Ciphertext Retrieval Method Based on Multi-Key Homomorphic Encryption

Abstract

The present invention discloses a ciphertext retrieval method based on multi-key homomorphic encryption, which can perform retrieval on ciphertexts encrypted with different keys. The data owner and the data user respectively use homomorphic encryption technology to encrypt the data and the query value, and upload the ciphertexts to the server. The server will expand the ciphertexts according to the total number k of participants (including the data owner and the data user) to obtain a multi-key form ciphertext containing k + 1 elements. The expanded ciphertext can perform homomorphic operations even under different key encryptions and supports distributed decryption, and the decryption process is jointly executed by all participants. Based on this, the present invention realizes the ciphertext retrieval function. At the same time, the present invention also optimizes the retrieval function by applying compression coding technology, and uses a Bloom filter set to return all retrieval results at one time, without repeatedly executing the retrieval algorithm, reducing the computational and storage overheads, and greatly improving the retrieval performance.

Description

Technical Field

[0001] The present invention belongs to the technical field of data processing, and particularly relates to a ciphertext retrieval method based on multi-key homomorphic encryption. Background Art

[0002] Regarding the ciphertext retrieval technology of homomorphic encryption, the prior art 1: Akavia et al. proposed a ciphertext retrieval method based on homomorphic encryption in their published paper "Secure Search on Encrypted Data via Multi-Ring Sketch" (the 2018 ACM SIGSAC Conference on Computer and Communications Security (CCS’18), DOI: 10.1145 / 3243734.3243810). This method takes an unordered data array array=(x1,...,x m ) and a query value l as inputs, where the data item x i and the query value l are both given in binary form. During encryption, each data item and the query value are encrypted bit by bit, and each bit corresponds to a ciphertext. The output of this method is the first matching item (i,x i ), where i = min{i∈[m]|isMatch(x i ,l)=1}, and isMatch() is a matching function related to the input format used as a black box. This function returns 0 / 1 as the return value, 1 indicates successful matching, and 0 indicates failed matching, that is, it returns the matching item with the smallest index among all matching results. The user first generates k groups of keys and k corresponding ciphertexts: each plaintext modulus p1,...,p k corresponds to a group of keys and a ciphertext. After encrypting the data array with the keys, the ciphertext and the corresponding public key are uploaded to the server. When performing retrieval, the user sends the encrypted query value to the server The server performs a matching operation on the ciphertexts. First, it calculates the encrypted matching array where For each element ind i in the array, when the data item x i matches the query value l, ind i is 1, otherwise it is 0. Next, the server performs an operation pj on the encrypted array [ind] to obtain the first candidate index where P∈{-1,0,1} m×m , R∈{0,1} m×(2m-1) , T∈{0,1} (2m-1)×m; i() represents the isPositive() operation. For a prime number p and an integer vector v = (v1,..., v m ), the operation is defined as Finally, the server uses the PIR protocol to return the candidate list to the user, where

[0003] Prior Art 2: Wen et al. proposed a ciphertext retrieval method based on homomorphic encryption in their published paper "LEAF: A Faster Secure Search Algorithm via Localization, Extraction, and Reconstruction" (the 2020 ACM SIGSAC Conference on Computer and Communications Security (CCS’20), DOI: 10.1145 / 3372297.3417237). The main function of this method is to retrieve the first non-zero item data in an unsorted array after homomorphic encryption, including three steps: localization, extraction, and reconstruction. In the localization step, the server divides the original array v = (v[1],..., v[n]) into t intervals of length k. The main goal of this step is to find the first interval containing non-zero items. Create an array ind = (ind[1],..., ind[k]) to indicate whether there are non-zero items in the interval. Suppose the index of the first non-zero item in the original array is between (j - 1)k and jk, where j ∈ [1, t], then ind[1] = ind[2] =... = ind[j - 1] = 0, ind[j] = ind[j + 1] =... = ind[t] = 1. Calculate the difference between two adjacent elements in the array ind to obtain a new indicator array flag ∈ {0, 1} t, where only flag[j] = 1. In the extraction step, the main objective is to extract the interval containing the first non-zero term for subsequent retrieval operations on this interval. Based on the position information obtained in the previous step, construct a new array shield with the same length as the original array. For any j ∈ [1, t] and i ∈ [1, k], shield[(j - 1)k + i] ← flag[j], that is, set all values of shield within the range of the interval where non-zero terms exist to 1, and the remaining values to 0. Multiply shield by the original array v, v[i] ← v[i] · shield[i], i ∈ [1, n]. In the updated array v, only the non-zero terms within the specified interval are 1. Add the elements corresponding to each interval position, and the result is the interval of the first non-zero term. In the reconstruction step, the server reconstructs an array containing only the first non-zero term based on the information from the previous two steps and returns it to the data user.

