A privacy protection method and system based on homomorphic authenticated encryption

Abstract

The present invention discloses a privacy protection method and system based on homomorphic authentication encryption, which belongs to the field of digital medicine. The method includes initializing the system and the medical cloud server; the medical data center encrypts the trained diagnostic model and uploads it to the medical cloud server; after the system user obtains authorization, the personal privacy data collected by the wearable device is extracted to form its query vector and then sent to the medical cloud server. The medical cloud server calculates in a ciphertext state and sends the result back to the user. The user decrypts to obtain the final result and completes the online medical service. The homomorphic authentication encryption algorithm proposed in the present invention uses this algorithm to achieve bilateral privacy protection and authenticity. By using this algorithm, the privacy and integrity of the user privacy, the medical data center data and the diagnostic results are ensured at the same time. And because the algorithm is simple, it can be implemented in many lightweight terminals, which is more user-friendly.

Description

Technical Field

[0001] The present invention relates to the field of smart medical care, and in particular to a homomorphic authentication encryption method for maintaining data privacy and authenticity in online medical care. Background Art

[0002] In recent years, cloud computing has become widely used in various fields, particularly in healthcare. Cloud healthcare is gaining increasing acceptance, and users are becoming increasingly accustomed to seeking online medical services. This is due to the continuous development of machine learning, which is improving the accuracy of learning models. If machine learning results from large amounts of sensitive data from multiple users in a medical system can be utilized, the corresponding learning models can achieve online diagnosis and prediction. For example, infectious disease prevention and control requires nucleic acid testing of specific populations. If personnel go directly to the hospital for examination and diagnosis, the crowds generated at the testing site can easily lead to cross-infection. If users can complete testing, consultation, and diagnosis remotely through the platform, they can receive immediate medical services while avoiding the risk of cross-infection caused by crowded gatherings. During the infectious disease prevention and control period, the advantages of cloud healthcare have been even more evident.

[0003] As the number of online services continues to grow, security concerns about data storage and computing in the cloud are frequently raised, and service quality, including security requirements, are also increasing. We strive to provide the convenience of cloud services while ensuring data security, especially for sensitive information like personal medical information. It's important to note that the accuracy of predictions is proportional to the amount of data. The more personal medical data a user has, the more accurate the predictions, resulting in higher accuracy. Therefore, it's important to consider the trade-off between the privacy of data and training model parameters and the accuracy of the results. The scenario we're considering is similar to a medical data center like a hospital, which holds a large amount of user private data. System users want to protect the privacy of their personal data while also benefiting from the predictions of the learning model. Ideally, we would encrypt private data and upload it to the cloud for computation and analysis, without having to hand over plaintext or encryption keys to an untrusted third party like the cloud.

[0004] Homomorphic encryption algorithms preserve the algebraic relationship between ciphertext and plaintext operations. These algorithms can support function evaluation using only ciphertext, without exposing plaintext data or keys to the cloud or service provider server. This is highly compatible with privacy protection requirements in cloud services. Similar solutions use homomorphic encryption algorithms to ensure confidentiality, but current cloud service applications that utilize homomorphic encryption algorithms are still relatively rare. This is because homomorphic encryption algorithms, including the encryption and bootstrapping processes, often result in significant ciphertext expansion, which is currently prohibitive. Furthermore, data authenticity should be considered. If a system performs extensive computations and an attacker compromises data integrity, meaningful results are impossible, wasting significant computational resources and communication costs. One implementation approach is to use both homomorphic encryption and homomorphic signature algorithms. However, combining current homomorphic algorithms is impractical due to prohibitive computational costs and practical applications. Another symmetric algorithm, homomorphic authenticated encryption, can simultaneously ensure the integrity of both homomorphic encryption operations and data, thereby reducing the computational burden. Summary of the Invention

[0005] In order to overcome the deficiencies of the above-mentioned prior art, the present invention proposes an online medical privacy protection method and system based on logistic regression. The present invention proposes a homomorphic authentication encryption algorithm, which is not completely homomorphic, but partially homomorphic, but we have proved that the algorithm is secure, and based on this algorithm, a lightweight online medical system that protects privacy and authenticity is implemented. The difference between the present invention and similar solutions is that the algorithm used in the present invention is more lightweight, and also pays attention to protecting the authenticity and integrity of the data. The two cloud servers in the present invention use the ciphertext parameters provided by the medical data center to perform calculations based on the ciphertext, and provide users with online detection services under the premise of ensuring the security and authenticity of user data and model parameters.

