector ciphertext number of the calculation result.

[0197] Assume that the equation x is known 2 The ciphertext numbers A, B, and C of the coefficients a, b, and c in the equation +bx+c=0 are homomorphically encrypted, and the homomorphically encrypted ciphertext numbers of the two roots of the equation are obtained, where the real part and the imaginary part of each root are represented by ciphertext numbers respectively (i.e., a pair of real ciphertext numbers are used to represent a root that may be a complex number). Obviously, it is very difficult or impossible to obtain the result by direct calculation, but based on the present invention, the calculation can be completed in the following way.

[0198] The common cryptographic component or component submits the ciphertext numbers A, B, and C to the core cryptographic component or component. The core cryptographic component or component decrypts the ciphertext numbers A, B, and C to obtain their plaintext numbers a, b, and c. Then the core cryptographic component or component uses a, b, and c to obtain the equation ax 2 +bx+c=0, and then use the homomorphic encryption algorithm to encrypt the real and imaginary parts of the two roots respectively, and then return the encrypted values ​​to the common cryptographic component or component.

[0199] The following example illustrates the decomposition and transformation processing of ciphertext numbers when ciphertext numbers are sorted.

[0200] Assume that when a common cryptographic component or component adds two ciphertext numbers with different floating factors, in order to adjust the floating factors of the two ciphertext numbers to be consistent, the core cryptographic component or component needs to adjust the floating factor of one of the ciphertext numbers X, but at the same time it is not desired to expose the plaintext number x corresponding to the ciphertext number X to the core cryptographic component or component. For example, if x is highly sensitive, the common cryptographic component or component uses a homomorphic encryption algorithm and homomorphic ciphertext operation to convert the ciphertext number X into Y, where Y = X + X 10 , X 10 =x0 is the number of ciphertexts, x0 is a number randomly selected from common cryptographic components or components (within the allowed range), X 10 has the same floating factor as X (so X 10The corresponding number of significant digits may not necessarily conform to the selection of significant digits when encrypting a plaintext number as described above), that is, Y and X have the same floating factor, and then submit the ciphertext number Y to the core cryptographic component or component, requesting that the floating factor of the ciphertext number Y be adjusted to the specified floating factor; the core cryptographic component or component decrypts Y to obtain the plaintext number y corresponding to Y, and then decomposes the plaintext number y into the product of the specified floating factor and a number as the number of significant digits (this number may not conform to the selection of significant digits when encrypting a plaintext number as described above), and then uses the homomorphic encryption algorithm to encrypt the number as the number of significant digits to obtain the ciphertext number Y1 with the floating factor adjusted, and then returns the ciphertext number Y1 with the floating factor adjusted to the ordinary cryptographic component or component; the ordinary cryptographic component or component uses the homomorphic encryption algorithm and homomorphic ciphertext operation to convert the homomorphically encrypted ciphertext number X0 of x0 into the product of the specified floating factor and a number as the number of significant digits (this number may not necessarily conform to the selection of significant digits when encrypting a plaintext number as described above). 20 Add the ciphertext number Y1 returned by the core cryptographic component or component, where X 20 Having the same floating factor as Y1, that is, having the expected floating factor, the ciphertext number X is obtained after the floating factor is adjusted.

[0201] The ciphertext number X mentioned above can be a single ciphertext number (the ciphertext of a single plaintext number) or a vector ciphertext number. If X is a vector ciphertext number, then x0 is a randomly selected plaintext vector, and Y, Y1, X 10 , X 20 are all vector ciphertext numbers.

[0202] Assume again that when the common cryptographic component or component operates on two ciphertext numbers with different ciphertext levels, it is necessary to reversely adjust the ciphertext level of one ciphertext number. Therefore, the core cryptographic component or component needs to reversely adjust the ciphertext level of one of the ciphertext numbers X, but at the same time it is not desired to expose the plaintext number x corresponding to the ciphertext number X to the core cryptographic component or component. For example, if x is highly sensitive, the common cryptographic component or component uses a homomorphic encryption algorithm and homomorphic ciphertext operation to convert the ciphertext number X into Y, where Y = X + X 10 , X 10 =x0 is the number of ciphertexts, x0 is a number randomly selected from common cryptographic components or components (within the allowed range), X 10 Has the same ciphertext level and floating factor as X (so X 10The corresponding number of significant digits does not necessarily conform to the selection of significant digits for encrypting a plaintext number as described above), that is, Y and X have the same ciphertext level and floating factor, and then submit the ciphertext number Y to the core cryptographic component or component, requesting that the floating factor of the ciphertext number Y be adjusted to the specified ciphertext level; the core cryptographic component or component decrypts Y to obtain the plaintext number y corresponding to Y, and then re-encrypts it using the homomorphic encryption algorithm y to obtain the ciphertext number Y1 with the specified operation level, and then returns the ciphertext number Y1 with the specified ciphertext level to the ordinary cryptographic component or component; the ordinary cryptographic component or component uses the homomorphic encryption algorithm and homomorphic ciphertext operation to convert the homomorphically encrypted ciphertext number X0 of x0 into 20 Add the ciphertext number Y1 returned by the core cryptographic component or component, where X 20 Having the same ciphertext level and floating factor as Y1, that is, having the expected ciphertext level, the ciphertext number X after adjusting the ciphertext level is obtained.

[0203] Similarly, the ciphertext number X mentioned above can be a single ciphertext number (the ciphertext of a single plaintext number) or a vector ciphertext number. If X is a vector ciphertext number, then x0 is a randomly selected plaintext vector, and Y, Y1, X 10 , X 20 are all vector ciphertext numbers.

[0204] The following example illustrates the implementation of calculating f(X) by decomposition transformation, where X is the ciphertext number of a single plaintext number, and its corresponding plaintext number is x.

[0205] Suppose now we want to calculate e X , then the common cryptographic component or component uses the homomorphic encryption algorithm to calculate the ciphertext number Y=X+X0, where X0 is the ciphertext number obtained by encrypting -x0 using the homomorphic encryption algorithm (X0 has the same floating factor as X), and x0 is a number randomly selected by the common cryptographic component or component; the common cryptographic component or component calculates the value of e^x0, where ^ is a power operation (the base is in front of ^ and the exponent is behind it); the common cryptographic component or component submits the ciphertext number Y to the core cryptographic component or component, requesting the calculation of e^x0. Y The core cryptographic component or component decrypts Y to obtain its plaintext number y and calculates e y The value of e is then encrypted using the homomorphic encryption algorithm y The value of is encrypted to obtain e Y The value of (the ciphertext number), and then calculate the e Y The value returned; ordinary password components or components, using e Y The value of and the value of e^x0 are calculated by multiplication using the homomorphic encryption algorithm to obtain e X The value of (the ciphertext number), specifically, a ciphertext number (e Y) with a plaintext number (e^x0), or by multiplying two ciphertext numbers, that is, e Y Multiply the ciphertext number by e^x0.

[0206] Assume that sin(X) is to be calculated, then the common cryptographic component or component uses the homomorphic encryption algorithm to calculate the ciphertext number Y=X+X0, where X0 is the ciphertext number obtained by encrypting -x0 using the homomorphic encryption algorithm (X0 has the same floating factor as X), and x0 is a number randomly selected by the common cryptographic component or component; the common cryptographic component or component calculates the values ​​of sin(x0) and cos(x0); the common cryptographic component or component submits the ciphertext number Y to the core cryptographic component or component, requesting the calculation of the values ​​of sin(Y) and cos(Y); the core cryptographic component or component decrypts Y to obtain its plaintext number y, calculates the values ​​of sin(y) and cos(y), and then uses the homomorphic encryption algorithm to encrypt the calculated values ​​of sin(y) and cos(y), thereby obtaining sin(Y) and cos(y). The value of s(Y) (which is a ciphertext number) is calculated, and then the calculated values ​​of sin(Y) and cos(Y) are returned; the ordinary cryptographic component or member uses the values ​​of sin(Y), cos(Y) and the values ​​of sin(x0), cos(x0) to calculate the value of sin(X) (which is a ciphertext number) by multiplying the ciphertext number sin(Y) with the plaintext number of cos(x0), multiplying the ciphertext number cos(Y) with the plaintext number of sina(x0), and then adding the two multiplication results, or multiplying the ciphertext numbers of sin(Y) and cos(x0) after homomorphic encryption, multiplying the ciphertext numbers of cos(Y) and sin(x0) after homomorphic encryption, and then adding the two multiplication results.

[0207] The calculation of other trigonometric functions is similar through decomposition and transformation.