[0004] The above prior arts 1 and 2 implement ciphertext retrieval in a single data owner environment based on homomorphic encryption technology, and only support retrieving ciphertexts encrypted under a single key. However, in practical applications, there are usually multiple data owners, and it is obviously unreasonable and insecure for them to hold the same key. In the case of holding different keys, to use this method to retrieve ciphertexts encrypted under different keys, one can choose to encrypt the same data repeatedly with different keys, but this will consume a large amount of computing and storage resources, resulting in a low practical application prospect for the method. Moreover, in prior art 1, each time a user retrieves, only the first matching item and its index can be obtained. If one wants to continue to obtain the next matching result, the index of the previous matching item needs to be used to construct a new query. That is to say, assuming there are m matching items, the user needs to execute the retrieval algorithm m times repeatedly to obtain all the matching results, bringing a large amount of additional computing and storage overhead. Summary of the Invention

[0005] The objective of the present invention is to provide a ciphertext retrieval method based on multi-key homomorphic encryption, which can be used to find the matching result ciphertext according to the ciphertext query value provided by the data user in a multi-data owner environment and improve the retrieval efficiency.

[0006] The technical solution adopted by the present invention is as follows: A ciphertext retrieval method based on multi-key homomorphic encryption is specifically implemented according to the following steps:

[0007] Step 1: According to the shared security parameters, initialize the parameters of the participating parties composed of data owners and data users, respectively set the public parameters of the multi-key homomorphic encryption scheme, and construct their own public-private key pairs;

[0008] Step 2: The data owner and the data user respectively use their own public keys to encrypt the plaintext data and the query value, obtain the ciphertext data and the retrieval token, and upload them to the server respectively. The server will expand them so that the ciphertexts encrypted under different keys can be operated on each other;

[0009] Step 3: The server will perform operations on the ciphertext data according to the retrieval token, find the ciphertext results that meet the requirements, and apply the compressed oblivious encoding technology to process the ciphertext results that meet the requirements to obtain the encoding results, and return the encoding results to the data user;

[0010] Step 4: If the data user needs to decrypt the encoding result, a distributed decryption application is sent to the server. The server will decode the encoding result to obtain the decoded ciphertext result. The server will send the ciphertext result to all participating parties. Each participating party will perform partial decryption operations on the ciphertext result respectively, and then the server will return the set of partial decryption results to the data user. The data user will perform a merging operation on it to obtain the final plaintext result.

[0011] The features of the present invention also lie in:

[0012] The specific process of Step 1 is as follows:

[0013] Parameter initialization: Assume that there are a total of k participating parties P = {P1, P2,..., P k}, where P1,..., P k-1 are data owners, and P k is the data user; Given an integer t > 1, the plaintext space R t , r t (q) = q mod t, where q = △t + r t q, security parameter λ, the distribution χ = χ(λ) on R; All participating parties set the public parameters pp = (n, q, χ, ψ, a) based on multi-key homomorphic encryption according to these shared parameters, including the RLWE dimension n, the ciphertext modulus q, the key distribution χ, and the error distribution ψ;

[0014] Key generation: The data owner P i∈[1,k-1] and the data user P k respectively generate their own key pairs (PK i , SK i ) and (PK k , SK k ) according to the public parameters pp.

[0015] The specific process of generating their own key pairs is as follows: Randomly select parameters s from R2 and from R qSelect parameter a from, select parameter e from χ, set the private key SK = s, and the public key PK = ([-(a·s + e)] q , a).

[0016] The specific process of step 2 is as follows:

[0017] Step 2.1, Plaintext data encryption: The data owner P i∈[1,k-1] Uses their respective public keys PK i∈[1,k-1] To encrypt the plaintext data, obtain the ciphertext data and upload the ciphertext data to the server. Assume that after uploading, the server stores a ciphertext set

[0018] Step 2.2, Query value encryption: The data user P k Uses the public key PK k To encrypt the query value qu, obtain the retrieval token And upload the retrieval token To the server;

[0019] Step 2.3, Ciphertext extension: The server will extend the received ciphertext according to the number of participating parties and the serial number of the uploader. The extension process is as follows: The participating party P i Uploads the homomorphic ciphertext The server will extend it according to the number of participating parties k and the serial number i. The extended ciphertext format is Where c′ i,0 = c i,0 , That is, expand the ciphertext vector from 2 - dimensional to k + 1 - dimensional, keep c0 unchanged, move c1 to the i - th position, and fill the remaining positions with 0 to obtain the extended ciphertext in the multi - key form.

