Homomorphic decryption methods, apparatus, non-volatile storage media, and computer equipment

Abstract

This invention discloses a homomorphic decryption method, apparatus, non-volatile storage medium, and computer device. The method includes: obtaining a first LWE ciphertext and its private key, wherein the first LWE ciphertext is the ciphertext to be homomorphically decrypted in a first-layer homomorphic encryption scheme; determining an NTRU private key and a rotation polynomial, wherein the NTRU private key is used to decrypt the NTRU ciphertext in a second-layer homomorphic encryption scheme; generating an evaluation key corresponding to a blind rotation algorithm based on the private key and NTRU private key of the first LWE ciphertext, wherein the evaluation key includes multiple automorphic keys and multiple computation keys; and performing homomorphic decryption on the first LWE ciphertext based on the rotation polynomial, the evaluation key, and the blind rotation algorithm to obtain a target NTRU ciphertext, wherein the target NTRU ciphertext corresponds to the NTRU private key and is the NTRU ciphertext in the second-layer homomorphic encryption scheme. This invention solves the technical problem of low bootstrapping efficiency of fully homomorphic ciphertext schemes in related technologies.

Description

Technical Field

[0001] This invention relates to the field of cryptography, and more specifically, to a homomorphic decryption method, apparatus, non-volatile storage medium, and computer equipment. Background Technology

[0002] Fully homomorphic encryption (FHE) is one of the main cryptographic tools for privacy computing, allowing computation on encrypted data directly without decryption. Existing FHE schemes are designed based on difficult problems on lattices, making them resistant to quantum computer attacks. Currently, mainstream FHE schemes follow the same framework: first, a noisy finite homomorphic encryption (SHE) scheme is designed that supports only a finite number of homomorphic operations. In such schemes, noise gradually increases with the number of homomorphic operations, eventually leading to decryption failure. Therefore, a corresponding bootstrap algorithm is needed to homomorphically decrypt the SHE scheme to reduce noise.

[0003] In 2009, Gentry pioneered the first feasible fully homomorphic encryption scheme based on ideal lattices and provided a theoretical framework for constructing such schemes. This framework can be divided into two layers: 1) The first layer involves constructing a partially homomorphic encryption scheme (SHE) that supports only a finite number of homomorphic operations. Random noise is typically introduced during the construction, and this noise accumulates with each homomorphic operation. Once the noise reaches a threshold, decryption fails. 2) The second layer utilizes a bootstrap algorithm to homomorphically compute the decryption circuit of the SHE in the first step, thereby reducing noise. Initially, because the depth of the homomorphically computeable circuit was less than the depth of the decryption circuit, most schemes used sparse subsets and assumptions to compress the decryption circuit. Therefore, the core design challenge lay in designing an SHE capable of homomorphically computing the decryption circuit, and then using Gentry's bootstrap theorem to transform the SHE into a fully homomorphic encryption scheme (FHE). In 2012, Gentry et al. constructed a class of hierarchical fully homomorphic encryption schemes based on the (R)LWE problem. These schemes use circuit depth as an auxiliary input parameter, employ key switching to control ciphertext dimensionality expansion, and modulus switching to control noise growth. They can homomorphically execute circuits of arbitrary bounded depth without bootstrapping. Therefore, these schemes no longer require compression / decryption circuits during bootstrapping. Since then, designing efficient bootstrapping algorithms has become a core task in fully homomorphic encryption.

[0004] Currently, research on improved bootstrapping mainly takes two approaches. The first approach aims to package several messages into a single ciphertext and refresh them in parallel to achieve bootstrapping. These schemes can encrypt a ring element rather than a single bit in a ciphertext, thus naturally supporting the packaging of multiple messages into independent "slots" and performing Single Instruction Multiple Data (SIMD) operations based on the Chinese Remainder Theorem (CRT). Currently, open-source libraries Helib, SEAL, and HEAAN, designed based on the BGV, BFV, and CKKS schemes respectively, are also widely used.

[0005] The second approach is a bootstrapping technique based on the Gentry-Sahai-Waters (GSW) scheme for homomorphic encryption. These schemes attempt to minimize the cost of bootstrapping a single ciphertext, even at the cost of having to perform bootstrapping after evaluating each gate of the circuit. However, these schemes have limitations: they require bootstrapping each gate of the circuit once and do not support packaging several messages into a single ciphertext. Open-source libraries based on this type of scheme include FHEW and TFHE, which are among the most efficient bootstrapping methods currently available. However, the aforementioned fully homomorphic encryption and decryption schemes still suffer from insufficient bootstrapping efficiency.

[0006] There is currently no effective solution to the above problems. Summary of the Invention

[0007] The present invention provides a homomorphic decryption method, apparatus, non-volatile storage medium, and computer device to at least solve the technical problem of low ciphertext bootstrapping efficiency in fully homomorphic schemes in related technologies.

[0008] According to one aspect of the present invention, a homomorphic decryption method is provided, comprising: obtaining a first LWE ciphertext and a private key of the first LWE ciphertext, wherein the first LWE ciphertext is ciphertext to be homomorphically decrypted in a first-layer homomorphic encryption scheme; determining an NTRU private key and a rotation polynomial, wherein the NTRU private key is used to decrypt the NTRU ciphertext in a second-layer homomorphic encryption scheme; generating an evaluation key corresponding to a blind rotation algorithm based on the private key of the first LWE ciphertext and the NTRU private key, wherein the evaluation key includes a plurality of automorphic keys and a plurality of computation keys, the plurality of automorphic keys being keys used for automorphism. The key switching key is obtained by encrypting the self-similar NTRU private key with the NTRU private key using the vector NTRU encryption method. The multiple computation keys are obtained by encrypting the private key of the first LWE ciphertext with the NTRU private key using the vector NTRU encryption method. Based on the rotation polynomial, the evaluation key and the blind rotation algorithm, the first LWE ciphertext is homomorphically decrypted to obtain the target NTRU ciphertext, wherein the target NTRU ciphertext corresponds to the NTRU private key and is the NTRU ciphertext in the second layer of the homomorphic encryption scheme.

[0009] Optionally, generating multiple computation keys for the evaluation key corresponding to the blind rotation algorithm based on the private key of the first LWE ciphertext and the NTRU private key includes: encrypting the component s0 in the private key of the first LWE ciphertext according to the ciphertext modulus of the NTRU ciphertext corresponding to the NTRU private key, the first parameter in the NTRU private key and integer pair, to obtain the evk0 key among the multiple computation keys, wherein the private key of the first LWE ciphertext is s0. Based on the ciphertext modulus of the NTRU ciphertext corresponding to the NTRU private key, the NTRU private key, and the first parameter, the component s in the private key s of the first LWE ciphertext is... i Each key is encrypted separately to obtain evk from the multiple computation keys. i A key, where 1 ≤ i < n; based on the ciphertext modulus of the NTRU ciphertext corresponding to the NTRU private key, the NTRU private key, and the first parameter, the sum of the components in the private key s of the first LWE ciphertext is encrypted to obtain evk among the plurality of computation keys. n Key.

