A publicly verifiable homomorphic encryption method and system

Abstract

This invention discloses a publicly verifiable homomorphic encryption method and system, relating to the field of data encryption and decryption technology. Based on the homomorphic encryption process, the verifiable homomorphic encryption process includes a key generation process, an encryption process, a ciphertext calculation process, a verification calculation process, and a decryption process. The Commitment scheme and the Non-Interactive Witness Indistinguishability Proof (NIWI) algorithm are used to verify the homomorphic encryption process in scenarios where the ciphertext calculation is untrusted, the encryption is untrusted, and the decryption is untrusted.

Description

Technical Field

[0001] This invention discloses a system relating to the field of data encryption and decryption technology, specifically a publicly verifiable homomorphic encryption method and system. Background Technology

[0002] Homomorphic encryption is an algorithm where data is processed and computed entirely in ciphertext form. This algorithm guarantees that computation in ciphertext is equivalent to computation in plaintext, making it highly suitable for outsourced computing and collaborative modeling. However, because data is ciphertext-based, it's difficult to verify whether the computation provider strictly adheres to the agreed-upon requirements. Similarly, untrusted encryptors and decryptors can still engage in malicious encryption and decryption. Therefore, verifying the homomorphic encryption computation process is necessary, but currently, there is no fully mature, publicly verifiable homomorphic encryption method. Summary of the Invention

[0003] This invention addresses the problems of existing technologies by providing a publicly verifiable homomorphic encryption method and system. The homomorphic encryption calculation process is publicly verifiable, preventing the calculation provider from not strictly following the agreed requirements and avoiding untrusted encryptors and decryptors from maliciously interfering with the encryption and decryption processes.

[0004] The specific solution proposed in this invention is as follows:

[0005] This invention provides a publicly disclosed verifiable homomorphic encryption method. Based on a homomorphic encryption process, the verifiable homomorphic encryption process includes a key generation process, an encryption process, a ciphertext calculation process, a verification calculation process, and a decryption process.

[0006] The Commitment scheme and the NIWI algorithm, a non-interactive witness indistinguishability proof, are used to verify homomorphic encryption in scenarios where ciphertext computation is untrusted, encryption is untrusted, and decryption is untrusted.

[0007] Furthermore, in the publicly verifiable homomorphic encryption method, for scenarios where ciphertext computation is untrusted, verification is performed during the homomorphic encryption process using the Commitment scheme and the NIWI algorithm, a non-interactive witness indistinguishability proof, including:

[0008] During key generation, the commitment scheme is used, and based on the security parameter λ, the initialization Com.Setup(1) is executed. λ Generate common parameters pp and execute the homomorphic encryption key generation algorithm HE.Keygen(1 λ Generate a public key pk and a private key sk, and randomly select a random number u. f Using the commitment algorithm Com.Commit(pp,u f Generate commitment c fand return (pp, pk, sk, c) f ),

[0009] During the encryption process, the encryptor uses the decryptor's public key pk to encrypt the data m to obtain c, and then returns c.

[0010] During the encryption computation, the inputs are the public parameter pp, the public key pk, the original ciphertext ct, the computation function f, and the commitment c. f First, the ciphertext data ct is processed according to a predetermined function f to obtain ct*=f(ct). Then, the corresponding proof π is calculated using the NIWI algorithm. f =NIWI.Proof(pp,pk,ct,f,u) f ,ct*,c f ), returns ct* and π f ,

[0011] Verification of the ciphertext calculation process: PVHE.Verify Evaluate(pp,pk,ct,f,ct*,π) f Input: public parameter pp, public key pk, original ciphertext ct, computation function f, and the computed ciphertext ct*, as well as the proof of π. f The NIWI algorithm is used to verify the value v = NIWI.Verify(pp, pk, ct, f, ct*, π). f The function returns v, where v = 1 if the validation passes and v = 0 if the validation fails.

[0012] During the decryption process, the inputs are the public parameter pp, the private key s, and the calculated ciphertext ct*. The private key sk is used to decrypt the ciphertext to obtain f(m).

