A Fast Method for Ciphertext Inner Product Calculation Based on Block Coding
By combining block coding and homomorphic encryption, the problems of privacy leakage and low efficiency in vector inner product calculation are solved, and secure and efficient vector inner product calculation is achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- NO 30 INST OF CHINA ELECTRONIC TECH GRP CORP
- Filing Date
- 2023-05-29
- Publication Date
- 2026-07-17
Smart Images
Figure CN116561784B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of data encryption technology, and in particular relates to a fast method for calculating the inner product of ciphertext based on block encoding. Background Technology
[0002] The inner product operation is one of the most fundamental operations between vectors, serving as the basis for calculating distance between vectors, vector similarity, matrix multiplication, and other operations. It is widely used in machine learning, computer graphics, and other fields. As a basic operation, the inner product operation is mostly performed on plaintext data. If the computation is malicious, sensitive information contained in the vector can be leaked. Furthermore, if a malicious third party is present during the computation, they can directly steal the plaintext data and obtain private information. Clearly, the inner product operation performed on plaintext carries the risk of privacy data leakage.
[0003] On the other hand, the method of encrypting the original vector using simple homomorphic encryption and other techniques can protect privacy during the vector inner product calculation process. However, when the vector dimension is not high, there is a disadvantage of low ciphertext space utilization, and the efficiency is not high as only one vector inner product is calculated at a time. Summary of the Invention
[0004] The purpose of this invention is to overcome the problems of existing technologies by disclosing a fast method for calculating encrypted inner products based on block coding. This invention solves the privacy leakage problem in the current vector inner product operation process, prevents malicious computing parties or malicious third parties from easily obtaining plaintext sensitive data during the inner product calculation process, and protects privacy.
[0005] The objective of this invention is achieved through the following technical solution:
[0006] A fast method for calculating the inner product of ciphertext based on block coding, the method comprising the following steps:
[0007] S1: Vector expansion step, which expands the plaintext vectors of each inner product by padding them with zeros;
[0008] S2: Block coding step, based on block coding, the vector is packaged and encoded in two forms, including: single vector repetition coding and several vectors concatenated coding;
[0009] S3: Homomorphic encryption step, using homomorphic encryption method to encrypt the plaintext polynomial that has completed block encoding in S2 to obtain the ciphertext polynomial;
[0010] S4: Fast calculation steps for ciphertext inner product, based on the ciphertext polynomial after two forms of packet encoding and encryption, utilizes the local summation algorithm of the packet vectors inside a single ciphertext to realize the batch calculation of the inner product of vectors in the ciphertext field;
[0011] S5: Decryption steps of the ciphertext inner product matrix: Decrypt each element of the ciphertext matrix to obtain the plaintext polynomial matrix;
[0012] S6: Decoding steps for the ciphertext inner product matrix: Decode each element in the plaintext polynomial matrix in turn to obtain the inner product of the plaintext packed vectors.
[0013] S7: Step to obtain the result of vector convolution operation. Extract the inner product values of each vector obtained in S6 to obtain the inner product matrix of all vectors.
[0014] According to a preferred embodiment, in step S2, the single vector is repeatedly encoded as follows: several repeated extended vectors are packaged and encoded into a plaintext polynomial.
[0015] According to a preferred embodiment, in step S2, the concatenation encoding of several vectors is as follows: all vectors are grouped, and if the last group has insufficient vectors, the zero vector is used instead; and the expanded vectors in each group are concatenated and packaged into a plaintext polynomial.
[0016] According to a preferred embodiment, in step S1, the plaintext vectors of each inner product to be calculated are v1, v2, ..., v s Each vector has a length of d, i.e., v i ={v i，1 v i，2 , ..., u i，d}, 1≤i≤s; Let N represent the number of plaintext slots; Let k be a factor of N, i.e., k|N, and k≥d; Let t=N / k, z=kd.