[0010] Optionally, the evk0 key, the evk i Key and the evk n The key is calculated using the following formula: Among them, NTRU' Q,f,τ() represents the vector NTRU encryption method, and the calculation formula for the vector NTRU encryption method is as follows: NTRU′ Q,f,τ (v):=(τ·g0 / f+B 0 ·v,…,τ·g d-1 / f+B d-1 ·v), where v represents the data to be encrypted, Q represents the ciphertext modulus of the NTRU ciphertext corresponding to the NTRU private key, and f represents the NTRU private key f∈R extracted from the private key distribution. Q g0 to g d-1 Let g0,, ..., gn represent the error polynomials drawn from the error distribution. d-1 ←R Q τ represents the first parameter in the integer pair, and B represents a positive integer.

[0011] Optionally, generating multiple automorphic keys in the evaluation key corresponding to the blind rotation algorithm based on the private key of the first LWE ciphertext and the NTRU private key includes: determining parameter j, where parameter j represents the number of times the private key is mapped during the automorphism process; and generating the multiple automorphic keys based on the ciphertext modulus of the NTRU ciphertext corresponding to the NTRU private key, the first parameter in the NTRU private key and integer pair, according to the following formula: Among them, ksk j Denotes the plurality of self-isomorphic keys, f(X) j ) represents the self-isomorphized NTRU private key, f(X) represents the NTRU private key, q represents the ciphertext modulus of the first LWE ciphertext, and NTRU' Q,f,τ () represents the vector NTRU encryption method, and N represents the degree of the polynomial ring corresponding to the target NTRU ciphertext.

[0012] Optionally, the step of homomorphically decrypting the first LWE ciphertext based on the rotation polynomial, the evaluation key, and the blind rotation algorithm to obtain the target NTRU ciphertext includes: Step 1: Determining multiple odd numbers w based on the first LWE ciphertext. i The first LWE ciphertext is represented as follows:

[0013] m represents the plaintext corresponding to the first LWE ciphertext, and a = (a0, ..., a0) n-1 For each a in a i , Step 2: Calculation The constant NTRU ciphertext c0(X) is obtained, where △ represents the second parameter in the integer pair, r represents the rotation polynomial, and ⊙ represents the ciphertext outer product. The ciphertext outer product is based on the following formula: c⊙c′ = ... <BitDecom B (c),c′>, This means that for a∈R Q The bit decomposition vector under basis B satisfies And ||a i || ∞ <B,c∈R Q The vector NTRU ciphertext c′ represents the ciphertext obtained by the vector NTRU encryption method; Step 3: Calculate We obtain the constant NTRU ciphertext c0′(X), where NTRU Q,f,τ,△ () represents the constant NTRU encryption method, and the calculation formula for the constant NTRU encryption method is: NTRU Q,f,τ,△ (u):=τ·g / f+△·u / f, Q represents the ciphertext modulus of the NTRU ciphertext corresponding to the NTRU private key, and f represents the NTRU private key f∈R extracted from the private key distribution. Q , g represents the error drawn from the error distribution g∈R Q u represents the data to be encrypted, τ represents the first parameter in the integer pair, and Δ represents the second parameter in the integer pair; Step 4: Calculate Obtain constant NTRU ciphertext in, One of the multiple self-similar keys; Step 5: Based on the constant NTRU ciphertext The evk i The key and the plurality of self-similar keys are used to process the constant NTRU ciphertext according to steps two through four. By iterating, the constant NTRU ciphertext is obtained. Step Six: encrypt the constant NTRU ciphertext. With the evk n The key is used to perform an outer product of the ciphertext to obtain the target NTRU ciphertext.

[0014] Optionally, the ciphertext based on the constant NTRU The evk i The key and the plurality of self-similar keys are used to process the constant NTRU ciphertext according to steps two through four. By iterating, the constant NTRU ciphertext is obtained. Including: for 1≤i≤n-1,

[0015] calculate

[0016] calculate

[0017] calculate in, It is one of the multiple self-similar keys.

[0018] Optionally, the above method further includes: when the ciphertext modulus of the first LWE ciphertext is q and the ciphertext modulus of the target NTRU ciphertext is Q, extracting a constant term from the target NTRU ciphertext to obtain a second LWE ciphertext with a ciphertext modulus of Q; performing a modulus switch on the second LWE ciphertext to obtain a third LWE ciphertext with a ciphertext modulus of q; and performing a key switch on the third LWE ciphertext to obtain a fourth LWE ciphertext, wherein the ciphertext modulus of the fourth LWE ciphertext is q, and the private key corresponding to the fourth LWE ciphertext is the same as the private key of the first LWE ciphertext.

[0019] Optionally, the step of extracting a constant term from the target NTRU ciphertext to obtain a second LWE ciphertext with a ciphertext modulus of Q includes: for the target NTRU ciphertext c 目标 =τ·g / f+△·m / f, according to the polynomial c 目标 The coefficients c = (c0,…,c N-1 The coefficients of f and f Sure It is the second LWE ciphertext that encrypts message m under the private key f, and message m is also a message encrypted with the first LWE ciphertext.

[0020] Optionally, the step of performing a modulo switch on the second LWE ciphertext to obtain a third LWE ciphertext with a modulus of q includes: calculating ModSwitch(LWE) Q,f (m),q)=「LWE Q,f (m)·q / Q” mod q, to ​​obtain the third LWE ciphertext LWE with ciphertext modulus q and corresponding to the private key f. q,f (m), where LWE Q,f (m) represents the second LWE ciphertext.

[0021] Optionally, the step of key switching on the third LWE ciphertext to obtain the fourth LWE ciphertext includes: based on the ciphertext modulus q of the first LWE ciphertext and the integer B. ks ,calculate Sure And determine e from the error distribution i,j,v ,in, Based on the private key f = (f0, ..., f of the third LWE ciphertext N-1The private key s∈(s0,…,s) of the first LWE ciphertext n-1 ), a i,j,v and e i,j,v The key switching key is calculated. in, According to the third LWE ciphertext and formula break down Obtain vector in, calculate The fourth LWE ciphertext is obtained.

[0022] Optionally, the above method further includes: obtaining the initial RLWE ciphertext RLWE q,s (m R )=(a R ,b R ), wherein the initial RLWE ciphertext is ciphertext encrypted using the same private key as the first LWE ciphertext; based on the initial RLWE ciphertext, a is determined. R =(a R0 ,…,a R(n-1) ), s=(s0,…,s n-1 ),m R =(m R0 ,…,m R(n-1 )) is a R s and m R The coefficients are used to extract multiple m encrypted with private key s from the initial RLWE ciphertext. Ri Initial LWE ciphertext LWE q,s (m Ri )=(a Ri ,b Ri The initial LWE ciphertext includes a first LWE ciphertext and multiple fifth LWE ciphertexts; a blind rotation algorithm is applied to each of the multiple fifth LWE ciphertexts to obtain multiple NTRU ciphertexts that correspond one-to-one with the multiple fifth LWE ciphertexts; multiple sixth LWE ciphertexts are extracted from the multiple NTRU ciphertexts that correspond one-to-one with the multiple fifth LWE ciphertexts; a second LWE ciphertext is extracted from the target NTRU ciphertext; the second LWE ciphertext and the multiple sixth LWE ciphertexts are packaged together to obtain the target RLWE ciphertext.