[0013] Furthermore, in the publicly verifiable homomorphic encryption method, for untrusted encryption scenarios, verification is performed during the homomorphic encryption process using the Commitment scheme and the Non-Interactive Witness Indistinguishability Proof (NIWI) algorithm, including:

[0014] An additional random number u is generated during the key generation process. e Using the commitment algorithm Com.Commit(pp,u e )

[0015] Generate commitment c e Returns (pp, pk, sk, c) e ,c f ),

[0016] During the encryption process, the NIWI algorithm is additionally used to calculate the corresponding proof π. e =

[0017] NIWI.Proof(pp,pk,m,ct,u e ,c e ), returns ct and π e ,

[0018] Verify the encryption process during the computation: PVHE.VerifyEnc(pp,pk,ct,c) e ,π e Input public parameters pp, public key pk, ciphertext ct, computation function f, commitment c e And proof of π e The NIWI algorithm is used to calculate v = NIWI.Verify(pp, pk, ct, c). e ,π e The function returns v, where v = 1 if the verification passes and v = 0 if the verification fails.

[0019] Furthermore, in the publicly verifiable homomorphic encryption method, for decryption of untrusted scenarios, verification is performed during the homomorphic encryption process using the Commitment scheme and the Non-Interactive Witness Indistinguishability Proof (NIWI) algorithm, including:

[0020] An additional random number u is generated during the key generation process. d Using the commitment algorithm Com.Commit(pp,u d Generate commitment c d Returns (pp, pk, sk, c) e ,c d ,c f ),

[0021] During the decryption process, the NIWI algorithm is additionally used to calculate the corresponding proof π. d =NIWI.Proof(pp,pk,f(m),ct*,u d ,c d Return f(m) and π. d ,

[0022] Verification of the decryption process during the calculation: PVHE.VerifyDec(pp,pk,ct,c) d ,π d Input public parameters pp, public key pk, ciphertext ct, computation function f, commitment c d And proof of π d The NIWI algorithm is used to calculate v = NIWI.Verify(pp, pk, ct, f(m), c). d ,π dThe function returns v, where v = 1 if the verification passes and v = 0 if the verification fails.

[0023] This invention also provides a publicly verifiable homomorphic encryption system, including a homomorphic encryption service module and an auditing service module.

[0024] Based on homomorphic encryption, a verifiable homomorphic encryption process includes key generation, encryption, ciphertext calculation, verification calculation, and decryption.

[0025] The homomorphic encryption service module and the audit service module are applied to the verifiable homomorphic encryption process. They respectively use the Commitment scheme and the NIWI algorithm for verification in the homomorphic encryption process for untrusted ciphertext computation scenarios, untrusted encryption scenarios, and untrusted decryption scenarios.

[0026] Furthermore, in a publicly verifiable homomorphic encryption system, for scenarios where ciphertext computation is untrusted, the NIWI algorithm (non-interactive witness indistinguishability proof) is used to verify the homomorphic encryption process, including:

[0027] During key generation, the homomorphic encryption service module utilizes the commitment scheme, based on the security parameter λ, to execute the initialization Com.Setup(1 λ Generate common parameters pp and execute the homomorphic encryption key generation algorithm HE.Keygen(1 λ Generate a public key pk and a private key sk, and randomly select a random number u. f Using the commitment algorithm Com.Commit(pp,u f Generate commitment c f and return (pp, pk, sk, c) f ),

[0028] During the encryption process, the homomorphic encryption service module uses the public key pk of the decryptor to encrypt the data m to obtain c, and then returns c.

[0029] During the encryption computation, the homomorphic encryption service module takes into account the public parameter pp, the public key pk, the original ciphertext ct, the computation function f, and the commitment c. f First, the ciphertext data ct is processed according to a predetermined function f to obtain ct*=f(ct). Then, the corresponding proof π is calculated using the NIWI algorithm. f =

[0030] NIWI.Proof(pp,pk,ct,f,u f ,ct*,c f ), returns ct* and π f ,

[0031] The audit service module verifies the ciphertext calculation process during the verification calculation: PVHE.VerifyEvaluate(pp,pk,ct,f,ct*,π) f Input: public parameter pp, public key pk, original ciphertext ct, computation function f, and the computed ciphertext ct*, as well as the proof of π. f The NIWI algorithm is used to verify the value v = NIWI.Verify(pp, pk, ct, f, ct*, π). f The function returns v, where v = 1 if the validation passes and v = 0 if the validation fails.

[0032] During the decryption process, the homomorphic encryption service module takes into account the public parameter pp, the private key s, and the calculated ciphertext ct*, and uses the private key sk to decrypt it to obtain f(m).