[0006] To achieve the above objectives, the present invention adopts a technical solution: a privacy protection method based on homomorphic authenticated encryption, comprising the following steps:

[0007] Initialize the system and medical cloud server;

[0008] The medical data center encrypts the trained diagnostic model and uploads it to the medical cloud server;

[0009] After the system user obtains authorization, the personal privacy data collected by the wearable device is extracted to form its query vector and sent to the medical cloud server. The medical cloud server calculates in a ciphertext state and sends the result back to the user. The user decrypts it to obtain the final result and completes the online medical service.

[0010] In the above solution, the initialization includes two medical cloud servers CS A and CSB Generate the corresponding public and private key pairs (PK A , SK A ), (PK B , SK B ), PK A CS A The public key, SK A CS A The private key, PK B CS B The public key, SK B CS B The public key is distributed to other parties, where p is a prime number, E is an elliptic curve defined on the finite field Fp, G(x, y) is a point on E with a prime order of n, and the pseudo-random function F k : {0, 1} λ →Z p , λ represents the safety parameter, Z p Represents a finite domain, the data owner chooses d←Z n , Z n represents a finite field, and the key k←{0, 1} used in the pseudorandom function λ , obtain the key sk=(d, k), and share the key with users who have the right to use the online service.

[0011] In the above scheme, the encryption of the trained diagnostic model includes: the data owner trains the diagnostic model on the sensitive data he owns, obtains the coefficients in the regression formula, and regards all the coefficients as a row vector Treat a specific data point instance as a column vector Then the regression formula is these two vectors and The product of the regression coefficient vector Each encryption of i Perform the following algorithm and select a random number r i ←Z n , then w i The first two parts of the ciphertext are (c i1 , c i2 )=r i G, w i The third part of the ciphertext is c i3 =d*c i1 +w i , d is the key, and the last part of the ciphertext is c4=d*c i3 +F k (τi), τi is related to w i Related tags: Fk (τi) is the output of the pseudo-random function that takes the label τi and the key k as input.

[0012] The specific structure of the encrypted coefficient vector is the following matrix:

[0013]

[0014] Treat each encrypted ciphertext as a whole Obtained the encrypted coefficient vector Submit to two medical cloud servers CS respectively A and CS B .

[0015] The above solution also includes the query generation stage: the personal privacy data collected by the wearable device is extracted to form its query vector Split the query vector into two vectors of the same dimension Make the sum of these two vectors equal to the query vector For each of these two vectors, use the medical cloud server CS A and CS B Public key encryption: Enc PKA Indicates the use of medical cloud server CS A The public key is used to encrypt the ciphertext. Similarly, Enc PKB Indicates the use of medical cloud server CS B The ciphertext is obtained by encrypting the public key, where n is the dimension of the vector. Each encrypted ciphertext is considered as a whole Get the two encrypted query data point components: and Submit to two medical cloud servers CS respectively A and CS B ;

[0016] Privacy-preserving computing phase: Two medical cloud servers CS A , CS B For users who receive and First decrypt it using your own private key: Dec SKA Indicates the use of medical cloud server CS A The private key is used to decrypt the plaintext, and the same is true for Dec SKB Indicates the use of medical cloud server CS B The user's query vector component is obtained by decrypting the plaintext with the private key. The user's health data collected by sensors is abstracted into a query vector, the query component Will Think of them as coefficients in a linear function:

[0017]

[0018] f1, f2 represent the coefficients of the linear function, x 1n , x 2n Represents a vector The nth dimension in .

[0019] Substitute the ciphertext corresponding to each item in the encrypted query vector into the calculation, that is, perform vector multiplication on it with its own encrypted coefficient vector, then corresponding to the query, obtain the ciphertext after two operations:

[0020]

[0021]

[0022] in, represents the encrypted diagnostic model, The specific structure is as follows:

[0023]

[0024] x 1n Represents a vector The nth dimension in c n1 Indicates the first part of the nth ciphertext, c n2 Indicates the second part of the nth ciphertext, c n3 Indicates the third part of the nth ciphertext, c n4 Represents the fourth part of the nth ciphertext.

[0025] The specific structure is as follows:

[0026]

[0027] The two ciphertexts to be calculated and Send to data users;

[0028] Query response phase: First, the data user calculates the labels τ1,…,τ corresponding to the two query vector components f1, f2 and n logistic regression classification coefficients. n , ciphertext and key sk=(d,k), calculate t i =F k (τ i ), 1≤i≤n, t1=f1(t1,...,t n), t2=f2(t1,…,t n ), F k It is a pseudo-random function, t1 and t2 are intermediate calculation results.