[0023] According to another aspect of the present invention, a homomorphic decryption apparatus is also provided, comprising: an acquisition module, configured to acquire a first LWE ciphertext and a private key of the first LWE ciphertext, wherein the first LWE ciphertext is ciphertext to be homomorphically decrypted in a first-layer homomorphic encryption scheme; a determination module, configured to determine an NTRU private key and a rotation polynomial, wherein the NTRU private key is used to decrypt the NTRU ciphertext in a second-layer homomorphic encryption scheme; and a generation module, configured to generate an evaluation key corresponding to a blind rotation algorithm based on the private key of the first LWE ciphertext and the NTRU private key, wherein the evaluation key includes multiple automorphic keys and multiple computation keys, the multiple automorphic keys being... The key switching key for automorphism is obtained by encrypting the automorphic NTRU private key with the NTRU private key using the vector NTRU encryption method. The multiple computation keys are obtained by encrypting the private key of the first LWE ciphertext with the NTRU private key using the vector NTRU encryption method. The homomorphic decryption module is used to homomorphically decrypt the first LWE ciphertext based on the rotation polynomial, the evaluation key and the blind rotation algorithm to obtain the target NTRU ciphertext, wherein the target NTRU ciphertext corresponds to the NTRU private key and is the NTRU ciphertext in the second layer of the homomorphic encryption scheme.

[0024] According to another aspect of the present invention, a non-volatile storage medium is also provided, the non-volatile storage medium including a stored program, wherein, when the program is executed, the device where the non-volatile storage medium is located is controlled to execute any of the above-described homomorphic decryption methods.

[0025] According to another aspect of the present invention, a computer device is also provided, the computer device including a memory and a processor, the memory being used to store a program, and the processor being used to run the program stored in the memory, wherein the program executes any of the above-described homomorphic decryption methods when it runs.

[0026] In this embodiment of the invention, a small evaluation key is generated based on the private key of the LWE ciphertext of the first layer in the fully homomorphic encryption scheme and the NTRU private key. Then, the evaluation key is used to homomorphically decrypt the LWE ciphertext of the first layer into NTRU ciphertext with reduced noise. This achieves the purpose of quickly reducing the noise in the first LWE ciphertext, thereby realizing the technical effect of improving the bootstrap efficiency in the NTRU-based fully homomorphic encryption and decryption scheme, and thus solving the technical problem of low bootstrap efficiency of fully homomorphic ciphertexts in related technologies. Attached Figure Description

[0027] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0028] Figure 1 A hardware structure block diagram of a computer terminal for implementing a homomorphic decryption method is shown.

[0029] Figure 2 This is a flowchart illustrating the homomorphic decryption method provided according to an embodiment of the present invention;

[0030] Figure 3 This is a structural block diagram of a homomorphic decryption device provided according to an embodiment of the present invention. Detailed Implementation

[0031] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0032] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0033] According to an embodiment of the present invention, a homomorphic decryption method embodiment is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0034] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1A hardware block diagram of a computer terminal for implementing a homomorphic decryption method is shown. Figure 1 As shown, the computer terminal 10 may include one or more processors (shown as 102a, 102b, ..., 102n in the figure) (the processor may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0035] It should be noted that the aforementioned one or more processors and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be implemented wholly or partially as software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be wholly or partially integrated into any other element in the computer terminal 10. As involved in the embodiments of this application, the data processing circuits serve as processor control (e.g., selection of a variable resistor termination path connected to an interface).

[0036] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the homomorphic decryption method in this embodiment of the invention. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby implementing the homomorphic decryption method of the application described above. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0037] The display may be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10.

[0038] To improve the efficiency of fully homomorphic encryption methods, fully homomorphic encryption schemes can be designed based on NTRU. However, the bottleneck limiting the practical application of fully homomorphic encryption remains the efficiency of bootstrapping. Therefore, the new and efficient fully homomorphic encryption bootstrapping technique proposed in this application is of great significance.

[0039] First, some nouns, terms, symbols, and methods that appear in the description of the embodiments of this application shall be interpreted or defined as follows:

[0040] Homomorphic encryption is a computationally complex cryptographic technique based on mathematically difficult problems. The result of processing homomorphically encrypted data is the same as the result of processing unencrypted data using the same method. As an encryption algorithm that can protect data privacy, IBM's Craig Gentry first proposed a fully homomorphic algorithm based on ideal lattices in 2009.

[0041] Automorphism refers to the isomorphic process from a mathematical object to itself, that is, a way to map a mathematical object to itself while preserving the entire structure of the mathematical object.

[0042] LWE ciphertext refers to ciphertext obtained by encryption based on the learning with errors problem. The learning with errors (LWE) problem is a problem of solving a noisy system of linear equations.

[0043] RLWE ciphertext refers to the ciphertext obtained by encrypting based on the ring learning with errors problem (RLWE).

[0044] NTRU ciphertext is ciphertext obtained by encryption using a public-key cryptography scheme invented in 1996 by three mathematics professors at Brown University in the United States. NTRU (Number Theory Research Unit) is a public-key cryptography scheme. Because the key generation method of NTRU is relatively easy, its encryption and decryption speeds are much faster than well-known algorithms such as RSA.

[0045] Bootstrapping is a ciphertext refresh technique that uses homomorphic decryption to reduce ciphertext noise.

[0046] Represents a set consisting of integers, i.e. Denotes the set of residual classes modulo q, i.e. Where q is a positive integer; for any positive integer n, Represents n items The direct product, i.e. Denotes the set of residual classes modulo Q, i.e. Where Q is a positive integer; Represents n items The direct product of.

[0047] make It is a positive integer, R is defined in A polynomial ring of degree N-1, R q It is defined in A polynomial ring of degree N-1, R Q It is defined in A polynomial ring of degree N-1; It is defined in A polynomial ring of degree n-1, It is defined in A polynomial ring of degree n-1 on the polynomial ring. It is defined in A polynomial ring of degree n-1.

[0048] For a distribution D, x←D means to randomly select x according to distribution D; for a finite set S, x←S means to uniformly and randomly select x from set S.

[0049] For real numbers Represents the integer closest to x.

[0050] The symbol := represents assignment, that is, for any two values ​​a and b, a:=b means that a is assigned as b.

[0051] The constant NTRU encryption method is an encryption scheme defined in this application. For the encrypted message polynomial u, a private key f is extracted from the private key distribution, and g is extracted from the error distribution. Based on two integer parameters (τ, Δ), a constant NTRU ciphertext is output.

[0052] NTRU Q,f,τ,△ (u):=τ·g / f+△·u / f∈R Q .