[0017] According to a preferred embodiment, step S4 specifically includes:
[0018] S41: For the two forms of ciphertext polynomials ctxt and bctxt obtained in S3, calculate and obtain the difference C between the two ciphertext polynomials in the ciphertext field. i，j =HE.Sub(ctxt) i bctxt j ), i = 1, ..., s, j = 1, 2, ..., r, where ctxt is: a ciphertext polynomial for repeated encoding of a single ciphertext, and bctxt is: a ciphertext polynomial for concatenated encoding of several vectors;
[0019] S42: Perform homomorphic multiplication on the difference between the two ciphertext polynomials to obtain C. i，j=HE.Square(C i，j ), i=1,...,s,j=1,2,...,r;
[0020] S43: Calculate the local sum C of the internal vectors of the ciphertext. i，j =PartialSum(C i，j , k), where k represents the length of a single vector packed internally;
[0021] S44: Obtain a ciphertext inner product matrix c, where C i，j This represents the inner product of the i-th vector and the j-th group of packed vectors.
[0022] According to a preferred embodiment, step S5 includes:
[0023] For each element C of the ciphertext matrix C i，j Decrypting the plaintext polynomial matrix P, where i = 1, ..., s, j = 1, 2, ..., r, yields the matrix P, i.e., the matrix elements P. i，j =HE,Decrypt(C i，j ), i=1,...,s, j=1,2,...,r.
[0024] According to a preferred embodiment, step S6 includes:
[0025] Decode each element of the plaintext polynomial matrix P sequentially to obtain the inner product VProd of the plaintext packet vectors. i，j =HE,Decode(P i，j ), i = 1, ..., s, j = 1, 2, ..., r, containing vector v i The inner product of i = 1, ..., s with the j-th group of packed vectors.
[0026] According to a preferred embodiment, step S7 includes:
[0027] Extract the inner product values of all vectors to obtain the inner product matrix Prod, which consists of the matrix elements.
[0028] The aforementioned main solution of the present invention and its various further alternative solutions can be freely combined to form multiple solutions, all of which are solutions that can be adopted and are claimed by the present invention. Those skilled in the art, after understanding the solution of the present invention, will realize that there are many combinations based on existing technology and common knowledge, all of which are technical solutions to be protected by the present invention, and will not be exhaustively listed here.
[0029] The beneficial effects of this invention are:
[0030] This invention discloses a fast method for calculating ciphertext inner products based on block encoding. When an untrusted computation party calculates the vector inner product, they cannot obtain the original data information of the vector. Furthermore, a malicious third party cannot steal any information contained in the ciphertext and perform malicious operations during the entire encrypted calculation process of the vector inner product. The fast method for calculating ciphertext inner products proposed in this invention can be applied to scenarios requiring matrix-vector operations, such as machine learning and computer graphics, providing security protection for the calculation of vector inner products. Attached Figure Description
[0031] Figure 1 This is a schematic diagram of the fast calculation method for ciphertext inner product based on block encoding according to the present invention. Detailed Implementation
[0032] The following specific examples illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that, unless otherwise specified, the following embodiments and features described therein can be combined with each other.
[0033] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.
[0034] Example 1:
[0035] refer to Figure 1 As shown in the figure, a fast method for calculating the inner product of ciphertext based on block coding is illustrated. The fast method for calculating the inner product of ciphertext includes the following steps.
[0036] Step S1: Vector expansion step, which expands the plaintext vectors of each inner product by padding them with zeros.
[0037] In step S1, the plaintext vectors of each inner product to be calculated are v1, v2, ..., v s Each vector has a length of d, i.e., v i ={ vi，1 v i，2 , ..., v i，d Let N represent the number of plaintext slots (which can be set to a power of 2). Let k be a factor of N, i.e., k|N, and k≥d; let t=N / k, z=kd.
[0038] The zero-padding extension specifically includes: for each v i ={v i，1v i，2 , ..., v i，d}, 1≤i≤s, first pad it with zeros to make it a degree k, that is
[0039] Step S2: Block encoding step. Based on block encoding, the vector is packaged and encoded in two forms, including: single vector repetition encoding and several vectors concatenated encoding.
[0040] Preferably, in step S2, the single vector is repeatedly encoded as follows: several repeated extended vectors are packaged and encoded into a plaintext polynomial.
[0041] Specifically, this can be achieved by expanding t vectors v′. i Packed and encoded as a plaintext polynomial ptxt i That is, ptxt i =HE.Encode(v′) i , v′ i ,...,v′ i ), i = 1, ..., s.