[0029] if and Then the user will get two ciphertexts Perform vector addition to obtain the encrypted result:

[0030]

[0031] That is, the ciphertext result of the regression formula z is obtained, and then the result is decrypted using the key sk = (d, k) Then substitute z into the Sigmoid function: Sigmoid(z)=(1+e -z ) -1 If Sigmoid(z) is greater than 0.5, the result is negative, otherwise the result is positive, and the final test result is obtained. Otherwise, it is considered that the integrity of the data is destroyed. and Invalid.

[0032] Furthermore, it also includes an update step, if the data owner needs to update the parameters of the logistic regression classification To update, you only need to train locally and use the parameters obtained after training Call LHAE to encrypt each item, and finally upload it back to the two cloud servers to overwrite the original encrypted parameter vector.

[0033] The present invention also provides a technical solution: a privacy protection system based on homomorphic authentication encryption, comprising an initialization module, a parameter outsourcing module and a privacy protection module, wherein the initialization module is used to initialize the system and the medical cloud server;

[0034] The parameter outsourcing module is used by the medical data center to encrypt the trained diagnostic model and upload it to the medical cloud server;

[0035] The privacy protection module is used to extract the personal privacy data collected by the wearable device to form its query vector and send it to the medical cloud server after the system user obtains authorization. The medical cloud server calculates in a ciphertext state and sends the result back to the user. The user decrypts to obtain the final result and completes the online medical service.

[0036] Furthermore, an update module is included to update the diagnosis model Or add new medical cloud service W new Specifically: If the data owner needs the parameters of the logistic regression classification To update, for example, if more specific data is obtained, only local training is required and the parameters obtained after training are used. Call LHAE to encrypt each item. Finally, re-upload it to the two cloud servers, overwriting the original encrypted parameter vector. If you need to add a new service, the same steps can be followed for the new detection service data, without affecting each other.

[0037] The advantages and beneficial effects of the present invention are as follows:

[0038] (1) Privacy: The privacy requirements of users’ private data, diagnostic models trained in the data center, and users’ diagnostic results are self-evident. The present invention effectively protects the privacy of user data, learning parameters, and classification results by using a homomorphic authenticated encryption algorithm, thus avoiding the leakage of sensitive information.

[0039] (2) Homomorphism: The homomorphic authenticated encryption algorithm proposed in this invention enables ciphertext computation, freeing online medical computing and storage clouds from doubt. This leverages cloud technology while ensuring high security.

[0040] (3) Reliability: The homomorphic authentication encryption algorithm proposed in this invention maintains the most basic privacy requirements while having signature and message homomorphic characteristics. If the integrity is forged or destroyed, verification cannot be completed.

[0041] (4) Efficiency: Based on the homomorphic authentication encryption algorithm proposed in this invention, the algorithm is simple to calculate and easy to implement, thus achieving lightweight protocol. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 Provides a general model diagram of a privacy-protected online medical system for the present invention;

[0043] Figure 2 This is the perception layer model diagram of the present invention;

[0044] Figure 3 This is a system data flow framework diagram of the present invention. DETAILED DESCRIPTION

[0045] The following will describe the technical solutions in the embodiments of the present invention in detail with reference to the accompanying drawings. The described embodiments are only a part of the embodiments of the present invention.

[0046] Reference Figure 1-Figure 3 , the specific implementation of the present invention is as follows:

[0047] 1. In the initial case, each element of the online medical diagnosis system is initialized. First, the medical cloud server CS A and CSB Generate the corresponding public and private key pairs (PK A , SK A ), (PK B , SK B ), PK A CS A The public key, SK A CS A The private key, PK B CS B The public key, SK B CS B The private key of . And distribute these public keys to other parties. p is a prime number, Fp represents a finite field, E is an elliptic curve defined on Fp, G(x, y) is a point on E with a prime order of n, and the pseudo-random function F k : {0, 1} λ →Z p , λ represents the safety parameter, Z p Represents a finite domain, the data owner chooses d←Z n , Z n represents a finite field, and the key k←{0, 1} used in the pseudorandom function λ , obtain the key sk = (d, k), and share the key with users who have the right to use the online service. Get the public parameter set parameters = {p, E p ,n,G,F k , PK A , PK B}.