[0208] Assume that 1 / X is to be calculated, then the common cryptographic component or component uses the homomorphic encryption algorithm to calculate the ciphertext number Y=X·X0 (the product of two ciphertext numbers), where X0 is the ciphertext number obtained by encrypting x0 using the homomorphic encryption algorithm, and x0 is a number randomly selected by the common cryptographic component or component; the common cryptographic component or component submits the ciphertext number Y to the core cryptographic component or component, requesting the calculation of the 1 / Y value; the core cryptographic component or component decrypts Y to obtain its plaintext number y, calculates the value of 1 / y, and then uses the homomorphic encryption algorithm to encrypt the calculated value of 1 / y, thereby obtaining the value of 1 / Y (the ciphertext number), and then returns the calculated value of 1 / Y; the common cryptographic component or component uses the value of 1 / Y and x0, and uses the multiplication operation of the homomorphic encryption algorithm to calculate the value of 1 / X (the ciphertext number), specifically, the ciphertext number of 1 / Y can be multiplied by the plaintext number x0, or the ciphertext number of 1 / Y can be multiplied by the ciphertext number of x0 after homomorphic encryption.

[0209] Assume that we want to calculate sqrt(X), that is, the square root of X. Then the common cryptographic component or component uses the homomorphic encryption algorithm to calculate the ciphertext number Y = X·X0 (the product of two ciphertext numbers), where X0 is the product of the homomorphic encryption algorithm (1 / x0). 2 The number of encrypted ciphertexts ((1 / x0) 2 is a number derived from a randomly selected number x0), x0 is a positive number randomly selected by the common cryptographic component or component; the common cryptographic component or component submits Y to the core cryptographic component or component, requesting to calculate the value of sqrt(Y); the core cryptographic component or component decrypts Y to obtain its plaintext number y, calculates the value of sqrt(y), and then uses a homomorphic encryption algorithm to encrypt the calculated value of sqrt(y), thereby obtaining the value of sqrt(Y) (which is a ciphertext number), and then returns the calculated value of sqrt(Y); the common cryptographic component or component uses the value of sqrt(Y) and x0, and uses the multiplication operation of the homomorphic encryption algorithm to calculate the value of sqrt(X) (which is a ciphertext number). Specifically, the ciphertext number sqrt(Y) can be multiplied by the plaintext number x0, or the ciphertext number sqrt(Y) can be multiplied by the ciphertext number x0 after homomorphic encryption.

[0210] Assume that we want to calculate ln(X), i.e., the natural logarithm of X (assuming that X is a positive number), then the common cryptographic component or component uses the homomorphic encryption algorithm to calculate the ciphertext number Y = X·X0 (the product of two ciphertext numbers), where X0 is the ciphertext number obtained by encrypting 1 / x0 using the homomorphic encryption algorithm, and x0 is a positive number randomly selected by the common cryptographic component or component; the common cryptographic component or component calculates the value of ln(x0); the common cryptographic component or component submits the ciphertext number Y to the core cryptographic component or component, requesting the calculation of the value of ln(Y); the core cryptographic component or component decrypts Y to obtain its value. The plaintext number y is used to calculate the value of ln(y), and then the calculated value of ln(y) is encrypted by a homomorphic encryption algorithm to obtain the value of ln(Y) (which is a ciphertext number), and then the calculated value of ln(Y) is returned; the ordinary cryptographic component or member uses the value of ln(Y) and the value of ln(x0) to calculate the value of ln(X) (which is a ciphertext number) by a homomorphic encryption algorithm and homomorphic ciphertext operation. Specifically, the ciphertext number ln(Y) can be added to the plaintext number of ln(x0), or the ciphertext number ln(Y) can be added to the ciphertext number of ln(x0) after homomorphic encryption.

[0211] If X in the above complex calculation is a vector ciphertext number and the same complex calculation is required to be performed on each encrypted plaintext element (component) in the vector ciphertext number, then the above complex calculation for a single ciphertext number X is also applicable to the vector ciphertext number X. At this time, x0 is a randomly selected plaintext vector. The core cryptographic component or component decrypts the vector ciphertext number Y to obtain the plaintext vector y, and then performs the same complex calculation on each element of the plaintext vector y. The calculation result is then encrypted to obtain the vector ciphertext number of the calculation result, that is, the ciphertext result calculated using Y. Then the ordinary cryptographic component or component uses the plaintext vector x0 to calculate other related plaintext vectors and other related vector ciphertext numbers, and uses the result calculated by Y to obtain the final expected calculation result through homomorphic encryption addition and multiplication operations.

[0212] Assume that X1 / X2 is to be calculated, then the common cryptographic component or component uses the homomorphic encryption algorithm to calculate the ciphertext numbers Y1=X1·X0, Y2=X2·X0 (the product of two ciphertext numbers), where X0 is the ciphertext number obtained by encrypting x0 using the homomorphic encryption algorithm, and x0 is a number randomly selected by the common cryptographic component or component; the common cryptographic component or component submits the ciphertext numbers Y1 and Y2 to the core cryptographic component or component, requesting the calculation of the value of Y1 / Y2; the core cryptographic component or component decrypts Y1 and Y2 to obtain their plaintext numbers y1 and y2, calculates the value of y1 / y2, and then uses the homomorphic encryption algorithm to encrypt the calculated value of y1 / y2, thereby obtaining the value of Y1 / Y2 (the ciphertext number), and then returns the calculated value of Y1 / Y2; the value of Y1 / Y2 is then the value of X1 / X2.

[0213] If the common cryptographic component or component does not want the core cryptographic component or component to know the X1 / X2 plaintext number, it can be calculated as follows:

[0214] Ordinary cryptographic components or components use homomorphic encryption algorithms to calculate the ciphertext number Y1=X1·X 01 , Y2=X2·X 02 (the product of two ciphertext numbers), where X 01 To use homomorphic encryption algorithm to 01 The number of encrypted ciphertexts, X 02 To use homomorphic encryption algorithm to 02 The number of encrypted ciphertexts, x 01 、x 02 is a number randomly selected by the common cryptographic component or component; the common cryptographic component or component submits the ciphertext numbers Y1 and Y2 to the core cryptographic component or component, requesting the calculation of the value of Y1 / Y2; the core cryptographic component or component decrypts Y1 and Y2 to obtain their plaintext numbers y1 and y2, calculates the value of y1 / y2, and then uses the homomorphic encryption algorithm to encrypt the calculated value of y1 / y2 to obtain the value of Y1 / Y2 (the ciphertext number), and then returns the calculated value of Y1 / Y2; the common cryptographic component or component uses the value of Y1 / Y2 and x 02 / x 01 The value of X1 / X2 is calculated through the homomorphic encryption algorithm and homomorphic ciphertext operation.

[0215] In the above X1 / X2 calculation, the ciphertext numbers X1 and X2 can be single ciphertext numbers or vector ciphertext numbers. If X1 and X2 are vector ciphertext numbers, then x0 and x2 are 01 、x 02 is a plaintext vector, and the corresponding plaintext vector and vector ciphertext number division operation is the division operation of the corresponding plaintext elements.

[0216] When a common cryptographic component or component requests a core cryptographic component or component to sort a ciphertext number, or requests a core cryptographic component or component to perform complex calculations on one or more ciphertext numbers, how can it be determined whether the ciphertext number needs to be transformed or converted? This can be done by defining a sensitivity attribute in the ciphertext number data object, and the value of this attribute is used to indicate whether the corresponding ciphertext number is highly sensitive (for example, the value of this attribute is set when the ciphertext number data object is initialized). If the corresponding ciphertext number is determined to be highly sensitive according to the sensitivity attribute of a ciphertext number data object, the common cryptographic component or component first transforms or converts the corresponding ciphertext number before submitting the ciphertext number data object to the core cryptographic component or component.

[0217] Suppose we want to calculate e A , where A is the column vector ciphertext X1,X2,…,Xn The ciphertext matrix is ​​composed of X1, X2, …, X n Submit to the core cryptographic component or component, the core cryptographic component or component decrypts X1, X2, …, X n Get the plaintext matrix a of A and calculate e a , and then use the homomorphic encryption algorithm to encrypt the calculation result to get e A (column vector ciphertext) and returns it to the common cryptographic component or building block.

[0218] Suppose we need to solve the ciphertext of the characteristic root of A, where A is the ciphertext of the column vector X1,X2,…,X n The ciphertext matrix is ​​composed of X1, X2, …, X n Submit to the core cryptographic component or component, the core cryptographic component or component decrypts X1, X2, …, X n Obtain the plaintext matrix a of A, find its characteristic root (which may be a complex number), and then encrypt the characteristic root and return it to the common cryptographic component or member.