[0020] The specific encryption processes for encrypting the plaintext data and the query value are as follows: Set p0 = PK i [0], p1 = PK i [1], randomly select u←R2, e1, e2←χ, and calculate the ciphertext

[0021] The specific process of step 3 is as follows:

[0022] Step 3.1, Find the ciphertext results that meet the requirements:

[0023] According to the received retrieval token The server first uses the matching function to match the stored ciphertext set To obtain the indicator vector Where This vector is composed of the ciphertext And the ciphertext Where the ciphertext Indicates successful matching, ciphertext Indicates failed matching; isMatch() is a matching function related to the input format, with a return value of 0 / 1. For matching data that meets the conditions, the function return value is 1, otherwise the return value is 0; the server passes the stored ciphertext set Multiplied by the indicator vector To obtain the final result ciphertext set That is, the ciphertext result that meets the requirements, where × represents homomorphic ciphertext multiplication.

[0024] Step 3.2. Apply the compressed oblivious encoding technique to process the ciphertext results that meet the requirements:

[0025] Initialize the Bloom filter set Where the parameter l = 2[(λ + lgs)·s - 1], λ is the shared security parameter, and s is the upper limit of the total number of elements inserted into the Bloom filter set; construct the hash function set For each ciphertext result that meets the requirements Randomly select a function h from the hash function set z , and calculate the function value h z (j), where j is the index of the ciphertext result that meets the requirements. According to the function value h z (j), map this ciphertext result to the Bloom filter at the corresponding index, that is, calculate To achieve one update of the Bloom filter set , where + represents homomorphic addition operation; the server updates the Bloom filter set That is the encoding result.

[0026] The specific process of Step 4 is as follows:

[0027] Step 4.1. The server decodes the Bloom filter set And outputs the stored ciphertext set

[0028] Step 4.2. Each participating party separately performs partial decryption operations on the decoding result:

[0029] For the given ciphertext in the ciphertext result Participating party P i Uses its own private key SK i = s i To decrypt the i-th item of the ciphertext, randomly select e z,i ← φ, and calculate To obtain the partial decryption result And return it to the server.

[0030] Step 4.3. The data user performs a merging operation on it:

[0031] The server collects the partial decryption results from each participating party and sends the set of partial decryption results to the data user. The data user performs a merging operation to obtain the plaintext result. The merging operation formula is Finally, the data user will obtain the set of plaintext results

[0032] The beneficial effects of the present invention are as follows:

[0033] 1) The ciphertext retrieval method based on multi-key homomorphic encryption of the present invention can perform retrieval on ciphertexts encrypted under different keys. The data owner and the data user respectively use the homomorphic encryption technology to encrypt the data and the query value, and upload the ciphertext to the server. The server will expand the ciphertext according to the total number k of participating parties (including the data owner and the data user) to obtain a multi-key form ciphertext containing k + 1 elements. The expanded ciphertext can perform homomorphic operations even under different key encryptions, and thus the ciphertext retrieval function of the present invention is realized. At the same time, the present invention also provides a distributed decryption function for multi-key ciphertexts, which is jointly executed by all participating parties.

[0034] 2) The present invention optimizes the method for returning retrieval results and realizes the one-time return of all matching results. After the server calculates the matching results, it applies the compressed oblivious coding technology, uses the hash function to randomly map the matching ciphertexts to the Bloom filter set, and returns the encoded set to the data user. The data user performs a decoding operation to obtain the final result ciphertext. Compared with the prior art, the present invention does not need to repeatedly execute the retrieval operation, and does not need to use the PIR protocol when returning the retrieval results, which improves the retrieval efficiency and practicality to a certain extent. Brief Description of the Drawings

[0035] Figure 1 is the flowchart of the ciphertext retrieval method based on multi-key homomorphic encryption of the present invention;

[0036] Figure 2 is the interaction diagram between entities of the ciphertext retrieval method based on multi-key homomorphic encryption in the multi-data owner environment of the present invention;

[0037] Figure 3 is the line graph of the retrieval time varying with different dataset sizes in the embodiment of the present invention;

[0038] Figure 4 is the line graph of the retrieval time varying with different result set sizes in the embodiment of the present invention;

[0039] Figure 5It is a bar chart showing the change of the multi-key homomorphic encryption algorithm with the number of participating parties in the embodiment of the present invention. Detailed implementation manner

[0040] The present invention will be described in detail below with reference to the accompanying drawings and specific implementation manners.