[0053] The vector NTRU encryption method is an encryption method defined in this application. For the message polynomial v to be encrypted, let... Extract the private key f from the private key distribution, and extract g0,…,g from the error distribution. d-1 Output vector NTRU ciphertext:

[0054]

[0055] Ciphertext cross product is an operation defined in this application. In this application, "⊙" represents the ciphertext cross product operation. For a ring element c∈R... Q With vector NTRU ciphertext The ciphertext outer product operation between the two is described as follows:

[0056]

[0057] Where, for a∈R Q , This represents the bit decomposition under basis B, where the vector satisfies And ||a i || ∞ <B。

[0058] This application defines a key switching algorithm based on constant NTRU ciphertext, including a key switching key generation method and a key switching method. The key switching key generation method KSG(f1,f2) is as follows: obtain the private key f1,f2∈R. Q The key switching key is calculated. in, The following calculation was performed:

[0059]

[0060] Key switching method To obtain the constant NTRU ciphertext of the message polynomial u encrypted under key f1. And obtain the corresponding key switching key. The result was obtained by using the ciphertext outer product operation. in, This is the constant NTRU ciphertext of the message polynomial u encrypted under key f2.

[0061] This application defines an automorphic method based on constant NTRU ciphertext. First, an automorphic key is generated using the key generation method AutoKGen(t,f), for example, by inputting an odd number. and private key f∈R Q Output the isomorphic key ksk t Among them, ksk t =KSG(ψ) t (f),f)=KSG((f(X t ),f(X)),ψ t (X) represents the isomorphism X→X t Then, based on the following automorphism method EvalAuto(c,ksk) t )Sure Input is a constant NTRU ciphertext of the message polynomial u encrypted under f. and the corresponding automorphic key ksk t Calculate ψ t (c)=c(X t ), and calculate Obtaining automorphism results

[0062] Figure 2 This is a flowchart illustrating the homomorphic decryption method provided in an embodiment of the present invention, as shown below. Figure 2 As shown, the method includes the following steps:

[0063] Step S202: Obtain the first LWE ciphertext and the private key of the first LWE ciphertext, wherein the first LWE ciphertext is the ciphertext to be homomorphically decrypted in the first layer of the homomorphic encryption scheme.

[0064] The first LWE ciphertext can be represented as: Where a and b are two parts of the first LWE ciphertext, a = (a0, ..., a n-1 The private key of the first LWE ciphertext can be represented as: m represents the message polynomial before encryption corresponding to the first LWE ciphertext, and noised(m) represents the encoding method of noise and message in the first LWE ciphertext. When the noise in the first LWE ciphertext is too large, the LWE ciphertext can no longer be decrypted. Therefore, the homomorphic decryption method provided in this application is needed to perform homomorphic decryption on the LWE ciphertext with excessive noise to obtain a constant NTRU ciphertext with reduced noise, so that the original message polynomial m can be decrypted based on the noise-reduced constant NTRU ciphertext.

[0065] Step S204: Determine the NTRU private key and the rotation polynomial, wherein the NTRU private key is used to decrypt the NTRU ciphertext in the second layer of the homomorphic encryption scheme. The NTRU private key can be the private key f, f∈R, of the NTRU-based GSW-like encryption scheme in the second layer of the fully homomorphic encryption framework. Q Based on the scheme of this application, the first LWE ciphertext can be homomorphically decrypted into the target NTRU ciphertext corresponding to the NTRU private key. The rotation polynomial can be represented by r and is used to rotate the key in the blind rotation method.

[0066] Step S206: Based on the private key and NTRU private key of the first LWE ciphertext, generate the evaluation key corresponding to the blind rotation algorithm. The evaluation key includes multiple automorphic keys and multiple computation keys. The multiple automorphic keys are key switching keys used for automorphism. The multiple automorphic keys are obtained by encrypting the automorphized NTRU private key with the NTRU private key using the vector NTRU encryption method. The multiple computation keys are obtained by encrypting the private key of the first LWE ciphertext with the NTRU private key using the vector NTRU encryption method.

[0067] It should be noted that the blind rotation algorithm in the above steps is a homomorphic decryption method used to reduce ciphertext noise, and the evaluation key is an auxiliary parameter required in the ciphertext bootstrapping process.

[0068] As an optional embodiment, the multiple computation keys in the evaluation key corresponding to the blind rotation algorithm can be generated based on the following steps: encrypting the component s0 in the private key of the first LWE ciphertext according to the ciphertext modulus of the NTRU ciphertext corresponding to the NTRU private key, the NTRU private key, and the first parameter in the integer pair, to obtain the evk0 key among the multiple computation keys, where the private key of the first LWE ciphertext is s. Based on the ciphertext modulus of the NTRU ciphertext corresponding to the NTRU private key, the NTRU private key, and the first parameter, the component s in the private key s of the first LWE ciphertext is... i Encryption is performed separately to obtain evk from multiple computation keys. i A key, where 1 ≤ i < n; based on the ciphertext modulus of the NTRU ciphertext corresponding to the NTRU private key, the NTRU private key, and the first parameter, the sum of the components in the private key s of the first LWE ciphertext is encrypted to obtain evk from multiple computation keys. n Key.

[0069] Optionally, the encryption scheme given in the above optional embodiments can be instantiated using integer pairs (τ, Δ). Specifically, for the ciphertext modulus Q and the message modulus t, and the encoding function noised(m) for the message m, the following settings are made: Where τ represents the first parameter and Δ represents the second parameter.

[0070] As an optional implementation, the evk0 key, evk i Key and evk n The key is calculated using the following formula:

[0071]

[0072] Among them, NTRU' Q,f,τ () represents the vector NTRU encryption method. The calculation formula for the vector NTRU encryption method is as follows:

[0073] NTRU′ Q,f,τ (v):=(τ·g0 / f+B 0 ·v,…,τ·g d-1 / f+B d-1 ·v)

[0074] In the formula, v represents the data to be encrypted, Q represents the ciphertext modulus of the NTRU ciphertext corresponding to the NTRU private key, and f represents the NTRU private key f∈R extracted from the private key distribution. Q g0 to g d-1 Let g0,, ..., gn represent the error polynomials drawn from the error distribution. d-1 ←R Qτ represents the first parameter in the integer pair, B represents a positive integer, and d = log0 B Q".

[0075] As an optional embodiment, multiple self-similar keys in the evaluation key corresponding to the blind rotation algorithm can also be generated as follows: Determine parameter j, where parameter j represents the number of times the private key is mapped during the self-similar process; generate multiple self-similar keys based on the ciphertext modulus of the NTRU ciphertext corresponding to the NTRU private key, the NTRU private key, and the first parameter in the integer pair, according to the following formula:

[0076]

[0077] Among them, ksk j Describing multiple automorphic keys, f(X) j ) represents the NTRU private key after self-isolation, f(X) represents the NTRU private key, q represents the ciphertext modulus of the first LWE ciphertext, and NTRU' Q,f,τ () denotes the vector NTRU encryption method, and N represents the degree of the polynomial ring corresponding to the target NTRU ciphertext.