[0219] Suppose we need to solve the inverse matrix of A, where A is the column vector ciphertext X1, X2, …, X n The ciphertext matrix is ​​composed of X1, X2, …, X n Submit to the core cryptographic component or component, the core cryptographic component or component decrypts X1, X2, …, X n Obtain the plaintext matrix a of A, find its inverse matrix, and then use the homomorphic encryption algorithm to encrypt the calculation result to obtain the inverse matrix of A (column vector ciphertext), which is returned to the common cryptographic component or component.

[0220] The principle for calling core cryptographic components or components for complex calculations is to use ciphertext numbers directly as much as possible for calculations that can meet the requirements based on ciphertext numbers, and to call core cryptographic components or components for calculations only for complex calculations that cannot meet the requirements or are difficult or impossible to complete based on ciphertext numbers.

[0221] For unconventional calculation rules or functions that appear in complex calculations, they can be implemented in one of the following ways:

[0222] (1) The program code for plaintext number calculation is dynamically loaded and called by the core cryptographic component or component as a trusted code (such as a trusted code with a digital signature); this trusted code is pre-stored locally by the core cryptographic component or component, or submitted by the common cryptographic component or component when submitting a calculation request. Before loading and executing the program code, the core cryptographic component or component first verifies the trustworthiness of the program code (such as by verifying the digital signature of the program code); this trusted program can be a compiled program code such as a C / C++ program, a Java / C# class library, or an interpreted program, such as an interpreted program written in a scripting programming language;

[0223] (2) When a common cryptographic component or member submits a computation request, it also submits a computation rule or a description (expression) of a complex computation. The core cryptographic component or member parses the computation rule or the description (expression) of the function, and then completes the corresponding computation based on the computation rule or the description (expression) of the function. As for the method and form of the unconventional computation rule or the description (expression) of the function, it is entirely defined by the implementer (for example, it can be defined with the aid of a scripting language).

[0224] For common cryptographic components or members, they can be implemented in the form of SDK, API (dynamic library, class library), or in the form of a separate service system (such as a server).

[0225] For core cryptographic components or members, since they involve the secure storage and use of the key (private key) for decryption operations (decryption operations), their security requirements are high and they usually cannot be implemented in a pure software manner. They can be implemented in the form of a cryptographic card containing software and hardware. The key (private key) for decryption operations is stored in the cryptographic card and is strictly protected. All sensitive operations are performed in the cryptographic card. Alternatively, the core cryptographic components or members are implemented in the form of a high-security, independently operated cryptographic server or cryptographic machine (they meet the relevant security requirements for cryptographic devices), the key (private key) for decryption operations is stored in the cryptographic server or cryptographic machine and is strictly protected. All sensitive operations are performed in the cryptographic server or cryptographic machine.

[0226] The various encryption parameters and keys used for data encryption can be permanent, such as the various encryption parameters and keys used to encrypt and calculate data stored in permanent media such as databases in enterprise applications and SaaS platforms. They can also be temporary, such as the various encryption parameters and keys used to encrypt and calculate confidential or private data in a data processing process or model parameter calculation process. Whether permanent or temporary, they must go through the corresponding initialization process to generate and set encryption parameters (cryptographic operation context), generate keys (key pairs), and output encryption parameters and encryption keys (public keys). For the implementation of the present invention, these initialization operations are the responsibility of the core cryptographic components or components.

[0227] Figure 1 This is a schematic diagram of the system of the present invention. The deployment mode of the common and core cryptographic components or members of the present invention is very flexible and can be deployed in various different ways (but the deployment mode is usually related to the application scenario).

[0228] For common cryptographic components or components that do not need to call core cryptographic components or components, they can be deployed anywhere, for example, they can be deployed on (enterprise) clients or user ends, and they can be deployed on data processing and computing servers, such as application servers, computing service platforms, and data processing service platforms. For common cryptographic components or components that need to call core cryptographic components or components, they are usually deployed on data processing and computing servers, such as application servers, computing service platforms, and data processing service platforms.

[0229] If the core cryptographic component or component is a cryptographic card, the core cryptographic component or component can be deployed in the same computer as the ordinary cryptographic components or components that need to be called (such as a server computer for enterprise applications), or deployed in a specialized computer with strict security protection at the location where the computer running the ordinary cryptographic components or components is located, such as a specialized computer with strict security protection in a SaaS cloud computing application platform or a privacy computing service platform, which are called by ordinary cryptographic components or components as cryptographic servers.

[0230] If the core cryptographic component or component is a separate cryptographic server or cryptographic machine, the core cryptographic component or component can be deployed on the application service platform or computing service platform where the computer running the ordinary cryptographic component or component is located, and run in the same place as these platforms and be subject to strict security protection, or the core cryptographic component or component can be deployed on another service platform or another place that is different from the application service platform or computing service platform, such as the cryptographic service platform or the place of a cryptographic service provider that specializes in providing cryptographic services. At this time, the ordinary cryptographic component or component remotely calls the cryptographic function of the core cryptographic component or component through the network (of course, this remote cryptographic function call requires security protection and authorization). This deployment method is also suitable for enterprise applications, SaaS cloud computing application platforms, and privacy computing service platforms.

[0231] The implementation of authorization for returning decrypted plaintext data is related to specific application scenarios, which will affect the implementation of ownership, management, and control rights of core cryptographic components or components. For example, for public applications and public services, the owners and operators of these public applications and public service platforms cannot be the owners, managers, and controllers of core cryptographic components or components, otherwise they may obtain sensitive plaintext data. Regardless of the application scenario and the authorization implementation method adopted, one principle must be ensured: only the authorized users and owners of decrypted data can obtain plaintext data. The following are possible authorization implementation methods for some application scenarios.

[0232] like Figure 2As shown in the figure, consider an application scenario where homomorphic encryption is used for an enterprise application, such as an enterprise financial system. In this case, the core cryptographic components or components can be deployed in the enterprise (in the form of a cryptographic card or cryptographic machine) or in a cryptographic service provider (in the form of a cryptographic server or cryptographic machine). Regardless of the deployment method, the ownership, management, and control rights of the core cryptographic components or components can belong to the enterprise or a dedicated cryptographic service provider. At this time, no matter who owns the ownership, management rights, and control rights of the core cryptographic component or component, the user of the decrypted data authorized within the enterprise (such as financial personnel) can issue authorization data separately (online), such as issuing digitally signed authorization data through a USB Key that stores a signature private key (the signature private key at this time is usually the private key of other algorithms, such as the SM2 algorithm private key and the RSA algorithm private key), requesting the core cryptographic component or component to decrypt the ciphertext number and return the decrypted plaintext number. At this time, the decrypted plaintext number is encrypted by the core cryptographic component or component using the data encryption key (such as the public key) of the user of the decrypted data and is returned to the user of the decrypted data. The user of the decrypted data uses his own data decryption key (such as a private key) to decrypt the returned encrypted plaintext number (usually not the homomorphically encrypted ciphertext number, but it can also be), thereby finally obtaining the plaintext number.

[0233] like Figure 3As shown in the figure, let's consider an application scenario where homomorphic encryption is used for the security protection of customer data in a SaaS platform, such as the security protection of enterprise financial data in a SaaS platform that provides financial services to enterprises. In this case, the core cryptographic components or components can be deployed on the SaaS service platform (in the form of cryptographic cards, cryptographic machines, or cryptographic servers), or on the cryptographic service platform of the cryptographic service provider (in the form of cryptographic servers). Regardless of where the core cryptographic components or components are deployed, the ownership, management rights, and control rights of the core cryptographic components or components do not belong to the SaaS platform operator (the management rights here refer to the power of technical management. If the cryptographic device is located on the SaaS platform, the platform has the responsibility for the security protection and management of the cryptographic device), but belong to a cryptographic service provider (if it belongs to the operator of the SaaS platform, then it is both a referee and an athlete, and there is a risk that it will obtain sensitive data). At this time, the customer of the SaaS platform is the owner of the confidential data, and the authorized personnel of the customer of the SaaS platform (such as financial personnel) are the users of the decrypted data. The authorized personnel of the customer can issue the authorization data (for example, issuing the digitally signed authorization data through a USB Key storing the signature private key) alone, requesting the core cryptographic component or component to decrypt the ciphertext and return the plaintext. At this time, the decrypted plaintext is encrypted by the core cryptographic component or component using the data encryption key (such as the public key) of the user who decrypted the data and then returned to the authorized personnel, and the authorized personnel use their own data decryption key (such as the private key) to decrypt the returned encrypted plaintext (usually not the homomorphically encrypted ciphertext, but it can be), and finally obtain the plaintext.