[0048] 2. Medical data center for training diagnostic models Encrypted And upload it to the medical cloud server. The data owner trains the diagnostic model on the sensitive data he owns and obtains the coefficients in the regression formula. All coefficients can be regarded as a row vector Treat a specific data point instance as a column vector Then the regression formula can be viewed as these two vectors and In order to protect the parameters, the regression coefficient vector Each encryption of i Perform the following algorithm and select a random number r i ←Z n , then w i The first two parts of the ciphertext are (c i1 , c i2 )=r i G, wi The third part of the ciphertext is c i3 =d*c i1 +w i , d is the key, and the last part of the ciphertext is c4=d*c i3 +F k (τi), τi is related to w i Related tags: F k (τi) is the output of the pseudo-random function that takes the label τi and the key k as input.

[0049]

[0050] Treat each encrypted ciphertext as a whole Obtained the encrypted coefficient vector Submit to two medical cloud servers CS respectively A and CS B .

[0051] 3. When an authorized user uses the online diagnostic service, the data user Figure 2 The personal privacy data collected by the wearable device in the middle perception layer is extracted to form its query data point vector Split the query vector into two vectors of the same dimension Make the sum of these two vectors equal to the query vector Use CS for each of the two vectors separately A and CS B Public key encryption: Treat each encrypted ciphertext as a whole The two encrypted query data point components are obtained: and And submit it to two medical cloud servers CS A , CS B .

[0052] Two medical cloud servers CS A , CS B For users who receive and First decrypt it using your own private key: Get the user's query vector component and Think of them as coefficients in a linear function: The ciphertext corresponding to each item in the encrypted query vector is brought into the calculation, that is, vector multiplication is performed on it with its own encrypted coefficient vector. Based on the homomorphism of the LHAE scheme proposed in this scheme, two ciphertexts after operation can be obtained corresponding to the query: Finally, the calculated results and Sent to data users.

[0053] User receives and After that, first, according to f1, f2, the two query vector components, the labels τ1, ..., τ corresponding to the n logistic regression classification coefficients n , ciphertext and key sk=(d,k), calculate t i =F k (τ i ), 1≤i≤n, t1=f1(t1,...,t n ), t2=f2(t1,…,t n ).if and Then the user will get two result components Perform vector addition to obtain the encrypted result: That is, the ciphertext result of the regression formula z is obtained, and then the result is decrypted using the key sk = (d, k) Substitute z into the Sigmoid function: Sigmoid(z)=(1+e -z ) -1 If Sigmoid(z) is greater than 0.5, the result is negative, otherwise the result is positive, and the final diagnostic test result is obtained. Otherwise, the integrity of the data is considered to be destroyed. and Invalid.

[0054] 4. When the data center needs to update or provide a new diagnostic model, such as the need for parameters of logistic regression classification To update, for example, if more specific data is obtained, only local training is required and the parameters obtained after training are used. Call LHAE to encrypt each item. Finally, re-upload it to the two cloud servers, overwriting the original encrypted parameter vector. If you need to add a new service, the same steps can be followed for the new detection service data, without affecting each other.

[0055] The above embodiments should be understood as merely illustrating the present invention and not as limiting the scope of protection of the present invention. After reading the contents of the present invention, technicians may make various changes or modifications to the present invention, and these equivalent changes and modifications also fall within the scope defined by the claims of the present invention.