[0078] Furthermore, the evaluation key EVK corresponding to the blind rotation algorithm can be determined. τ,△ The evaluation key is in the form of EVK. τ,△ =(evk0,…,evk) n ,{ksk j} j∈S The evaluation key constructed using the above optional implementation method is an NTRU-based key, which is superior to the traditional RLWE-based evaluation key in terms of storage. The NTRU-based evaluation key is shorter and more efficient to use.

[0079] Step S208: Based on the rotation polynomial, evaluation key and blind rotation algorithm, homomorphically decrypt the first LWE ciphertext to obtain the target NTRU ciphertext, wherein the target NTRU ciphertext corresponds to the NTRU private key and is the NTRU ciphertext in the second layer of homomorphic encryption scheme.

[0080] As an optional embodiment, the process of homomorphically decrypting the first LWE ciphertext based on a rotation polynomial, an evaluation key, and a blind rotation algorithm to obtain the target NTRU ciphertext may include the following steps:

[0081] Step 1: Based on the first LWE ciphertext, determine the multiple odd numbers w. i The first LWE ciphertext is represented as m represents the plaintext corresponding to the first LWE ciphertext, and a = (a0, ..., a0) n-1 For each a in ai ,

[0082] Step 2: Calculation We obtain the constant NTRU ciphertext c0(X), where △ represents the second parameter in the integer pair, r represents the rotation polynomial, and ⊙ represents the ciphertext outer product. The ciphertext outer product is based on the following formula, which represents the operation between the ring element c and the vector NTRU ciphertext c′ to obtain a new ring element:

[0083] c⊙c′= <BitDecom B (c),c′>, This means that for a∈R Q The bit decomposition vector under basis B satisfies And ||a i || ∞ <B,c∈R Q , where c′ represents the ciphertext obtained by encrypting using the vector NTRU encryption method.

[0084] Specifically, for constant NTRU ciphertext c = NTRU Q,f,τ,△ (u) and the vector NTRU ciphertext c′=NTRU′ Q,f,τ (v), the result of the ciphertext outer product is:

[0085]

[0086] Step 3: Calculation We obtain the constant NTRU ciphertext c0′(X), where NTRU Q,f,τ,△ () represents the constant NTRU encryption method. The calculation formula for the constant NTRU encryption method is: NTRU Q,f,τ,△ (u):=τ·g / f+△·u / f, Q represents the ciphertext modulus of the NTRU ciphertext corresponding to the NTRU private key, and f represents the NTRU private key f∈R extracted from the private key distribution. Q , g represents the error drawn from the error distribution g∈R Q , u represents the data to be encrypted, τ represents the first parameter in the integer pair, and △ represents the second parameter in the integer pair.

[0087] Step 4: Calculation Obtain constant NTRU ciphertext in, It is one of several automorphic keys.

[0088] Step 5: Ciphertext based on constant NTRU evk i The key and multiple self-similar keys are used to process the constant NTRU ciphertext according to steps two through four. By iterating, the constant NTRU ciphertext is obtained.

[0089] As an optional embodiment, the execution process of step five may include the following steps:

[0090] 1) For 1≤i≤n-1, calculate

[0091] 2) Calculation

[0092] 3) Calculation in, It is one of several automorphic keys.

[0093] Step Six: Contain constant NTRU ciphertext With evk n The key is used to perform a ciphertext outer product to obtain the target NTRU ciphertext.

[0094] In the above steps, a small evaluation key is generated based on the private key of the LWE ciphertext of the first layer in the fully homomorphic encryption scheme and the NTRU private key. Then, the evaluation key is used to homomorphically decrypt the LWE ciphertext of the first layer into NTRU ciphertext with reduced noise. This achieves the goal of quickly reducing the noise in the first LWE ciphertext, thereby improving the bootstrap efficiency in the NTRU-based fully homomorphic encryption and decryption scheme. This solves the technical problem of low bootstrap efficiency of fully homomorphic ciphertexts in related technologies.

[0095] As an optional embodiment, the above homomorphic decryption method can be applied to an efficient bootstrapping scheme for ciphertext. For a homomorphic encryption / decryption scheme where the first layer is LWE ciphertext, the bootstrapping process can include the following steps: Given that the ciphertext modulus of the first LWE ciphertext is q and the ciphertext modulus of the target NTRU ciphertext is Q, extract a constant term from the target NTRU ciphertext to obtain a second LWE ciphertext with a ciphertext modulus of Q; perform modulus switching on the second LWE ciphertext to obtain a third LWE ciphertext with a ciphertext modulus of q; perform key switching on the third LWE ciphertext to obtain a fourth LWE ciphertext, wherein the ciphertext modulus of the fourth LWE ciphertext is q, and the private key corresponding to the fourth LWE ciphertext is the same as the private key of the first LWE ciphertext. The first LWE ciphertext is the first-layer LWE ciphertext, and the noise in the first LWE ciphertext needs to be reduced, therefore, bootstrapping noise reduction is required. The first LWE ciphertext can be represented as: Where, a = (a0, ..., a n-1 ), s=(s0,…,s n-1 ).

[0096] Through the above optional embodiments, the target NTRU ciphertext with a ciphertext modulus of Q obtained by homomorphically decrypting the first LWE ciphertext can be processed to output a fourth LWE ciphertext with a ciphertext modulus of q. The private key corresponding to the fourth LWE ciphertext is the same as the private key of the first LWE ciphertext, so that the user can decrypt the fourth LWE ciphertext using the private key corresponding to the first LWE ciphertext, thus completing the efficient bootstrapping of the LWE ciphertext.

[0097] Optionally, a constant term is extracted from the target NTRU ciphertext to obtain a second LWE ciphertext with a ciphertext modulus of Q, including: for the target NTRU ciphertext c 目标 =τ·g / f+△·m / f, according to the polynomial c 目标 The coefficients c = (c0,…,c N-1 The coefficients of f and f Sure This is the second LWE ciphertext used to encrypt message m under the private key f. Message m is also a message encrypted with the first LWE ciphertext. The target NTRU ciphertext is represented as c. 目标 It can also be represented as ACC.

[0098] As an optional embodiment, the process of mod-switching the second LWE ciphertext may include the following steps: calculating ModSwitch(LWE) Q,f (m),q)=「LWE Q,f (m)·q / Q” mod q, to ​​obtain the third LWE ciphertext LWE with ciphertext modulus q and corresponding private key f. q,f (m), where LWE Q,f (m) indicates the second LWE ciphertext.

[0099] As an optional embodiment, the process of key switching on the third LWE ciphertext to obtain the fourth LWE ciphertext may include the following steps:

[0100] Based on the ciphertext modulus q and integer B of the first LWE ciphertext ks ,calculate

[0101] Sure And determine e from the error distribution i,j,v ,in,

[0102] Based on the private key f = (f0, ..., f) of the third LWE ciphertext N-1 The private key s∈(s0,…,s) of the first LWE ciphertext n-1 ), a i,j,v and e i,j,v The key switching key is calculated. in,

[0103]

[0104] According to the third LWE ciphertext and formula break down Obtain vector in,

[0105] calculate Obtain the fourth LWE ciphertext

[0106] As an optional embodiment, this application provides the following four sets of bootstrap algorithm parameters and corresponding experimental results as shown in Table 1. Those skilled in the art will understand that embodiments capable of implementing the homomorphic decryption method proposed in this application are not limited to the following four implementation methods.