[0234] Consider another application scenario: homomorphic encryption is used in a cloud computing service platform that provides big data processing and machine learning modeling. In this case, the data used for processing and modeling comes from platform customers (such as banks, insurance companies, product manufacturers, e-commerce companies, etc.). The sensitive data of platform customers is submitted to the platform for data processing and model calculation after homomorphic encryption. In this case, the core cryptographic components or components can be deployed on the cloud computing platform (in the form of cryptographic cards or cryptographic machines, cryptographic servers), or on the cryptographic service platform of a cryptographic service provider (in the form of cryptographic servers). Regardless of where the core cryptographic components or components are deployed, the ownership, management rights, and control rights of the core cryptographic components or components do not belong to the owner or operator of the cloud computing service platform (the management rights here refer to the power of technical management. If the cryptographic equipment is located on the public service platform, the platform has the responsibility for the security protection and management of the cryptographic equipment), but belong to a dedicated cryptographic service provider (if it belongs to the operator of the cloud computing platform, it is both a referee and an athlete, and there is a risk that it will obtain sensitive data). In this case, the platform customer is the owner of the confidential data, the owner and user of the final data processing results and model calculation results. In order to provide platform customers with stricter data security protection and prevent sensitive information from being leaked, the core cryptographic components or components need to obtain simultaneous (online or offline) authorization from the platform customers and the owners or managers of the core cryptographic components or components (i.e., cryptographic service providers) before they output the final processing results and model data in plain text. They will digitally sign the authorization data separately. In practical applications, the authorization method can be further divided into two situations: First, if Figure 4 As shown, the core cryptographic component or component used for real-time online calculation and the core cryptographic component or component that returns the plaintext number based on the decryption of the authorization data are the same or located in the same place. Figure 5 As shown, the core cryptographic components or components used for real-time online computing and the core cryptographic components or components that decrypt and return plaintext numbers based on authorization data are core cryptographic components or components located in different places, wherein the core cryptographic components or components used for real-time online computing are located in a cloud computing service platform that performs big data processing and is based on machine learning modeling, and the core cryptographic components or components that decrypt and return plaintext numbers based on authorization data are located at a cryptographic service provider's location, while the core cryptographic components or components of the cloud computing service platform never decrypt and return plaintext numbers (this can more effectively prevent the leakage of sensitive data).

[0235] Regardless of the application scenario, the user or owner of the decrypted data has a private key for decrypting the ciphertext (that is, the private key of the homomorphic encryption algorithm). The user or owner of the decrypted data can use his or her own private key to decrypt the homomorphic encrypted ciphertext and operations and calculation results. The core cryptographic components or components are only called when needed during data processing and calculation (such as sorting ciphertext numbers and performing complex calculations).

[0236] In the implementation of the present invention, which subjects hold the homomorphic encryption (algorithm) private key for decrypting ciphertext (here, holding refers to physical holding, not logical holding), and what is the homomorphic encryption (algorithm) public key used to encrypt data, which may include the following situations:

[0237] Scenario 1: Except for the homomorphic encryption private key for decrypting data stored in the core cryptographic component or component, and the private key does not leave the core cryptographic component or component, all participating entities do not hold the homomorphic encryption private key. Different participating entities use the same homomorphic encryption public key (public public key) to encrypt data, and then the core cryptographic component or component uses the same private key (public private key) to decrypt the data; this scenario is applicable to the enterprise applications, SaaS applications, public data processing platforms, and public model computing platforms mentioned above; from a computing perspective, the advantage of this is that for public data processing platforms and public model computing platforms, ciphertext data from different participating entities can be directly mixed for ciphertext operations (for a public data processing platform or public model computing platform, the data involved in the calculation and processing may come from different entities. Of course, the cryptographic operation context used for ciphertext data from different sources must also be the same);

[0238] Scenario 2: Similar to Scenario 1, all participants do not hold homomorphic encryption private keys. The difference from Scenario 1 is that different participants use different homomorphic encryption (public-private key pairs) public keys to encrypt data, and then the core cryptographic components or components use different private keys to decrypt the data. This scenario is applicable to the enterprise applications, SaaS applications, public data processing platforms, and public model computing platforms mentioned above. From a computing perspective, for public data processing platforms and public model computing platforms, the problem with this is that ciphertext data from different entities cannot be directly mixed for ciphertext operations. If such operations are required, the core cryptographic components or components need to perform corresponding conversions to data encrypted with one of the two ciphertext numbers, or to convert the two ciphertext numbers into data encrypted with the same other public key (such as the public public key).

[0239] Scenario 3: Different participants, some of whom hold homomorphic encryption (public-private key pair) private keys, and some do not. Different participants use different homomorphic encryption public keys to encrypt data. Participants without private keys must obtain decrypted data by using the corresponding private key of the core cryptographic component or component to decrypt the ciphertext data, while participants with private keys can either decrypt the ciphertext data with their own private keys, or have the core cryptographic component or component use the corresponding private key to decrypt the ciphertext data. This scenario is applicable to the enterprise applications mentioned above (the owners of different enterprise applications may hold private keys), SaaS applications, public data processing platforms, and public model computing platforms. From a computing perspective, for public data processing platforms and public model computing platforms, the problem with this is that ciphertext data from different entities and encrypted with different public keys cannot be directly mixed for ciphertext operations. If such operations are required, the core cryptographic component or component needs to perform corresponding conversions to convert the data into data encrypted with a public key (such as a public public key) for which no entity holds the corresponding private key.

[0240] For situations 2 and 3, the core cryptographic component or component can maintain a list indicating which homomorphic encryption public keys correspond to private keys held by the participating entities, so as to know that the data encrypted by a homomorphic encryption public key cannot be converted into data encrypted by the public key corresponding to the private key held by the entity, but can only be converted into data encrypted by other public keys, such as the public public key.

[0241] For the various SaaS service platforms and public data processing / model computing platforms (various cloud computing) application scenarios mentioned above, the platform system or the platform's operation and maintenance, and operation managers can participate in the authorization of ciphertext decryption operations as the user or owner of the decrypted data, or as one of the users or owners of the decrypted data, but cannot authorize individually.

[0242] The implementation of the common cryptographic components or members of the present invention preferably adopts a data (or data object)-centric implementation method rather than a common cryptographic (algorithm, technology)-centric implementation method. The so-called data (or data object)-centric implementation method means that except for a small number of interfaces (such as the initialization of the cryptographic operation environment, i.e., the cryptographic operation context, and the initialization program for the ciphertext number data object), the parameters submitted and passed through the calling function or method for the operation of the ciphertext number provided by the (common) cryptographic component or member are only the ciphertext number data object, and there are no special parameters related to the cryptographic operation, such as no cryptographic operation context, etc. The parameters related to the cryptographic operation are included in the ciphertext number data object, submitted and passed as part of the data object, and the specific encryption parameters that need to be used in the process of operating the ciphertext number data object are obtained by the (common) cryptographic component or member by parsing the ciphertext number data object, i.e., only from the (common) cryptographic component or member. From the interface of calling functions or methods provided by (common) cryptographic components or components, the function or method interface only provides operations and calculations for ciphertext data objects, and has nothing to do with cryptographic operations, cryptographic calculations, and cryptographic operations. For example, (ordinary) cryptographic components or components do not provide interface functions or methods for adjusting the ciphertext level of ciphertext numbers. Whether the ciphertext level of ciphertext numbers needs to be adjusted is automatically handled by the interface functions or methods (such as addition and multiplication interface functions or methods) that implement ciphertext operations and calculations according to needs or requirements. This makes it unnecessary for programmers who use the interface (function or method) of (ordinary) cryptographic components or components to care about cryptographic operations, how to use encryption parameters, cryptographic knowledge, or cryptographic algorithms.

[0243] The so-called cryptographic (algorithm, technology)-centric implementation method is to submit and pass parameters related to cryptographic calculations and operations (for example, cryptographic operation context, amplification factor) in addition to the (ciphertext number) data object through the interface of calling functions or methods provided by cryptographic components or components. For homomorphic encryption, programmers need to use special interface functions or methods provided by cryptographic components or components to perform special cryptographic operations and processing on ciphertext numbers, such as adjusting the ciphertext level of ciphertext numbers. In this way, programmers who use the cryptographic component or component interface need to be familiar with cryptographic algorithms and cryptographic calculations and have cryptographic knowledge.

[0244] Modules that implement basic cryptographic functions (such as various commonly used libraries such as HElib, SEAL, Palisade, etc.) usually adopt an implementation method with cryptography (algorithms, technologies) as the core. In order to implement an implementation method centered on data (or data objects), ordinary cryptographic components or components can provide a data (data object)-centered calling interface to the application. Within the ordinary cryptographic components or components, the ordinary cryptographic components or components call the cryptography (algorithm, technology)-centered interface of the basic cryptographic function module to call the homomorphic encryption cryptographic function provided by the basic cryptographic function module.