Claims

1. A privacy protection method based on homomorphic authenticated encryption, characterized in that: The following steps are involved: Initialize the system and medical cloud server; The medical data center encrypts the trained diagnostic model and uploads it to the medical cloud server; After obtaining authorization, the system user extracts the personal privacy data collected by the wearable device to form its query vector and sends it to the medical cloud server. The medical cloud server calculates the encrypted data and sends the result back to the user. The user decrypts it to obtain the final result, completing the online medical service. Query generation phase: Personal privacy data collected by wearable devices is extracted to form its query vector Split the query vector into two vectors of the same dimension Make the sum of these two vectors equal to the query vector For each of these two vectors, use the medical cloud server CS A and CS B Public key encryption: 1≤i≤n,Enc PKA Indicates the use of medical cloud server CS A The public key is used to encrypt the ciphertext, Enc PKB Indicates the use of medical cloud server CS B The ciphertext is obtained by encrypting the public key, n is the dimension of the vector, and the ciphertext is regarded as a whole Get the encrypted two query data point components: and Submit to two medical cloud servers CS respectively A and CS B ; Privacy-preserving computing phase: Two medical cloud servers CS A , CS B For users who receive and First decrypt it using your own private key: 1≤i≤n,Dec SKA Indicates the use of medical cloud server CS A The private key is used to decrypt the plain text, Dec SKB Indicates the use of medical cloud server CS B The private key is used to decrypt the plaintext and obtain the user's query vector component The user's health data collected by sensors is abstracted into a query vector, the query component Will Think of it as a coefficient in a linear function: f1, f2 represent the coefficients of the linear function, x 1n , x 2n Represents a vector The nth dimension in ; Substitute the ciphertext corresponding to each item in the encrypted query vector into the calculation, that is, perform vector multiplication on it with its own encrypted coefficient vector, then corresponding to the query, obtain the ciphertext after two operations: in, represents the encrypted diagnostic model, The specific structure is as follows: x 1n Represents a vector The nth dimension in c n1 Indicates the first part of the nth ciphertext, c n2 Indicates the second part of the nth ciphertext, c n3 Indicates the third part of the nth ciphertext, c n4 Represents the fourth part of the nth ciphertext; The specific structure is as follows: The two ciphertexts to be calculated and Send to data users; Query response phase: First, the data user calculates the labels τ1,…,τ corresponding to the two query vector components f1, f2 and n logistic regression classification coefficients. n , ciphertext and key sk=(d,k), calculate t i =F k (τ i ),1≤i≤n,t1=f1(t1,…,t n ),t2=f2(t1,…,t n ), F k It is a pseudo-random function, t1 and t2 are intermediate calculation results; if and Then the user will get two ciphertexts Perform vector addition to obtain the encrypted result: That is, the ciphertext result of the regression formula z is obtained, and then the result is decrypted using the key sk=(d,k) Then substitute z into the Sigmoid function: Sigmoid(z)=(1+e -z ) -1 If Sigmoid(z) is greater than 0.5, the result is negative, otherwise the result is positive, and the final test result is obtained. Otherwise, it is considered that the integrity of the data is destroyed. and Invalid.

2. A privacy protection method based on homomorphic authenticated encryption according to claim 1, characterized in that: The initialization includes two medical cloud servers CS A and CS B Generate the corresponding public key (PK A ,SK A ) and private key (PK B ,SK B ), and distribute the public key to other parties, p is a prime number, E is an elliptic curve defined on Fp, G(x,y) is a point on E with a prime order of n, λ represents a security parameter, Z n represents a finite field, F k :{0,1} λ →Z p is a pseudo-random function, the data owner chooses d←Z n and the key k←{0,1} used in the pseudorandom function λ , obtain the key sk = (d, k), and share the key with users who have the right to use the online service.

3. The privacy protection method based on homomorphic authenticated encryption according to claim 1, characterized in that: The encryption of the trained diagnostic model includes: the data owner trains the diagnostic model on the sensitive data he owns, obtains the coefficients in the regression formula, and regards all the coefficients as a row vector Treat a specific data point instance as a column vector Then the regression formula is these two vectors and The product of the regression coefficient vector Each encryption: For each of the w i Perform the following algorithm and select a random number r i ←Z n , then w i The first two parts of the ciphertext are (c i1 ,c i2 )=r i G,w i The third part of the ciphertext is c i3 =d*c i1 +w i ,d is the key, the last part of the ciphertext is c i4 =d*c i3 +F k (τi), τi is related to w i Related tags: F k (τi) is the output of the pseudo-random function obtained by taking the label τi and the key k as input; the specific structure of the encrypted coefficient vector is the following matrix: Treat each encrypted ciphertext as a whole Obtained the encrypted coefficient vector Submit to two medical cloud servers CS respectively A and CS B .

4. A privacy protection method based on homomorphic authenticated encryption according to any one of claims 1 to 3, characterized in that: It also includes an update step if the data owner needs to update the parameters of the logistic regression classification To update, you only need to train locally and use the parameters obtained after training Call LHAE to encrypt each item, and finally upload it back to the two cloud servers to overwrite the original encrypted parameter vector.