[0107] Table 1

[0108] Parameter set Private key distribution <![CDATA[(n,q,N,Q,B,Q ks ,B ks )]]> Decryption error rate Target security strength P128T Tripartite distribution <![CDATA[(512,1024,1024,2 19.9 ,2 4 ,2 14 ,2 7 )]]> <![CDATA[2 -32 ]]> 128 P128G Gaussian distribution <![CDATA[(465,1024,1024,2 19.9 ,2 4 ,2 14 ,2 7 )]]> <![CDATA[2 -34 ]]> 128 P192T Tripartite distribution <![CDATA[(1024,1024,2048,2 25.4 ,2 9 ,2 19 ,28)]]> <![CDATA[2 -53 ]]> 192 P192G Gaussian distribution <![CDATA[(870,1024,2048,2 25.4 ,2 9 ,2 17 ,28)]]> <![CDATA[2 -42 ]]> 192

[0109] As an optional embodiment, the above homomorphic decryption method can also be applied to a fully homomorphic encryption and decryption scheme where the first layer is RLWE ciphertext. Optionally, efficient bootstrapping can be performed on RLWE ciphertext in the following manner:

[0110] Obtain the initial RLWE ciphertext RLWE q,s (m R )=(a R ,b R ), wherein the initial RLWE ciphertext is ciphertext encrypted using the same private key as the first LWE ciphertext; based on the initial RLWE ciphertext, a is determined. R =(a R0 ,…,a R(n-1) ), s=(s0,…,s n-1 ),m R =(m R0 ,…,m R(n-1) ) is a R s and m R The coefficients are extracted from the initial RLWE ciphertext to obtain multiple m encrypted with the private key s. Ri Initial LWE ciphertext LWE q,s (m Ri )=(a Ri ,b RiThe process involves: initial LWE ciphertext including first LWE ciphertext and multiple fifth LWE ciphertexts; applying a blind rotation algorithm to each of the multiple fifth LWE ciphertexts to obtain multiple NTRU ciphertexts that correspond one-to-one with each of the multiple fifth LWE ciphertexts; extracting multiple sixth LWE ciphertexts from each of the multiple NTRU ciphertexts that correspond one-to-one with each of the multiple fifth LWE ciphertexts; extracting second LWE ciphertexts from the target NTRU ciphertext; and packaging the second LWE ciphertexts and the multiple sixth LWE ciphertexts together to obtain the target RLWE ciphertext.

[0111] The following embodiment illustrates the implementation flow of a bootstrapping scheme for RLWE ciphertext, for RLWE ciphertext encrypted with private key s. Let a R =(a R0 ,…,a R(n-1) ), s=(s0,…,s n-1 ), for The coefficient.

[0112] Step 1: Extract n bytes of m encrypted with private key s from the RLWE ciphertext. Ri LWE ciphertext LWE q,s (m Ri )=(a Ri ,b Ri ), where the n LWE ciphertexts may include the first LWE ciphertext and the fifth LWE ciphertext in the above homomorphic decryption method.

[0113] Step 2: Apply the homomorphic decryption method provided in the above embodiments or optional embodiments of this application to the above n LWE ciphertexts respectively, and perform blind rotation on the above n LWE ciphertexts in sequence to obtain n ACCs corresponding to the n LWE ciphertexts respectively. i , among which, ACC i This represents the NTRU ciphertext obtained by blindly rotating the i-th LWE ciphertext among the above n LWE ciphertexts.

[0114] Step 3: From each ACC i Extract the encryption and encrypt m in modulus Q Ri LWE ciphertext LWE Q,f (m Ri ), to obtain n ACC i Each corresponds to n new LWE ciphertexts, which may include the second LWE ciphertext and the sixth LWE ciphertext in the above homomorphic decryption method.

[0115] Step 4: Package the n new LWE ciphertexts into a single target RLWE ciphertext. The packaging process is described below:

[0116] PackKGen(f,s): Input vector and ring elements For all Extract And sample from the error distribution Then calculate

[0117] Output RPK τ ={rpk j,k}

[0118] Pack({LWE Q,f (m Ri )},RPK τ For 0 ≤ i ≤ n-1, in Enter the packaging key RPK τ ={rpk j,k First calculate Where 0≤j≤N-1, then calculate satisfy calculate and output Where (u,v) represents the target RLWE ciphertext obtained by packaging.

[0119] Based on the blind rotation algorithm proposed in this application, a new efficient quantum-secure bootstrap algorithm is designed. The bootstrap algorithm proposed in this application has the following characteristics and advantages: (1) Small evaluation key size: Compared with the homomorphic algorithms disclosed in the prior art, the homomorphic decryption method proposed in this application has a shorter evaluation key. (2) High computational efficiency: The bootstrap algorithm proposed in this invention requires fewer multiplications in the homomorphic decryption process. (3) Support for arbitrary private key distribution: The choice of the first-layer ciphertext private key will not affect the performance of the homomorphic encryption and decryption algorithm proposed in this application, and the private key distribution can be flexibly selected to adjust the system parameters.

[0120] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to the present invention.

[0121] Through the above description of the embodiments, those skilled in the art can clearly understand that the homomorphic decryption method according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platform. Of course, it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods of the various embodiments of the present invention.

[0122] According to embodiments of the present invention, a homomorphic decryption apparatus for implementing the above-described homomorphic decryption method is also provided. Figure 3 This is a structural block diagram of a homomorphic decryption device provided according to an embodiment of the present invention, such as... Figure 3 As shown, the homomorphic decryption device includes: an acquisition module 32, a determination module 34, a generation module 36, and a homomorphic decryption module 38. The homomorphic decryption device will be described below.

[0123] The acquisition module 32 is used to acquire the first LWE ciphertext and the private key of the first LWE ciphertext, wherein the first LWE ciphertext is the ciphertext to be homomorphically decrypted in the first layer of homomorphic encryption scheme;

[0124] The determination module 34, connected to the acquisition module 32, is used to determine the NTRU private key and the rotation polynomial, wherein the NTRU private key is used to decrypt the NTRU ciphertext in the second layer of homomorphic encryption.

[0125] The generation module 36, connected to the determination module 34, is used to generate an evaluation key corresponding to the blind rotation algorithm based on the private key and NTRU private key of the first LWE ciphertext. The evaluation key includes multiple automorphic keys and multiple computation keys. The multiple automorphic keys are key switching keys used for automorphism. The multiple automorphic keys are obtained by encrypting the automorphic NTRU private key with the NTRU private key using the vector NTRU encryption method. The multiple computation keys are obtained by encrypting the private key of the first LWE ciphertext with the NTRU private key using the vector NTRU encryption method.

[0126] The homomorphic decryption module 38, connected to the aforementioned generation module 36, is used to homomorphically decrypt the first LWE ciphertext based on the rotation polynomial, evaluation key, and blind rotation algorithm to obtain the target NTRU ciphertext. The target NTRU ciphertext corresponds to the NTRU private key and is the NTRU ciphertext in the second layer of the homomorphic encryption scheme.