[0245] Where ordinary cryptographic components or members adopt a data (or data object)-centric implementation approach, core cryptographic components or members should also adopt a data (or data object)-centric implementation approach as much as possible. For example, for interface functions or methods that only involve ciphertext number operations and calculations, the parameters passed by calling the interface only involve data objects and do not involve cryptographic parameters. For other cryptographic-related operations, such as encryption parameter adjustment, in addition to passing data objects through the interface, cryptographic-related parameters also need to be passed through the interface (core cryptographic components or members are usually not called directly by applications and are not used by ordinary programmers. They are only used by professional technicians who develop ordinary cryptographic components or members).

[0246] For the implementation of the data object for operation and calculation (in the program) of the present invention, which stores ciphertext numbers, the type definition (such as class definition, structure definition) of the corresponding ciphertext number data object (data storage structure) can be provided by the common cryptographic component or member. Whether the ciphertext number data object directly stores the ciphertext number through the corresponding data field or structure or stores the ciphertext number by referring to other data objects (structures) through fields (such as pointers, reference fields) is entirely up to the implementer. In addition to the data field or structure for storing the ciphertext number or referencing the data object for storing the ciphertext number, the ciphertext number data object also has the corresponding data field or structure for storing the ciphertext number. The cryptographic operation context information of the calculation, as well as parameters outside the cryptographic operation context related to the encryption of the current ciphertext number, or the cryptographic operation context is not stored directly, but a corresponding field is used to store the indication information for obtaining the cryptographic operation context (such as a pointer, identifier, etc.). For the case where the corresponding field stores the indication information for obtaining the cryptographic operation context, the cryptographic operation context can be stored in a globally accessible data storage structure (because it contains the necessary common parameters), such as a global Map table. When performing data encryption, decryption and ciphertext calculations, the corresponding cryptographic operation context can be obtained through the indication information of the cryptographic operation context. When serializing a ciphertext data object, the cryptographic operation context can be directly serialized, and then the cryptographic operation context information in the serialized data is used to recover the cryptographic operation context for cryptographic operation when the data object is deserialized and reconstructed. Alternatively, when serializing a ciphertext data object, the cryptographic operation context generation parameters containing the reconstructed cryptographic operation context are serialized, and then the cryptographic operation context generation parameters in the serialized data are used to reconstruct the cryptographic operation context for cryptographic operation when the data object is deserialized and reconstructed, or the cryptographic operation context for cryptographic operation is found in the global table, and then the corresponding indication information for obtaining the cryptographic operation context is generated, that is, the cryptographic operation context can be directly stored in the reconstructed ciphertext data object, or the cryptographic operation context indication information can be obtained.

[0247] In a specific implementation, in addition to all the parameters required for cryptographic operations, the cryptographic operation context may also contain the corresponding functions or methods of the cryptographic operations (because it can be a data object containing functions or methods), but this is not necessary. If the cryptographic operation context also contains the corresponding functions or methods of the cryptographic operations, the codes of these functions or methods themselves are not serialized (but are reconstructed locally during deserialization).

[0248] In order to implement a data (or data object)-centric implementation method, for an object-oriented programming language, a common cryptographic component or member provides a class definition of a ciphertext data object, and provides a constructor (method) or initialization function (method) of the corresponding data object. The input parameters of the constructor (method) or initialization function (method) only need to input a plaintext number (integer, floating point number), a homomorphic encryption public key, and a cryptographic operation context, or indication information for selecting a cryptographic operation context. The constructor (method) or initialization function (method) of the ciphertext data object encodes the plaintext number according to the input parameters, uses or selects a corresponding cryptographic operation context to encrypt the encoded plaintext number to obtain a corresponding ciphertext number (if there is no created cryptographic operation context, then creates a corresponding cryptographic operation context), and then sets the corresponding field of the ciphertext data object to complete the initialization setting of the ciphertext data object.

[0249] For non-object-oriented programming languages, ordinary cryptographic components or components define and provide initialization functions for ciphertext data objects. The input parameters of the initialization function only need to input the ciphertext data object to be initialized, the plaintext number (integer, floating point number), the homomorphic encryption public key, and the cryptographic operation context or the indication information for selecting the cryptographic operation context. For the initialization function of the ciphertext data object, the plaintext number is encoded according to the input parameters, and the matching created cryptographic operation context is found using the input cryptographic operation context or according to the indication information of the cryptographic operation context (if there is no created one, the corresponding cryptographic operation context is created), and the encoded plaintext number is encrypted using the cryptographic operation context to obtain the corresponding ciphertext number, and then the corresponding fields of the ciphertext data object are set to complete the initialization setting of the ciphertext data object.

[0250] In the implementation of the present invention, under the same cryptographic operation context, the granularity q of the floating factor and the constant c in the floating factor of different types of data may be the same or different. If the selection of q and c for different types of data are the same, then q and c may or may not belong to the cryptographic operation context; if the selection of q and c for different types of data are different, then they do not belong to the cryptographic operation context.

[0251] During the initialization process of the cryptographic operation context and / or ciphertext data object of the present invention, it is necessary to select and set (one or more) amplification factors γ, the granularity q of the floating factor β and the constant c. To this end, the above-mentioned scheme of selecting and setting γ and β through testing can be adopted, or the above-mentioned scheme of automatically selecting and setting (by the corresponding initialization program) based on the range of the exponents of the known (most of) floating-point numbers to be encrypted, operated and calculated can be adopted. Of course, other schemes deemed appropriate by the implementer may also be adopted.

[0252] Through the above ciphertext data objects and the initialization methods of ciphertext data objects, programmers do not need to worry about how to program and call cryptographic components or components to encrypt plaintext numbers to obtain corresponding ciphertext numbers, and do not need to worry about the writing of constructors (methods) or initialization functions (methods).

[0253] It should be pointed out here that since the core cryptographic component or component has high security requirements, whether it is implemented in the form of a cryptographic card or an independently running cryptographic server or cryptographic machine, ordinary cryptographic components or components cannot directly call the functions of the core cryptographic component or component through program code calls (function or method calls), but must call them indirectly (such as through the network or PCIE bus); various data objects submitted by ordinary cryptographic components or components when calling core cryptographic components or components, such as ciphertext data objects, must be serialized before they can be transmitted to the core cryptographic component or component, and the core cryptographic component or component will reconstruct the data object through deserialization; when the response is returned, the various data objects returned must be serialized before they can be returned to the ordinary cryptographic component or component, and the ordinary cryptographic component or component will reconstruct the data object through deserialization; in order to avoid continuous and repeated calls in this call and return process The cryptographic operation context is created repeatedly. The cryptographic operation context should be saved in the form of global data in priority, and duplicate cryptographic operation contexts should be avoided. By introducing a reference count for each global cryptographic operation context, the global cryptographic operation context can be effectively managed: a global table is maintained, which stores different cryptographic operation contexts, and each cryptographic operation context has a reference count; when a cryptographic operation context needs to be referenced and it does not exist in the global table, the cryptographic operation context is created in the global table and its reference count is set to 1; for each additional reference to a ciphertext data object or other cryptographic data object to a ciphertext operation context, its reference count is increased by 1; if a ciphertext data object or a cryptographic data object no longer references a cryptographic operation context, its reference count is reduced by 1; when the reference count of a cryptographic operation context is 0 and times out, the cryptographic operation context is deleted from the global table.

[0254] For the implementation of ciphertext data objects of different data types (integer, floating point, complex number), different data classes (types) (such as class) can be directly defined, or different values ​​can be set in a field or attribute representing the data type of the ciphertext data object (class) to distinguish them. When the type of the ciphertext data object needs to be known during the operation or calculation process, the type of the ciphertext data object can be determined by the value of this field or attribute (for example, for C language, the first field of the structure data can be used to identify the type of the ciphertext data object, so that the type of the data object and the specific data structure can be known through the first field of the data structure pointed to by the pointer. This is a common method for defining different types of data objects with common characteristics in C language programming, and can achieve technical effects similar to defining base classes and derived classes in object-oriented programming languages); for programming languages ​​and technologies with reflection mechanisms, the base class can be defined first, and then different types of ciphertext data objects can be defined through different derived classes. During the operation or calculation process, when the type of the ciphertext data object needs to be known, it can be determined through the reflection mechanism. The method of directly defining different data types (such as class) is the least desirable. This adds extra complexity for both programmers who write secure computing systems and programmers who write applications. For example, when adding two real ciphertext numbers, it is usually not necessary to care whether the two ciphertext numbers are integer ciphertext numbers or floating-point ciphertext numbers. Only after decryption to obtain the plaintext numbers, different processing is performed based on whether the two ciphertext number data objects are of integer type or floating-point type. In addition, when directly defining different data types (such as class), different operation operation (interface) functions or methods need to be defined for operations on different data types.