[0041] The ciphertext retrieval method based on multi-key homomorphic encryption of the present invention, as Figure 1 shown, is specifically implemented according to the following steps:

[0042] Step 1: According to the shared security parameters, initialize the participant parameters composed of the data owner and the data user, respectively set the public parameters based on multi-key homomorphic encryption, and construct their own public-private key pairs; the specific process is as follows:

[0043] Parameter initialization: Assume that there are a total of k participants P = {P1, P2,..., P k}, where P1,..., P k-1 are data owners, and P k is the data user; given an integer t > 1, the plaintext space R t , r t (q) = q mod t, there is q = △t + r t q, the security parameter λ, the distribution χ = χ(λ) on R; all participants set the public parameters pp = (n, q, χ, ψ, a) based on multi-key homomorphic encryption according to these shared parameters, including the RLWE dimension n, the ciphertext modulus q, the key distribution χ, and the error distribution ψ;

[0044] Key generation: The data owner P i∈[1,k-1] and the data user P k generate their respective key pairs (PK i , SK i ) and (PK k , SK k ) according to the public parameters pp. Among them, the specific process of generating their respective key pairs is as follows: Randomly select parameters s from R2, select parameters a from R q , select parameters e from χ, set the private key SK = s, and the public key PK = ([- (a·s + e)] q , a).

[0045] Step 2: The data owner and the data user respectively encrypt the plaintext data and the query value using their own public keys to obtain ciphertexts, upload the ciphertexts to the server, and expand the ciphertexts in the server; the specific process is as follows:

[0046] Step 2.1: Encryption of plaintext data: The data owner P i∈[1,k-1]Use their respective public keys PK i∈[1,k-1] Encrypt the plaintext data to obtain ciphertext data and upload the ciphertext data to the server. Assume that the server stores a ciphertext set after uploading

[0047] Step 2.2, Query value encryption: Data user P k Use the public key PK k To encrypt the query value qu to obtain the retrieval token And upload the retrieval token To the server;

[0048] The specific encryption processes for encrypting the plaintext data and the query value are: Set p0 = PK i [0], p1 = PK i [1], randomly select u ← R2, e1, e2 ← χ, and calculate the ciphertext

[0049] Step 2.3, Ciphertext expansion: The server will expand the received ciphertext according to the number of participants and the serial number of the uploader. The expansion process is: Participant P i Uploaded the homomorphic ciphertext The server will expand it according to the number of participants k and the serial number i. The expanded ciphertext format is Where c′ i,0 = c i,0 , That is, expand the ciphertext vector from 2 - dimensional to k + 1 - dimensional, keep c0 unchanged, move c1 to the i - th position, and fill the remaining positions with 0 to obtain the expanded ciphertext in the multi - key form.

[0050] Step 3, The server calculates according to the ciphertext corresponding to the query value to find the ciphertext result that meets the requirements. The specific process is:

[0051] According to the received retrieval token The server first uses the matching function to match the stored ciphertext set To obtain the indication vector Where This vector is composed of the ciphertext And the ciphertext Among them, the ciphertext Indicates a successful match, and the ciphertext Indicates a failed match; isMatch() is a matching function related to the input format, with 0 / 1 as the return value. For the matching data that meets the conditions, the function return value is 1, otherwise the return value is 0; The server multiplies the stored ciphertext set With the indication vector To obtain the final result ciphertext set That is, the ciphertext result that meets the requirements, where × represents homomorphic ciphertext multiplication.

[0052] The present invention optimizes the acquisition stage of the retrieved data and applies the compressed oblivious encoding technology to return the matching results at one time. The server applies the compressed oblivious encoding technology to the set of matching ciphertext results and returns it to the data user. The specific process is as follows:

[0053] Initialize the Bloom filter set where the parameter l = 2[(λ + lgs)·s - 1], λ is the shared security parameter, and s is the upper limit of the total number of elements inserted into the Bloom filter set; construct the hash function set For each ciphertext result that meets the requirements Randomly select a function h from the hash function set z , and calculate the function value h z (j), where j is the index of the ciphertext result that meets the requirements. According to the function value h z (j), map the ciphertext result to the Bloom filter at the corresponding index, that is, calculate to achieve one update of the Bloom filter set , where + represents the homomorphic addition operation; the server returns the updated Bloom filter set as the encoding result to the data user.