[0127] It should be noted that the acquisition module 32, determination module 34, generation module 36, and homomorphic decryption module 38 mentioned above correspond to steps S202 to S208 in the embodiments. The four modules and their corresponding steps implement the same instances and application scenarios, but are not limited to the content disclosed in the above embodiments. It should also be noted that the above modules, as part of the device, can run in the computer terminal 10 provided in the embodiments.

[0128] Embodiments of the present invention may provide a computer device. Optionally, in this embodiment, the computer device may be located in at least one of a plurality of network devices in a computer network. The computer device includes a memory and a processor.

[0129] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the homomorphic decryption method and apparatus in this embodiment of the invention. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby realizing the aforementioned homomorphic decryption method. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to a computer terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0130] The processor can invoke information and application programs stored in the memory via the transmission device to perform the following steps: obtaining a first LWE ciphertext and its private key, wherein the first LWE ciphertext is the ciphertext to be homomorphically decrypted in the first layer of homomorphic encryption; determining the NTRU private key and the rotation polynomial, wherein the NTRU private key is used to decrypt the NTRU ciphertext in the second layer of homomorphic encryption; determining the NTRU private key and the rotation polynomial, wherein the NTRU private key is used to decrypt the NTRU ciphertext in the second layer of homomorphic encryption; and homomorphically decrypting the first LWE ciphertext based on the rotation polynomial, the evaluation key, and the blind rotation algorithm to obtain the target NTRU ciphertext, wherein the target NTRU ciphertext corresponds to the NTRU private key and is the NTRU ciphertext in the second layer of homomorphic encryption.

[0131] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a non-volatile storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, etc.

[0132] Embodiments of the present invention also provide a non-volatile storage medium. Optionally, in this embodiment, the aforementioned non-volatile storage medium can be used to store the program code executed by the homomorphic decryption method provided in the above embodiments.

[0133] Optionally, in this embodiment, the non-volatile storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0134] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: obtaining a first LWE ciphertext and a private key for the first LWE ciphertext, wherein the first LWE ciphertext is the ciphertext to be homomorphically decrypted in the first layer of homomorphic encryption; determining the NTRU private key and a rotation polynomial, wherein the NTRU private key is used to decrypt the NTRU ciphertext in the second layer of homomorphic encryption; determining the NTRU private key and a rotation polynomial, wherein the NTRU private key is used to decrypt the NTRU ciphertext in the second layer of homomorphic encryption; and homomorphically decrypting the first LWE ciphertext based on the rotation polynomial, the evaluation key, and the blind rotation algorithm to obtain the target NTRU ciphertext, wherein the target NTRU ciphertext corresponds to the NTRU private key and is the NTRU ciphertext in the second layer of homomorphic encryption.

[0135] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0136] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0137] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0138] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0139] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0140] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a non-volatile storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0141] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method of homomorphic decryption, the method comprising: The method comprises: obtaining a first LWE ciphertext and a private key of the first LWE ciphertext, wherein the first LWE ciphertext is a ciphertext to be homomorphic decrypted in a homomorphic encryption first-layer scheme; determining an NTRU private key and a rotation polynomial, wherein the NTRU private key is used for decrypting an NTRU ciphertext in a homomorphic encryption second-layer scheme; generating an evaluation key corresponding to a blind rotation algorithm according to the private key of the first LWE ciphertext and the NTRU private key, wherein the evaluation key comprises a plurality of auto-isomorphic keys and a plurality of calculation keys, the plurality of auto-isomorphic keys are key switching keys for auto-isomorphism, the plurality of auto-isomorphic keys are obtained by encrypting an auto-isomorphic NTRU private key based on a vector NTRU encryption method using the NTRU private key, and the plurality of calculation keys are obtained by encrypting the private key of the first LWE ciphertext based on the vector NTRU encryption method using the NTRU private key respectively; performing homomorphic decryption on the first LWE ciphertext based on the rotation polynomial, the evaluation key and the blind rotation algorithm to obtain a target NTRU ciphertext, wherein the target NTRU ciphertext corresponds to the NTRU private key, and the target NTRU ciphertext is an NTRU ciphertext in the homomorphic encryption second-layer scheme; wherein the plurality of computation keys are generated based on the following steps: encrypting components in the private key s of the first LWE ciphertext according to a ciphertext modulus of an NTRU ciphertext corresponding to the NTRU private key, the NTRU private key, and a first parameter in an integer pair i respectively, and encrypting a sum of the components in the private key s of the first LWE ciphertext to obtain evk i , wherein 0≤i n , wherein 0≤i wherein denotes a set consisting of integers, denotes a set consisting of residues modulo , i.e. wherein is a positive integer; for any positive integer , denotes a direct product of ​ wherein the plurality of auto-isomorphic keys are generated based on the following steps: determining a parameter j, wherein the parameter j represents the number of times of mapping the private key in the auto-isomorphism process; and generating the plurality of auto-isomorphic keys based on the following formula: ; Wherein, f represents the NTRU private key extracted from the private key distribution , wherein, is a polynomial ring defined on , N is a positive integer, , the number of times is , represents the set composed of the modulus , that is , wherein is a positive integer, , represents the plurality of automorphism keys, , represents the NTRU private key after the automorphism, , represents the NTRU private key, q represents the ciphertext modulus of the first LWE ciphertext, , represents the vector NTRU encryption method, N represents the number of polynomial rings corresponding to the target NTRU ciphertext.

2. The method of claim 1, wherein, The evk i The key and the evk n The key is calculated by the following formula: when i = 0, when 0 < i < n, , ; wherein, represents the vector NTRU encryption method, and the calculation formula of the vector NTRU encryption method is as follows: , v represents the data to be encrypted, Q represents the ciphertext modulus of the NTRU ciphertext corresponding to the NTRU private key, g0 to g d-1 represents an error polynomial extracted from an error distribution , represents the first parameter in the integer pair, and B represents a positive integer, .

3. The method of claim 1, wherein, the homomorphic decryption on the first LWE ciphertext based on the rotation polynomial, the evaluation key and the blind rotation algorithm to obtain the target NTRU ciphertext comprises: Step one: determining a plurality of odd numbers w according to the first LWE ciphertext i wherein the first LWE ciphertext is expressed as m represents a plaintext corresponding to the first LWE ciphertext, for each a in a i , , ; Step two: computation , resulting in constant NTRU ciphertext wherein, denotes the second parameter of the integer pair, r denotes the rotation polynomial, denotes the ciphertext outer product, which is expressed based on the following formula: the ring element c is operated with the vector NTRU ciphertext to obtain a new ring element: , denotes that for , the bit decomposition vector under the basis satisfies and , , the vector NTRU ciphertext denotes the ciphertext obtained by encrypting through the vector NTRU encryption method; Step three: calculation , to obtain constant NTRU ciphertext , wherein, denotes the constant NTRU encryption method, and the calculation formula of the constant NTRU encryption method is: , Q denotes the ciphertext modulus of the NTRU ciphertext corresponding to the NTRU private key, f denotes the NTRU private key extracted from the private key distribution , g denotes the error extracted from the error distribution , u denotes the data to be encrypted, denotes the first parameter in the integer pair, denotes the second parameter in the integer pair; Step four: computation , resulting in a constant NTRU ciphertext wherein, is one of the plurality of automorphism keys; Step five: Iterating the constant NTRU ciphertext based on the constant NTRU ciphertext , the evk i , the key and the plurality of automorphism keys according to steps two to four to obtain a constant NTRU ciphertext ; and ​ Step six: take the outer product of the constant NTRU ciphertext with the evk n key to obtain the target NTRU ciphertext.