[0255] Whether the ciphertext data objects storing single ciphertext numbers and vector ciphertext numbers are implemented by different types of data objects or by the same type of data objects, that is, treating single ciphertext numbers as special cases of vector ciphertext numbers (a vector with only one element), depends on the specific implementer. In addition, a matrix ciphertext data object can also be defined in the specific implementation. The matrix ciphertext data object contains a single or multiple vector ciphertext numbers.

[0256] In order to reduce the difficulty for ordinary programmers to write computing programs using homomorphically encrypted ciphertext numbers, the implemented confidential computing system can provide auxiliary computing programs and / or auxiliary compilation tools, where:

[0257] The auxiliary computing program receives (one or more) ciphertext data objects and description information of a calculation formula and / or a calculation process, parses the description information of the calculation formula and / or the calculation process, uses the ciphertext data objects according to the description of the calculation formula and / or the calculation process, and calls common cryptographic components or members to complete corresponding calculations; the description information of the calculation formula and / or the calculation process is specified by the implementer himself; the auxiliary computing program can be implemented as a dynamically loaded program component, such as a dynamic library, a class library (for example, released in the form of an SDK), or a stand-alone program;

[0258] Alternatively, the programmer still writes calculation programs for ciphertext number data objects in the same way as writing calculation programs for plaintext numbers (such as integers and floating-point numbers), using operators (such as +, -, *, / , etc.) and common calculation functions provided by the programming language (such as natural exponential function, natural logarithm function, trigonometric function, square root function, etc.) and annotates the ciphertext data objects in the program, or predefines a special base class for ciphertext numbers, and all ciphertext numbers are derived classes of ciphertext numbers; the auxiliary compilation tool annotates the ciphertext data objects in the source program code according to the programmer's comments in the source program code or according to the data type of the data object of the calculation formula in the program. The program code that uses the common calculation functions provided by the programming language to perform operations and calculations on the ciphertext data object is converted into a program code that uses the ciphertext data object to call the operation operation function or method corresponding to the operator provided by the common cryptographic component or component (such as the function or method for addition, subtraction, multiplication, and division operations corresponding to the +, -, *, / operator), and calls the corresponding conventional calculation function provided by the common cryptographic component or component (such as the natural exponential function, natural logarithm function, trigonometric function, square root function, etc. for the ciphertext number provided by the common cryptographic component or component) to perform the corresponding calculation; then, the transformed source code is converted into a program code that uses the ciphertext data object to call the operation operation function or method corresponding to the operator provided by the common cryptographic component or component (such as the natural exponential function, natural logarithm function, trigonometric function, square root function, etc. for the ciphertext number provided by the common cryptographic component or component) to perform the corresponding calculation; The program is compiled by the compiler, and then the compiled program is executed; for the interpreted source program (script program), the transformed source program is directly executed, or, for programming languages ​​that do not support operator overloading but provide a reflection mechanism or function (such as the reflection mechanism or tool of Java, Golang, and C#), the auxiliary compilation tool converts the program code that uses operators to perform operations on data objects and the program code that calls common calculation functions provided by the programming language to perform calculations on data objects in the source program code according to the programmer's comments in the source program code, into program codes that call operation functions or methods corresponding to operators provided by ordinary cryptographic components or components to perform operations, and program codes that call corresponding conventional calculation functions provided by ordinary cryptographic components or components to perform corresponding calculations on data objects, operation functions or methods corresponding to operators provided by ordinary cryptographic components or components, and conventional calculation functions provided by ordinary cryptographic components or components. During the execution process, the type (what type of data, such as integer, floating point, double precision floating point or other type of data object) and kind (whether it is a ciphertext data object) of the data object involved in the operation or calculation are determined by reflection, and then the corresponding operation or calculation processing is performed according to the type and kind of the data object.

[0259] In order to determine the type and kind of data objects involved in operations or calculations through reflection, and perform corresponding operations or calculations based on the type and kind of data objects, ordinary cryptographic components or members provide operation functions or methods corresponding to operators, and corresponding conventional calculation functions, whose input parameter types are the most basic object class (Object class) (other types are its derived classes).

[0260] For programming languages ​​(such as C++) that support operator overloading (such as +, -, *, / , etc.), the confidentiality system can provide (all required) operator overloading programs for ciphertext data objects through implementation, so that ordinary programmers can write calculation programs for ciphertext numbers in the same programming method as writing ordinary calculation programs for plaintext numbers (such as integers, floating-point numbers), wherein the data objects representing ciphertext numbers can be assigned values ​​through data initialization programs (such as constructors of C++ data objects); further, the types of ciphertext number data objects may include integer types, floating-point types and complex types, and for ciphertext number objects of integer type, after the core cryptographic component or component decrypts the ciphertext number, for the non-integer plaintext number obtained by decryption, the core cryptographic component or component rounds off its absolute value to an integer (if the plaintext number obtained by decryption is itself an integer plaintext number, of course no conversion is required), and the sign remains unchanged, thereby obtaining an integer plaintext number.

[0261] Other specific technical implementations not described are well known and self-evident to technicians in the relevant fields.

Claims

1. A secure computing system, characterized by: The secure computing system includes common cryptographic components or members and core cryptographic components or members, wherein: Ordinary cryptographic components or components: use homomorphic encryption algorithms to encrypt plaintext numbers and perform algebraic operations on ciphertext numbers, i.e., ciphertext operations; ordinary cryptographic components or components do not have a key for decrypting ciphertext numbers; Core cryptographic components or members: organize ciphertext numbers, perform complex calculations on ciphertext numbers, and return ciphertext numbers to the user or owner of decrypted data after decryption; the organization of ciphertext numbers is aimed at situations where it is difficult or impossible to change or adjust the ciphertext numbers without decrypting the ciphertext numbers to obtain their plaintext numbers, wherein the change or adjustment of the ciphertext numbers includes changing or adjusting the ciphertext level of the ciphertext numbers, changing or adjusting the cryptographic operation context used in data encryption operations, data decryption operations and ciphertext operations, that is, changing or adjusting the cryptographic operation context used in the cryptographic operation, and changing or adjusting the parameters related to the cryptographic operation outside the cryptographic operation context; the parameters related to the cryptographic operation outside the cryptographic operation context are parameters used and / or used by the cryptographic operation but not placed in the cryptographic operation context; the core cryptographic component or member has a key for decrypting the ciphertext numbers; the key for decrypting the ciphertext numbers is securely protected; the core cryptographic component or member does not return sensitive data in plain text, and the sensitive data includes data decrypted from the ciphertext numbers, and data calculated using the data decrypted from the ciphertext numbers that is not allowed to be returned in plain text; The plaintext number includes a single plaintext number and a plaintext vector, and the ciphertext number includes a ciphertext obtained by encrypting a single plaintext number, i.e., a single ciphertext number, and a ciphertext obtained by encrypting a plaintext vector, i.e., a vector ciphertext number; The complex calculation refers to a calculation that cannot obtain the expected result due to the limitation of the number of multiplication operations allowed by the ciphertext number, that is, the limitation of the ciphertext level, or a calculation that is difficult or impossible to complete using the ciphertext number; the difficult or impossible calculation refers to a calculation that cannot be completed and obtain the expected result based on the ciphertext number within the required or specified time due to the limitation of the homomorphic encryption algorithm itself or the computing technology; The cryptographic operation context refers to a set of common parameters required for performing encryption operations, decryption operations and ciphertext operations on data, i.e., cryptographic operations, and the set of common parameters constitutes the basic background environment of the cryptographic operation; if the confidential computing system supports different homomorphic encryption algorithms at the same time, the cryptographic operation context also includes a homomorphic encryption algorithm identifier, which is used to identify the homomorphic encryption algorithm used for data encryption operations, decryption operations and ciphertext operations; if there is no homomorphic encryption algorithm identifier in the cryptographic operation context, the corresponding homomorphic encryption algorithm is the default algorithm; The components in the common cryptographic components or members and the core cryptographic components or members are system components that cannot be independently operated, and the components are system components that can be independently operated; the common cryptographic components or members and the core cryptographic components or members are located in the same or different operating locations, and if they are located in different operating locations, the common cryptographic components or members exchange data with the core cryptographic components or members through a network; For a request for arranging a ciphertext number submitted by the common cryptographic component or component, the core cryptographic component or component decrypts the ciphertext number to be arranged, arranges the plaintext number obtained by decryption according to the requirements of the common cryptographic component or component, and then re-encrypts the arranged plaintext number using a homomorphic encryption algorithm, and then returns the re-encrypted ciphertext number; For a request submitted by the common cryptographic component or component to perform a complex calculation on a ciphertext number, the core cryptographic component or component decrypts the ciphertext number, uses the decrypted plaintext number to perform the complex calculation required by the common cryptographic component or component, and then uses a homomorphic encryption algorithm to encrypt the calculated result, and then returns the encrypted ciphertext number; For a request to decrypt and return a plaintext number corresponding to a ciphertext number, the core cryptographic component or component decrypts the ciphertext number after confirming the authorization of the user or owner of the decrypted data and / or the owner, manager or controller of the core cryptographic component or component, encrypts the decrypted plaintext number using the data encryption key of the user or owner of the decrypted data, and then returns the encrypted ciphertext to the user or owner of the decrypted data; thereafter, the user or owner of the decrypted data uses the data decryption key to decrypt the ciphertext returned by the core cryptographic component or component, and finally obtains the plaintext number.