[0042] Preferably, in step S2, the concatenation encoding of several vectors is as follows: all vectors are grouped, and if the last group has insufficient vectors, the zero vector is used instead; and the expanded vectors in each group are concatenated and packaged into a plaintext polynomial.
[0043] Specifically, this can be achieved by: taking all s vectors v1, v2, ..., v s Divide the vectors into groups of t. If the last group has insufficient vectors, replace it with the zero vector. Group vectors.
[0044] Concatenate the expanded t vectors in each group and encode them into a plaintext polynomial bptxt. j j = 1, 2, ..., r, such as the first group of vector concatenation encoding, bptxt1 = HE.Encode(v′1, v′2, ..., v′ t ).
[0045] Based on block coding, plaintext vectors are packaged and encoded in two ways: single vector repetition coding and multiple vector concatenation coding. This greatly improves the utilization of plaintext slots, avoids wasting space, and can also greatly reduce memory overhead in practical applications.
[0046] Furthermore, the block coding mode allows multiple vector codes to be encrypted into a single ciphertext. Therefore, in the subsequent calculation of the inner product of the ciphertext, completing one calculation operation is equivalent to calculating the inner product of the plaintext multiple times, achieving the effect of batch calculation of the inner product and greatly improving the efficiency of ciphertext calculation.
[0047] Step S3: Homomorphic encryption step, using homomorphic encryption method to encrypt the plaintext polynomial that has completed block encoding in S2 to obtain the ciphertext polynomial.
[0048] Specifically, the encryption for a single vector repetition encoding is as follows: homomorphic encryption is performed on each plaintext polynomial to obtain the corresponding ciphertext polynomial ctxt. i ctxt i =HE.Encrypt(ptxt) i ), i = 1, ..., s.
[0049] Encryption of several vector concatenations is achieved by: encoding each plaintext polynomial bptxt j Homomorphic encryption is performed on j = 1, 2, ..., r to obtain the ciphertext polynomial bctxt j j = 1, 2, ..., r, i.e., bctxt j =HE.Encrypt(bptxt) j ), j = 1, 2, ..., r.
[0050] Homomorphic encryption allows homomorphic addition and multiplication operations to be performed without decrypting the data, protecting data security during computation and representing a potential solution to prevent privacy breaches. Furthermore, some homomorphic encryption schemes (such as BFV and CKKS schemes) also support batch encoding of multiple plaintext data, converting them into corresponding ciphertext, and then performing calculations on the ciphertext fields, which significantly improves computational efficiency. The main algorithms included in homomorphic encryption schemes are as follows:
[0051] (1) HE.KeyGen(λ): Key generation algorithm, select algorithm parameter λ, output public key pk, private key sk, calculate key evk.
[0052] (2) HE.Encode(v): Encoding algorithm that encodes a numerical vector v and outputs a plaintext polynomial m on a ring.
[0053] (3) HE.Enc pk (m): Encryption algorithm that uses a public key to encrypt plaintext m and outputs ciphertext c.
[0054] (4) HE.Dec sk (c): Decryption algorithm, which uses the public key to encrypt the ciphertext c and outputs the plaintext m.
[0055] (5) HE.Decode(m): Decoding algorithm, which decodes a plaintext polynomial m on a ring and outputs a numerical vector v.
[0056] (6) HE.Add evk (e1, c2): Homomorphic addition operation, where c1 and c2 are the corresponding ciphertexts of m1 and m2, respectively, and the output is c. add It is the corresponding ciphertext of m1+m2.
[0057] (7) HE.Mul evk (c1, c2): Homomorphic multiplication operation, c1 and c2 are the corresponding ciphertexts of m1 and m2 respectively, output c mul It is the corresponding ciphertext of m1×m2.
[0058] (8) HE.RotateLeft(c, i) shifts the corresponding plaintext slot element in ciphertext c to the left by i positions.
[0059] (9) HE.RotateRight(c, i) shifts the plaintext slot element corresponding to the ciphertext c to the right by i positions.
[0060] Homomorphic encryption offers the advantage of ciphertext computation. Throughout the entire calculation of the ciphertext vector inner product, the original data of the vector is never exposed to the computer or a malicious third party, thus ensuring the privacy of the data owner.