[0054] Step 4. If the data user needs to decrypt the encoding result, submit a distributed decryption request to the server, and decode the encoding result within the server. The specific process is as follows: The server decodes the Bloom filter set to obtain the decoded ciphertext result The server sends the ciphertext result to all participants, and each participant performs a partial decryption operation on the ciphertext result respectively. The specific process is as follows:

[0055] For the given ciphertext in the ciphertext result Participant P i uses its own private key SK i = s i to decrypt the i-th item of the ciphertext, randomly select e z,i ← φ, and calculate to obtain the partial decryption result and return it to the server.

[0056] Then the server returns the set of partial decryption results to the data user, and the data user performs a merging operation on it. The specific process is as follows:

[0057] The server collects the partial decryption results from each participating party and sends the set of partial decryption results to the data user. The data user performs a merging operation to obtain the plaintext result. The merging operation formula is Finally, the data user will obtain the set of plaintext results

[0058] The present invention realizes the ciphertext retrieval function based on a multi-key homomorphic encryption scheme, and supports ciphertext retrieval in an environment with multiple data owners. In step 2, each data owner or data user encrypts the data and uploads it to the server. The server expands the homomorphic ciphertext according to the total number of participating parties, enabling ciphertexts encrypted with different keys to perform operations on each other. Based on this, step 3 realizes the ciphertext retrieval function for the expanded multi-key ciphertext, can find the matching result ciphertext according to the ciphertext query value provided by the data user, and optimizes the performance of the retrieval by using the compression coding technology. The Bloom filter set is used to return all result ciphertexts that meet the retrieval conditions at one time, avoiding repeated execution of the retrieval algorithm, reducing the calculation and storage overhead, and improving the retrieval efficiency. In step 4, the present invention provides a distributed decryption function, which can decrypt the multi-key ciphertext after operation.

[0059] Taking the plaintext data as the data set and the retrieved ciphertext results as the result set, by setting different data set sizes and result set sizes, a retrieval performance comparison is made with the prior art 1. The results are as Figure 3 、 Figure 4 shown. Through Figure 3 、 4 It can be seen that as the data set size and result set size increase, the retrieval time of the method of the present invention increases, but the performance is far superior to that of the prior art 1. At the same time, the influence of the number of participating parties on the multi-key homomorphic encryption algorithm is tested. Through Figure 5 It can be seen that as the number of participating parties increases, the running time of the algorithm also increases, but within an acceptable range.

[0060] ​The present invention discloses a ciphertext retrieval method based on multi-key homomorphic encryption, which can perform retrieval on ciphertexts encrypted with different keys. The data owner and the data user respectively use homomorphic encryption technology to encrypt the data and the query value, and upload the ciphertexts to the server. The server will expand the ciphertexts according to the total number k of the participating parties (including the data owner and the data user) to obtain multi-key form ciphertexts containing k + 1 elements. The expanded ciphertexts can perform homomorphic operations even under different key encryptions and support distributed decryption, and the decryption process is jointly executed by all participating parties. Accordingly, the ciphertext retrieval function of the present invention is realized. At the same time, the present invention also optimizes the retrieval function by applying compression coding technology, and uses a Bloom filter set to return all retrieval results at one time, without repeatedly executing the retrieval algorithm, reducing the calculation and storage overhead, and greatly improving the retrieval performance.