2. The secure computing system according to claim 1, wherein: A single plaintext number to be encrypted is decomposed into a product of a floating factor β and a significant digit, wherein the significant digit refers to a number having an expected number of significant digits, i.e., a number having sufficient significant digits; for a complex plaintext number, the floating factors of its real part and its imaginary part are the same; the floating factor is a positive number; the significant digit is encrypted to obtain a significant digit ciphertext, and the significant digit ciphertext and the floating factor together constitute a ciphertext of the single plaintext number, i.e., a single ciphertext number; A plaintext vector to be encrypted, each element of which is decomposed into the product of the same floating factor β and an effective digit, and the effective digits of all elements constitute an effective digit vector; the effective digit vector is encrypted to obtain the ciphertext of the effective digit vector, i.e., the vector ciphertext number, and the ciphertext of the effective digit vector, i.e., the vector ciphertext number, together with the floating factor, constitute the ciphertext of the plaintext vector, i.e., the vector ciphertext number of the plaintext vector; The significant digits of a single plaintext number and the significant digits vector of a plaintext vector are collectively referred to as the significant digits, and the ciphertext of the significant digits of a single plaintext number, i.e., the ciphertext number, and the ciphertext of the significant digits vector of a plaintext vector, i.e., the vector ciphertext number, are collectively referred to as the ciphertext of the significant digits or the ciphertext number of the significant digits; The selection of the floating factor enables the homomorphic encryption algorithm to be used to encrypt the effective digits in a usual manner, and the encrypted result and the result of the operation based on the ciphertext number meet the requirements for the effective digits, calculation accuracy and calculation efficiency of the data; the encryption in the usual manner for the effective digits refers to the encryption method used to encrypt the number to be encrypted when the floating factor is not introduced; When a system component, including a common cryptographic component or member and a core cryptographic component or member, encrypts a plaintext number, the plaintext number to be encrypted is first decomposed into a product of a floating factor β and a valid digit, and then the valid digit is encrypted in a usual manner using a homomorphic encryption algorithm to obtain a ciphertext of the valid digit, and then the floating factor and the ciphertext of the valid digit are combined to form a ciphertext number after the plaintext number is encrypted; When a system component, including a core cryptographic component or member, decrypts a ciphertext number, it first decrypts the ciphertext of the significant digits in the ciphertext number to obtain the corresponding significant digits, and then multiplies the decrypted significant digits by the floating factor β given in the ciphertext number to obtain the plaintext number corresponding to the ciphertext number.

3. The secure computing system according to claim 2, wherein: When it is necessary to adjust the floating factor of a ciphertext number and it is difficult or impossible to complete the adjustment without decrypting the ciphertext number, the common cryptographic component or component submits the ciphertext number to be adjusted to the core cryptographic component or component; the core cryptographic component or component decrypts the ciphertext number to obtain the plaintext number, and then automatically adjusts the floating factor of the plaintext number and the corresponding number of significant digits, or adjusts the floating factor of the plaintext number and the corresponding number of significant digits according to the floating factor specified in the adjustment request or the specified requirements, and then uses a homomorphic encryption algorithm to encrypt the adjusted number of significant digits, and forms the adjusted ciphertext number together with the encryption result and the adjusted floating factor, and then returns the adjusted ciphertext number to the common cryptographic component or component; the specified requirements are different from the specified floating factor.

4. The secure computing system according to claim 3, wherein: When adjusting the floating factor of a ciphertext number, it is allowed to adjust its cryptographic operation context and other encryption parameters outside the cryptographic operation context. The other encryption parameters outside the cryptographic operation context refer to parameters used in the cryptographic operation but not included in the cryptographic operation context.

5. The secure computing system according to claim 2, wherein: The common cryptographic components or components can reduce the floating factor by: If it is necessary to reduce the floating factor of a ciphertext number by d times, then reduce the floating factor of the ciphertext number to be adjusted by d times to obtain a new floating factor, and then multiply the ciphertext of the significant digits of the ciphertext number to be adjusted by the ciphertext number of d to obtain the ciphertext of the new significant digits. Alternatively, if the homomorphic encryption algorithm supports the multiplication of ciphertext numbers by plaintext numbers, then multiply the ciphertext of the significant digits of the ciphertext number to be adjusted by the plaintext number d to obtain the ciphertext of the new significant digits. The new floating factor and the ciphertext of the new significant digits together constitute the ciphertext number with the floating factor adjusted.

6. The secure computing system according to claim 2, wherein: The common cryptographic components or components increase the floating factor in the following ways without the help of the core cryptographic components or components: If it is necessary to increase the floating factor of a ciphertext number by d times and 1 / d is within the representation range of the effective digits, the common cryptographic component or member increases the floating factor of the ciphertext number to be adjusted by d times to obtain a new floating factor, multiplies the ciphertext of the effective digits of the ciphertext number to be processed by 1 / d and obtains the ciphertext of the new effective digits after homomorphic encryption, and the new floating factor and the ciphertext of the new effective digits together constitute the ciphertext number with the adjusted floating factor.

7. The secure computing system according to any one of claims 2 to 6, characterized in that: When the ciphertexts of two numbers are multiplied, the common cryptographic component or member multiplies the ciphertexts of the effective digits of the two numbers according to the homomorphic encryption algorithm to obtain the ciphertext of the effective digits of the product, and multiplies the floating factors to obtain the floating factors of the product; When two ciphertext numbers with the same floating factor are added, the common cryptographic component or member adds the ciphertexts of the significant digits of the two numbers according to the addition operation of the homomorphic encryption algorithm to obtain the ciphertext of the significant digits of the sum, and the floating factor remains unchanged; When two ciphertext numbers with different floating factors are added, the common cryptographic component or member adjusts the floating factors of the two ciphertext numbers to be consistent with each other with the help of the core cryptographic component or member or by itself, and then adds the two ciphertext numbers with the same adjusted floating factors.

8. The secure computing system according to any one of claims 1 to 6, characterized in that: If the common cryptographic component or component requires the core cryptographic component or component to sort out a ciphertext number X, and at the same time does not want to expose the plaintext number x corresponding to the ciphertext number X to the core cryptographic component or component, the common cryptographic component or component uses the homomorphic encryption algorithm and homomorphic ciphertext operation to convert the ciphertext number X into Y, where Y is the ciphertext number x-x0, that is, the plaintext number corresponding to Y is y=x-x0, x0 is a number randomly selected by the common cryptographic component or component or a number derived from the randomly selected number, and then submits the ciphertext number Y to the core cryptographic component or component. Request for sorting; the core cryptographic component or component decrypts Y to obtain the plaintext number y corresponding to Y, and then uses the plaintext number y corresponding to the ciphertext number Y to complete the sorting required by the ordinary cryptographic component or component, and then uses the homomorphic encryption algorithm to encrypt the sorting result, and returns the encrypted sorting result to the ordinary cryptographic component or component; the ordinary cryptographic component or component uses the homomorphic encryption algorithm and homomorphic ciphertext operation to add the homomorphic encrypted ciphertext number X0 of x0 to the ciphertext number returned by the core cryptographic component or component, so as to obtain the expected sorting result for the ciphertext number X.

9. The secure computing system according to any one of claims 1 to 6, characterized in that: If the common cryptographic component or component requires the core cryptographic component or component to use the ciphertext number X to complete a complex calculation, and at the same time does not want to expose the plaintext number x corresponding to the ciphertext number X to the core cryptographic component or component, the common cryptographic component or component uses a homomorphic encryption algorithm and homomorphic ciphertext operation to convert the ciphertext number X into Y, where Y is the ciphertext number of x+x0 or x·x0, that is, the plaintext number y corresponding to Y is x+x0 or x·x0, and x0 is a number randomly selected by the common cryptographic component or component or a number derived from the randomly selected number, and then submits the ciphertext number Y to the core cryptographic component or component to request the completion of the specified calculation; the core cryptographic component or component decrypts Y to obtain the plaintext number y corresponding to Y, and then uses the plaintext number y corresponding to the ciphertext number Y to complete the calculation specified by the common cryptographic component or component, and then uses the homomorphic encryption algorithm to encrypt the calculation result, and returns the encrypted calculation result to the common cryptographic component or component; the common cryptographic component or component uses the ciphertext number returned by the core cryptographic component or component and x0, and uses the homomorphic encryption algorithm and homomorphic ciphertext operation to calculate the expected calculation result.