[0061] Step S4: Fast calculation of ciphertext inner product. Based on the ciphertext polynomial after two forms of packet encoding encryption, the algorithm of local summation of packet vectors within a single ciphertext is used to realize the batch calculation of vector inner product in the ciphertext field.
[0062] Specifically, as shown in Table 2, step S4 includes:
[0063] S41: For the two forms of ciphertext polynomials ctxt and bctxt obtained in S3, calculate and obtain the difference C between the two ciphertext polynomials in the ciphertext field. i，j =HE.Sub(ctxt) i bctxt j ), i = 1, ..., s, j = 1, 2, ..., r, where ctxt is: a ciphertext polynomial for repeated encoding of a single ciphertext, and bctxt is: a ciphertext polynomial for concatenated encoding of several vectors.
[0064] S42: Perform homomorphic multiplication on the difference between the two ciphertext polynomials to obtain C. i，j =HE.Square(C i，j ), i=1,...,s,j=1,2,...,r;
[0065] S43: Calculate the local sum C of the internal vectors of the ciphertext. i，j =PartialSum(C i，j , k), where k represents the length of a single vector packed internally.
[0066] Furthermore, the algorithm for locally summing the packet vectors corresponding to the ciphertext can be: Let a ciphertext c = HE.Encrypt(v1, v2, ..., v t ), where v i Let Sv1 be a vector of dimension k. Locally sum the packet vectors corresponding to the ciphertext c to obtain the new ciphertext c' = HE.Encrypt(Sv1, Sv2, ..., Sv...). t ),in
[0067] Furthermore, as shown in Table 1, the specific steps of the algorithm for locally summing the packet vector corresponding to the ciphertext are as follows:
[0068] ① Initialize an auxiliary vector and encode it as a plaintext polynomial. Let c' represent the concatenation of t vectors of length k, and initialize c' = c;
[0069] ② Set the loop variable j = logk-1;
[0070] ③ Calculate tmp = HE.RotateRight(init, 2) sequentially using homomorphic shift, homomorphic addition, and homomorphic multiplication operations. j ), s1=HE.Mul(init, c′), s2=HE.Mul(tmp, c′), s2=HE.RotateLeft(s2, 2 j c′=HE.Add(s1,s2);
[0071] ④ If the loop variable j > 0, then calculate tmp = HE.RotateLeft(tmp, 2 j +2 j-1 ), init=HE.Mul(tmp, init);
[0072] ⑤ The loop variable j = j-1. If j ≥ 0, then return to step ③.
[0073] ⑥ Reset the loop variable j = 0;
[0074] ⑦ Calculate tmp = HE.RotateRight(c', 2j) and c' = HE.Add(c', tmp) in sequence;
[0075] ⑧ The loop variable j = j + 1. If j < log k, then return to step ⑦.
[0076] ⑨ Return the new ciphertext c', which represents the result of the local summation of the ciphertext packing vector.
[0077] Table 1 Local Summation of Packing Vectors Within a Single Ciphertext
[0078]
[0079]
[0080] S44: Obtain a ciphertext inner product matrix C, where C i，j This represents the inner product of the i-th vector and the j-th group of packed vectors.
[0081] Table 2 Batch calculation of the inner product of vectors in the ciphertext field: CInnerProd(ctxt, bctxt, s, r, k)
[0082]
[0083] Step S5: Decryption of the ciphertext inner product matrix. Decrypt each element of the ciphertext matrix to obtain the plaintext polynomial matrix.
[0084] Preferably, step S5 includes: processing each element C of the ciphertext matrix C. i，j Decrypting the plaintext polynomial matrix P, where i = 1, ..., s, j = 1, 2, ..., r, yields the matrix P, i.e., the matrix elements P. i，j =HE,Decrypt(C i，j ), i=1,...,s, j=1,2,...,r.
[0085] Step S6: Decoding the ciphertext inner product matrix. Decode each element in the plaintext polynomial matrix in turn to obtain the inner product of the plaintext packing vector.
[0086] Preferably, step S6 includes: decoding each element of the plaintext polynomial matrix P sequentially to obtain the inner product of the plaintext packet vectors, VProd. i，j =HE,Decode(P i，j ), i = 1, ..., s, j = 1, 2, ..., r, containing vector v i The inner product of i = 1, ..., s with the j-th group of packed vectors.