Claims

1. A ciphertext retrieval method based on multi-key homomorphic encryption, characterized in that The implementation is carried out according to the following steps: Step 1: According to the shared security parameters, initialize the participant parameters composed of the data owner and the data user, respectively set the public parameters based on multi-key homomorphic encryption, and construct their own public-private key pairs; The specific process is as follows: Parameter initialization: Assume that there are a total of participants , among which is the data owner, is the data user; Given an integer , the plaintext space , , , there is , the security parameter , the distribution on R; All participants set the public parameters of multi-key homomorphic encryption based on these shared parameters , including the RLWE dimension , the ciphertext modulus , the key distribution and the error distribution ; Key Generation: Data Owner and Data User generate their respective key pairs respectively according to the public parameters and ; Step 2: The data owner and the data user respectively use their public keys to encrypt the plaintext data and the query value to obtain ciphertexts, upload the ciphertexts to the server, and expand the ciphertexts in the server; the specific process is as follows: Step 2.1, Plaintext data encryption: The data owner uses their respective public keys to encrypt the plaintext data, obtaining ciphertext data and uploading the ciphertext data to the server. Assume that after uploading, the server stores a ciphertext set ; Step 2.2, Query Value Encryption: The data user uses the public key to encrypt the query value , obtaining the retrieval token , and uploads the retrieval token to the server; Step 2.3, Ciphertext Expansion: The server will expand the received ciphertext according to the number of participating parties and the serial number of the uploader. The expansion process is as follows: The participating party uploads the homomorphic ciphertext , and the server will expand it according to the number of participating parties and the serial number . The format of the expanded ciphertext is , where , , that is, the ciphertext vector is expanded from 2 dimensions to dimensions, and is kept unchanged. Move to the th position, and fill the remaining positions with 0 to obtain the expanded ciphertext in the multi-key form; Step 3: The server calculates according to the ciphertext corresponding to the query value, finds out the ciphertext results that meet the requirements, and applies the compressed oblivious coding technology to process the ciphertext results that meet the requirements to obtain the coding results, and returns the coding results to the data user; Step 4: If the data user needs to decrypt the coding results, submit a distributed decryption application to the server, decode the coding results in the server to obtain the decoded ciphertext results, the server sends the ciphertext results to all participants, and each participant respectively performs partial decryption operations on the ciphertext results, and then the server returns the set of partial decryption results to the data user, and the data user performs a merging operation on it to obtain the final plaintext result.

2. The ciphertext retrieval method based on multi-key homomorphic encryption according to claim 1, characterized in that, The specific process of generating the respective key pairs is as follows: randomly select R 2Select parameters s ,from R q Select parameter a from Select parameter e and set the private key , public key .

3. The ciphertext retrieval method based on multi-key homomorphic encryption according to claim 1, wherein The specific encryption process of the encrypted plaintext data and the encrypted query value is as follows: Set , , randomly select , calculate the ciphertext , .

4. The ciphertext retrieval method based on multi-key homomorphic encryption according to claim 1, wherein The specific process of finding out the ciphertext results that meet the requirements is as follows: According to the received retrieval token , the server first uses the matching function to match the stored ciphertext set and obtains the indication vector , where , this vector is composed of the ciphertext and the ciphertext . Among them, the ciphertext indicates a successful match, and the ciphertext indicates a failed match; is a matching function related to the input format, with 0 / 1 as the return value. For the matching data that meets the conditions, the function return value is 1, otherwise the return value is 0; the server multiplies the stored ciphertext set by the indication vector to obtain the final result ciphertext set , that is, the ciphertext result that meets the requirements, where , represents homomorphic ciphertext multiplication.

5. The ciphertext retrieval method based on multi-key homomorphic encryption according to claim 1, wherein The specific process of applying the compressed oblivious coding technology to process the ciphertext results that meet the requirements is as follows: Initialize the Bloom filter set , where the parameter , is a shared security parameter, is the upper limit of the total number of elements inserted into the Bloom filter set; Construct a set of hash functions For each ciphertext result that meets the requirements Randomly select a function from the set of hash functions And calculate the function value Where j Is the index of the ciphertext result that meets the requirements. According to the function value Map the ciphertext result to the Bloom filter at the corresponding index, that is, calculate To achieve one update of the Bloom filter set Where + represents the homomorphic addition operation; the server updates the Bloom filter set Which is the encoding result.

6. The ciphertext retrieval method based on multi-key homomorphic encryption according to claim 5, characterized in that The decoding of the encoding result within the server is specifically as follows: The server decodes the Bloom filter set and outputs the ciphertext result stored therein .

7. The ciphertext retrieval method based on multi-key homomorphic encryption according to claim 6, wherein The specific process of each participant respectively performing partial decryption operations on the ciphertext results is as follows: For the given ciphertext in the ciphertext result , the participant uses its own private key to decrypt the th item of the ciphertext, randomly selects , and calculates to obtain a partial decryption result and returns it to the server.

8. The ciphertext retrieval method based on multi-key homomorphic encryption according to claim 6, characterized in that The specific process of the data user performing a merging operation on it is as follows: The server collects the partial decryption results from each participating party and sends the set of partial decryption results to the data user. The data user performs a merging operation to obtain the plaintext result. The merging operation formula is . Finally, the data user will obtain the set of plaintext results .

Images