10. The secure computing system according to any one of claims 1 to 6, characterized in that: For complex calculations, if the calculation rules or functions are not conventional calculation rules or functions supported by the core cryptographic component or member, the core cryptographic component or member may complete the corresponding calculation in the following ways: The program code for plaintext number calculation is loaded and called by the core cryptographic component or component as trusted code, and the trusted code completes the corresponding expected calculation; Alternatively, the common cryptographic component or member submits a description of a calculation rule or function corresponding to a complex calculation, and the core cryptographic component or member completes the corresponding desired calculation by parsing the description of the calculation rule or function; The conventional calculation rules or functions supported by the core cryptographic components or members refer to the calculation rules or functions that the core cryptographic components or members can complete the corresponding calculations without providing additional calculation rules or function descriptions or additional program codes.

11. The secure computing system according to any one of claims 1 to 6, characterized in that: One way to authorize a request to decrypt a plaintext number corresponding to a ciphertext number is through authorization data; the authorization data contains the ciphertext number to be decrypted or the hash value of the ciphertext number, and is digitally signed by the user or owner of the decrypted data, and / or the owner or manager or controller of the core cryptographic component or member, the digital signature including a public key digital signature or a symmetric key digital signature; The entity that requests to return the plaintext number corresponding to the ciphertext number submits the corresponding authorization data for obtaining the plaintext number corresponding to the ciphertext number when requesting to return the plaintext number corresponding to the ciphertext number; the core cryptographic component or component verifies the validity of the authorization data by verifying the digital signature of the authorization data; If the core cryptographic component or member does not pre-store the encryption key used for data encryption of the user or owner of the decrypted data, the authorization data contains a public key for encrypting the returned data or data for generating and / or deriving the encryption key.

12. The secure computing system according to any one of claims 1 to 6, characterized in that: The core cryptographic component or component maintains an authorizer list, the information of which includes the identification information of the authorizer, the signature verification key for the digital signature of the authorizer, the authorization method, and the encryption key for encrypting the plaintext number returned to the user or owner of the decrypted data after decrypting the ciphertext number to obtain the plaintext number; the authorizer refers to an entity that can issue authorization data, including the user or owner of the decrypted data, and the owner, manager or controller of the core cryptographic component or component.

13. The secure computing system according to any one of claim 7, characterized in that: A data object used to store a ciphertext number is called a ciphertext number data object; in addition to the ciphertext number, the ciphertext number data object also stores a cryptographic operation context and parameters related to the current ciphertext number encryption and ciphertext operation outside the cryptographic operation context, or stores information for obtaining the cryptographic operation context and parameters related to the current ciphertext number encryption and ciphertext operation outside the cryptographic operation context; the parameters related to the current ciphertext number encryption and ciphertext operation outside the cryptographic operation context refer to parameters used for the current ciphertext number encryption and ciphertext operation but not included in the cryptographic context, including a public key that is not included in the cryptographic operation context, an amplification factor, a current ciphertext level, and / or a current ciphertext operation modulus; if a floating factor is introduced into the encryption of the ciphertext number, the parameters of the floating factor used to generate the ciphertext number belong to the parameters in the cryptographic operation context, or belong to the parameters related to the current ciphertext number encryption and ciphertext operation outside the cryptographic operation context; the current ciphertext number refers to the ciphertext number stored in the ciphertext number data object; The serialized data of the ciphertext number data object after serialization contains a cryptographic operation context or a cryptographic operation context generation parameter corresponding to the ciphertext number; when reconstructing the ciphertext number data object through deserialization, the cryptographic operation context of the ciphertext number data object is restored or reconstructed or the information of the cryptographic operation context is obtained through the cryptographic operation context or the cryptographic operation context generation parameter in the serialized data; When performing cryptographic operations, the program or system component performing the cryptographic operations directly or indirectly obtains the cryptographic operation context required for the cryptographic operation and the parameters related to the current ciphertext number encryption and the ciphertext operation outside the cryptographic operation context through the ciphertext data object; The cryptographic operation context generation parameters refer to parameters used to generate or construct a cryptographic operation context.

14. The secure computing system according to claim 13, characterized in that: The ciphertext data object includes an integer type ciphertext data object and a floating point type ciphertext data object, respectively referred to as an integer ciphertext data object and a floating point ciphertext data object; For an integer type ciphertext data object, after decrypting the ciphertext, the core cryptographic component or member rounds the absolute value of the non-integer plaintext number obtained by decryption to the nearest integer, with the sign unchanged, thereby obtaining an integer plaintext number, and then returns the integer type plaintext number, or uses the integer plaintext number for operation, calculation or processing; if the ciphertext number stored in the integer type ciphertext data object is a vector ciphertext number, then after decrypting the ciphertext number, the absolute value of each non-integer element in the decrypted plaintext vector is rounded to the nearest integer and converted to an integer, with the sign unchanged, to obtain an integer plaintext vector; For a ciphertext data object of floating-point type, the core cryptographic component or member returns a plaintext number of the floating-point type after decrypting the ciphertext number, or uses the floating-point plaintext number for operation, calculation or processing.

15. The secure computing system according to claim 13, wherein: The ciphertext data object also includes a plural type of ciphertext data object, referred to as a plural ciphertext data object; If the homomorphic encryption algorithm does not support complex encryption and complex ciphertext operations, the complex ciphertext number data object simultaneously stores the real ciphertext and imaginary ciphertext of the complex ciphertext number. When the ordinary cryptographic component or member, or the core cryptographic component or member, performs ciphertext operations or ciphertext calculations on the complex type ciphertext number data object, the real ciphertext number and the imaginary ciphertext number are taken out from the complex ciphertext number data object, and the ciphertext operation or ciphertext calculation is performed using the real or imaginary ciphertext number according to the complex operation or calculation rules to obtain the corresponding ciphertext operation or calculation results.

16. The secure computing system according to claim 13, characterized in that: The secure computing system is provided with an auxiliary computing program and / or an auxiliary compilation tool, wherein: The auxiliary calculation program receives the ciphertext data object and the description information of the calculation formula and / or the calculation process, parses the description information of the calculation formula and / or the calculation process, uses the ciphertext data object and calls the common cryptographic component or member to complete the corresponding calculation according to the calculation formula and / or the calculation process specified in the description information of the calculation formula and / or the calculation process; The auxiliary compilation tool converts the program code that uses the operator to perform operations on the ciphertext data object in the source program code into the program code that uses the ciphertext data object to call the operation function or method corresponding to the operator provided by the common cryptographic component or member according to the programmer's comments in the source program code or the data type of the data object that appears in the calculation formula in the source program, and converts the program code that uses the common calculation function provided by the programming language to perform calculations on the ciphertext data object in the source program code into the program code that uses the ciphertext data object to call the corresponding conventional calculation function provided by the common cryptographic component or member to perform corresponding calculations; Alternatively, for a programming language that does not support operator overloading but provides a reflection mechanism or function, the auxiliary compilation tool converts the program code that uses the operator to perform operations on the data object in the source program code according to the programmer's comments in the source program code into a program code that calls the operation function or method corresponding to the operator provided by the common cryptographic component or member to perform the operation, and converts the program code that calls the common calculation function provided by the programming language to perform calculations on the data object in the source program code into a program code that calls the corresponding conventional calculation function provided by the common cryptographic component or member to perform corresponding calculations on the data object; the operation function or method corresponding to the operator provided by the common cryptographic component or member, and / or the conventional calculation function provided by the common cryptographic component or member, determine the type and type of the data object involved in the operation or calculation through reflection during the execution process, and then perform corresponding operation or calculation processing according to the type and type of the data object; The commonly used calculation functions provided by the programming language include natural exponential function, natural logarithm function, trigonometric function, and square root function, and the corresponding conventional calculation functions provided by the ordinary cryptographic components or members are calculation functions provided by ordinary cryptographic components or members that correspond to the commonly used calculation functions provided by the programming language.

17. The secure computing system according to claim 13, characterized in that: For programming languages ​​that support operator overloading, the secure computing system provides operator overloading for ciphertext number data objects, and ordinary programmers write calculation programs for ciphertext number data objects in the same way as they write calculation programs for plaintext numbers; the ordinary programmers refer to those who use ordinary cryptographic components or modules to write programs.

Images