5. A privacy protection system based on homomorphic authenticated encryption, characterized by: It includes an initialization module, a parameter outsourcing module and a privacy protection module. The initialization module is used to initialize the system and the medical cloud server; The parameter outsourcing module is used by the medical data center to encrypt the trained diagnostic model and upload it to the medical cloud server; The privacy protection module is used to extract the personal privacy data collected by the wearable device to form its query vector after the system user obtains authorization and sends it to the medical cloud server. The medical cloud server calculates the encrypted data and sends the result back to the user. The user decrypts it to obtain the final result and completes the online medical service; The privacy protection module includes a query generation module, a privacy protection calculation module and a query response module; In the query generation module, the personal privacy data collected by the wearable device is extracted to form its query vector Split the query vector into two vectors of the same dimension Make the sum of these two vectors equal to the query vector For each of these two vectors, use the medical cloud server CS A and CS B Public key encryption: 1≤i≤n,Enc PKA Indicates the use of medical cloud server CS A The public key is used to encrypt the ciphertext, Enc PKB Indicates the use of medical cloud server CS B The ciphertext is obtained by encrypting the public key, n is the dimension of the vector, and each encrypted ciphertext is regarded as a whole Get the two encrypted query data point components: and Submit to two medical cloud servers CS respectively A and CS B ; In the privacy protection computing module, two medical cloud servers CS A , CS B For users who receive and First decrypt it using your own private key: 1≤i≤n,Dec SKA Indicates the use of medical cloud server CS A The private key is used to decrypt the plain text, Dec SKB Indicates the use of medical cloud server CS B The private key is used to decrypt the plaintext and obtain the user's query vector component The user's health data collected by sensors is abstracted into a query vector, the query component Will Think of it as a coefficient in a linear function: f1, f2 represent the coefficients of the linear function, x 1n , x 2n Represents a vector The nth dimension in ; Substitute the ciphertext corresponding to each item in the encrypted query vector into the calculation, that is, perform vector multiplication on it with its own encrypted coefficient vector, then corresponding to the query, obtain the ciphertext after two operations: in, represents the encrypted diagnostic model, The specific structure is as follows: x 1n Represents a vector The nth dimension in c n1 Indicates the first part of the nth ciphertext, c n2 Indicates the second part of the nth ciphertext, c n3 Indicates the third part of the nth ciphertext, c n4 Represents the fourth part of the nth ciphertext; The specific structure is as follows: The two ciphertexts to be calculated and Send to data users; In the query response module: First, the data user calculates the labels τ1,…,τ corresponding to the two query vector components f1, f2, and n logistic regression classification coefficients. n , ciphertext and key sk=(d,k), calculate t i =F k (τ i ),1≤i≤n,t1=f1(t1,…,t n ),t2=f2(t1,…,t n ), F k It is a pseudo-random function, t1 and t2 are intermediate calculation results; if and Then the user will get two ciphertexts Perform vector addition to obtain the encrypted result: That is, the ciphertext result of the regression formula z is obtained, and then the result is decrypted using the key sk=(d,k) Then substitute z into the Sigmoid function: Sigmoid(z)=(1+e -z ) -1 If Sigmoid(z) is greater than 0.5, the result is negative, otherwise the result is positive, and the final test result is obtained. Otherwise, it is considered that the integrity of the data is destroyed. and Invalid.

6. A privacy protection system based on homomorphic authenticated encryption according to claim 5, characterized in that: It also includes an update module for updating diagnostic models or adding new medical cloud services.

7. A privacy protection system based on homomorphic authenticated encryption according to claim 5 or 6, characterized in that: The initialization module specifically includes: two medical cloud servers CS A and CS B Generate the corresponding public key (PK A ,SK A ) and private key (PK B ,SK B ), and distribute the public key to other parties, p is a prime number, E is an elliptic curve defined on Fp, G(x,y) is a point on E with a prime order of n, λ represents a security parameter, Z n represents a finite field, F k :{0,1} λ →Z p is a pseudo-random function, the data owner chooses d←Z n and the key k←{0,1} used in the pseudorandom function λ , obtain the key sk = (d, k), and share the key with users who have the right to use the online service.

8. A privacy protection system based on homomorphic authenticated encryption according to claim 5 or 6, characterized in that: The parameter outsourcing module specifically includes: the data owner trains the diagnostic model on the sensitive data he owns, obtains the coefficients in the regression formula, and regards all the coefficients as a row vector Treat a specific data point instance as a column vector Then the regression formula is these two vectors and The product of the regression coefficient vector Each encryption: For each of the w i Perform the following algorithm and select a random number r i ←Z n , then w i The first two parts of the ciphertext are (c i1 ,c i2 )=r i G,w i The third part of the ciphertext is c i3 =d*c i1 +w i ,d is the key, the last part of the ciphertext is c i4 =d*c i3 +F k (τi), τi is related to w i Related tags: F k (τi) is the output of the pseudo-random function obtained by taking the label τi and the key k as input; the specific structure of the encrypted coefficient vector is the following matrix: Treat each encrypted ciphertext as a whole Obtained the encrypted coefficient vector Submit to two medical cloud servers CS respectively A and CS B .

Images