4. The method of claim 3, wherein, The constant NTRU ciphertext is based on the constant NTRU ciphertext , the evk i , the key and the plurality of automorphism keys, and the constant NTRU ciphertext is obtained by iterating the constant NTRU ciphertext , including: For , compute ; Computing ; Computing wherein, is one of the plurality of automorphism keys.

5. The method according to any one of claims 1 to 4, characterized in that, The method further comprises: in the case that the ciphertext modulus of the first LWE ciphertext is q and the ciphertext modulus of the target NTRU ciphertext is Q, extracting a constant term from the target NTRU ciphertext to obtain a second LWE ciphertext with a ciphertext modulus of Q; performing modulus switching on the second LWE ciphertext to obtain a third LWE ciphertext with a ciphertext modulus of q; performing key switching on the third LWE ciphertext to obtain a fourth LWE ciphertext, wherein the ciphertext modulus of the fourth LWE ciphertext is q, and the private key corresponding to the fourth LWE ciphertext is the same as the private key of the first LWE ciphertext.

6. The method of claim 5, wherein, the extracting of the constant term from the target NTRU ciphertext to obtain the second LWE ciphertext with the ciphertext modulus of Q comprises: For the target NTRU ciphertext , according to the coefficient of the polynomial and the coefficient of the polynomial , determine is the second LWE ciphertext of the encrypted message under the private key , and the message m is also the message encrypted by the first LWE ciphertext, wherein g represents an error drawn from an error distribution , represents the first parameter in the integer pair, represents the second parameter in the integer pair.

7. The method of claim 6, wherein, the modulus switching on the second LWE ciphertext to obtain the third LWE ciphertext with the ciphertext modulus of q comprises: Computing the third LWE ciphertext with the ciphertext modulus q and corresponding to the private key wherein denotes the second LWE ciphertext.

8. The method of claim 7, wherein, the key switching on the third LWE ciphertext to obtain the fourth LWE ciphertext comprises: According to a ciphertext modulus q of the first LWE ciphertext and an integer , compute ; determining and determining wherein, ; a private key of the third LWE ciphertext a private key of the first LWE ciphertext 、 and a key switching key is computed wherein, ， ； According to the third LWE ciphertext and the formula decomposition , get the vector , wherein ; Computing , obtaining the fourth LWE ciphertext .

9. The method according to any one of claims 1 to 4, characterized in that, further comprising: obtaining an initial RLWE ciphertext wherein the initial RLWE ciphertext is a ciphertext encrypted with a same private key as a private key of the first LWE ciphertext; Based on the initial RLWE ciphertext, determine for The coefficients are extracted from the initial RLWE ciphertext using multiple private keys. Encryption Initial LWE ciphertext The initial LWE ciphertext includes the first LWE ciphertext and a plurality of fifth LWE ciphertexts; using the blind rotation algorithm on the plurality of fifth LWE ciphertexts respectively to obtain a plurality of NTRU ciphertexts corresponding to the plurality of fifth LWE ciphertexts one by one; extracting a plurality of sixth LWE ciphertexts from the plurality of NTRU ciphertexts corresponding to the plurality of fifth LWE ciphertexts one by one; extracting a second LWE ciphertext from the target NTRU ciphertext; The second LWE ciphertext and the plurality of sixth LWE ciphertexts are packed to obtain a target RLWE ciphertext.

10. A homomorphic decryption device, characterized in that, The method comprises the following steps: An acquisition module is configured to acquire a first LWE ciphertext and a private key of the first LWE ciphertext, wherein the first LWE ciphertext is a ciphertext to be homomorphic decrypted in a first homomorphic encryption scheme; A determination module is configured to determine an NTRU private key and a rotation polynomial, wherein the NTRU private key is used to decrypt an NTRU ciphertext in a second homomorphic encryption scheme; A generation module is configured to generate an evaluation key corresponding to a blind rotation algorithm according to the private key of the first LWE ciphertext and the NTRU private key, wherein the evaluation key comprises a plurality of automorphism keys and a plurality of calculation keys, the plurality of automorphism keys are key switching keys used for automorphism, the plurality of automorphism keys are obtained by encrypting an NTRU private key after automorphism based on a vector NTRU encryption method using the NTRU private key, and the plurality of calculation keys are obtained by encrypting the private key of the first LWE ciphertext based on the vector NTRU encryption method using the NTRU private key respectively; A homomorphic decryption module is configured to homomorphic decrypt the first LWE ciphertext based on the rotation polynomial, the evaluation key and the blind rotation algorithm to obtain a target NTRU ciphertext, wherein the target NTRU ciphertext corresponds to the NTRU private key, and the target NTRU ciphertext is an NTRU ciphertext in the second homomorphic encryption scheme. The generating module is further configured to encrypt the components in the private key s of the first LWE ciphertext according to the ciphertext modulus of the NTRU ciphertext corresponding to the NTRU private key, the NTRU private key, and the first parameter in the integer pair, to obtain the components in the private key s of the first LWE ciphertext i respectively, and encrypt the sum of the components in the private key s of the first LWE ciphertext to obtain the evk in the plurality of calculation keys i key and evk n key, wherein 0≤i wherein denotes a set consisting of integers, denotes a set consisting of residues modulo , i.e. wherein is a positive integer; for any positive integer , denotes the direct product of .​ The generation module is further configured to determine a parameter j, wherein the parameter j represents a number of times of mapping the private key in the automorphism process; and generate the plurality of automorphism keys based on the following formula: ; wherein f represents the NTRU private key drawn from the private key distribution wherein, is a polynomial ring defined on with the degree of N being a positive integer, represents a set consisting of the residue classes modulo , i.e. wherein is a positive integer, represents the plurality of automorphism keys, represents the NTRU private key after the automorphism, represents the NTRU private key, and q represents a ciphertext modulus of the first LWE ciphertext, represents the vector NTRU encryption method, and N represents the degree of the polynomial ring corresponding to the target NTRU ciphertext.

11. A non-volatile storage medium, comprising: The non-volatile storage medium comprises a stored program, wherein the program controls the homomorphic decryption method in any one of claims 1 to 9 to be executed when the program is run by a device in which the non-volatile storage medium is located.

12. A computer device, comprising: The computer device comprises a memory and a processor, the memory is configured to store a program, and the processor is configured to run the program stored in the memory, wherein the program executes the homomorphic decryption method in any one of claims 1 to 9 when the program is run.

Images