[0087] Step S7: Obtain the result of vector convolution operation. Extract the inner product values of each vector obtained in S6 to obtain the inner product matrix of all vectors.
[0088] Preferably, step S7 includes: extracting the inner product values of all vectors to obtain the inner product matrix Prod, i.e., the matrix elements.
[0089] This invention discloses a fast method for calculating ciphertext inner products based on block encoding. When an untrusted computation party calculates the vector inner product, they cannot obtain the original data information of the vector. Furthermore, a malicious third party cannot steal any information contained in the ciphertext and perform malicious operations during the entire encrypted calculation process of the vector inner product. The fast method for calculating ciphertext inner products proposed in this invention can be applied to scenarios requiring matrix-vector operations, such as machine learning and computer graphics, providing security protection for the calculation of vector inner products.
[0090] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.
Claims
1. A fast method for calculating the inner product of ciphertext based on block coding, characterized in that, The fast method for calculating the inner product of ciphertext includes the following steps: S1: Vector expansion step, which expands the plaintext vectors of each inner product by padding them with zeros; S2: Block coding step, based on block coding, the vector is packaged and encoded in two forms, including: single vector repetition coding and several vectors concatenated coding; S3: Homomorphic encryption step, using homomorphic encryption method to encrypt the plaintext polynomial that has completed block encoding in S2 to obtain the ciphertext polynomial; S4: Fast calculation steps for ciphertext inner product, based on the ciphertext polynomial after two forms of packet encoding and encryption, utilizes the local summation algorithm of the packet vectors inside a single ciphertext to realize the batch calculation of the inner product of vectors in the ciphertext field; S5: Decryption steps of the ciphertext inner product matrix: Decrypt each element of the ciphertext matrix to obtain the plaintext polynomial matrix; S6: Decoding steps for the ciphertext inner product matrix: Decode each element in the plaintext polynomial matrix in turn to obtain the inner product of the plaintext packed vectors. S7: Steps for obtaining the results of vector convolution operation: Extract the inner product values of each vector obtained in S6 to obtain the inner product matrix of all vectors; In step S1, the plaintext vector of each inner product to be calculated is: The length of each vector is d ,Right now ;make Indicate the number of plaintext slots; let yes One of the factors, namely ,and ;make , ; Step S4 specifically includes: S41: Ciphertext polynomials in two forms obtained from S3 and The difference between the two ciphertext polynomials is calculated and obtained in the ciphertext field. ,in, For: a ciphertext polynomial that is repeatedly encoded with a single ciphertext. For: a ciphertext polynomial encoded by concatenating several vectors; S42: Perform homomorphic multiplication on the difference between the two ciphertext polynomials to obtain... ; S43: Calculate the local sum of the internal vectors of the ciphertext to obtain... ,in Indicates the length of a single vector packed internally; S44: Obtain a ciphertext inner product matrix Ciphertext inner product matrix medium elements Indicates the first The vector and the first The inner product of all grouped vectors.
2. The fast ciphertext inner product calculation method based on block coding as described in claim 1, characterized in that, In step S2, the single vector is repeatedly encoded as follows: several repeated extended vectors are packaged and encoded into a plaintext polynomial.
3. The fast ciphertext inner product calculation method based on block coding as described in claim 1, characterized in that, In step S2, several vectors are concatenated and encoded as follows: All vectors are grouped, and if the last group has insufficient vectors, the zero vector is used instead. The expanded vectors in each group are then concatenated and packaged into a plaintext polynomial.
4. The fast method for calculating the inner product of ciphertext based on block coding as described in claim 1, characterized in that, Step S5 includes: inner product matrix of ciphertext Each element Decryption yields the plaintext polynomial matrix. , i.e., matrix elements .
5. The fast ciphertext inner product calculation method based on block coding as described in claim 4, characterized in that, Step S6 includes: For plaintext polynomial matrices Each element in the vector is decoded sequentially to obtain the inner product of the plaintext packet vectors. It contains vectors With the The inner product of grouped vectors.
6. The fast calculation method for ciphertext inner product based on block coding as described in claim 5, characterized in that, Step S7 includes: Extract the inner product values of all vectors to obtain the inner product matrix of all vectors. , i.e., matrix elements .