[0033] Furthermore, in a publicly verifiable homomorphic encryption system, for scenarios where encryption is untrusted, the NIWI algorithm (non-interactive witness indistinguishability proof) is used for verification during the homomorphic encryption process, including:

[0034] During the key generation process, the homomorphic encryption service module additionally generates a random number u. e Using the commitment algorithm Com.Commit(pp,u e Generate commitment c e Returns (pp, pk, sk, c) e ,c f ),

[0035] During the encryption process, the homomorphic encryption service module additionally uses the NIWI algorithm to calculate the corresponding proof π. e =NIWI.Proof(pp,pk,m,ct,u) e ,c e ), returns ct and π e ,

[0036] The audit service module verifies the encryption process during the verification calculation using PVHE.VerifyEnc(pp,pk,ct,c). e ,π e Input public parameters pp, public key pk, ciphertext ct, computation function f, commitment c e And proof of π e The NIWI algorithm is used to calculate v = NIWI.Verify(pp, pk, ct, c). e ,π eThe function returns v, where v = 1 if the verification passes and v = 0 if the verification fails.

[0037] Furthermore, in the publicly verifiable homomorphic encryption system, for untrusted decryption scenarios, verification is performed during the homomorphic encryption process using the Commitment scheme and the Non-Interactive Witness Indistinguishability Proof (NIWI) algorithm, including:

[0038] During the key generation process, the homomorphic encryption service module additionally generates a random number u. d Using the commitment algorithm Com.Commit(pp,u d Generate commitment c d Returns (pp, pk, sk, c) e ,c d ,c f ),

[0039] During the decryption process, the homomorphic encryption service module additionally uses the NIWI algorithm to calculate the corresponding proof π. d =NIWI.Proof(pp,pk,f(m),ct*,u d ,c d Return f(m) and π. d ,

[0040] The audit service module verifies the decryption process during the verification calculation process using PVHE.VerifyDec(pp,pk,ct,c). d ,π d Input public parameters pp, public key pk, ciphertext ct, computation function f, commitment c d And proof of π d The NIWI algorithm is used to calculate v = NIWI.Verify(pp, pk, ct, f(m), c). d ,π d The function returns v, where v = 1 if the verification passes and v = 0 if the verification fails.

[0041] This invention also provides an application of a publicly verifiable homomorphic encryption system, which is deployed on a homomorphic encryption client and applied to outsourced computing scenarios and data-sharing computing scenarios for homomorphic encryption verification.

[0042] The advantages of this invention are:

[0043] This invention provides a publicly verifiable homomorphic encryption method that utilizes the commitment scheme and the indistinguishability of non-interactive witnesses to prove that the NIWI algorithm can be publicly verified for homomorphic encryption computation. This prevents computation providers from not strictly following the agreed requirements for computation and avoids untrusted encryptors and decryptors from maliciously interfering with the encryption and decryption process. Attached Figure Description

[0044] Figure 1 This is a schematic diagram of the system deployment of the present invention.

[0045] Figure 2 This is an interactive diagram of the system of the present invention when applied to an outsourced computing scenario.

[0046] Figure 3 This is an interactive diagram of the system of the present invention when applied to a data sharing computing scenario.

[0047] Figure 4 This is an interactive diagram of the system of the present invention when applied to a special data sharing computing scenario. Detailed Implementation

[0048] The present invention will be further described below with reference to the accompanying drawings and specific embodiments, so that those skilled in the art can better understand and implement the present invention. However, the embodiments described are not intended to limit the present invention.

[0049] This invention provides a publicly disclosed verifiable homomorphic encryption method. Based on a homomorphic encryption process, the verifiable homomorphic encryption process includes a key generation process, an encryption process, a ciphertext calculation process, a verification calculation process, and a decryption process.

[0050] The Commitment scheme and the NIWI algorithm, a non-interactive witness indistinguishability proof, are used to verify homomorphic encryption in scenarios where ciphertext computation is untrusted, encryption is untrusted, and decryption is untrusted.

[0051] This invention relates to the basic process of homomorphic encryption algorithms, which mainly include: a key generation algorithm HE.Keygen, an encryption algorithm HE.Enc, a ciphertext calculation algorithm HE.Evaluate, and a decryption algorithm HE.Dec.

[0052] HE.Keygen(1 λ ): Initialize parameters according to the corresponding cryptographic algorithm and security parameter λ to generate public key pk and private key sk.

[0053] HE.Enc(m, pk): The encryptor uses the decryptor's public key pk to encrypt the data m, obtain c, and send it to the ciphertext computer.

[0054] HE.Evaluate(pk,ct,f): Evaluates the encrypted ciphertext data according to the given function f, obtaining ct. * = f(ct).

[0055] HE.Dec(sk,ct * ): Decrypt using the private key sk to obtain f(m).

[0056] This invention relates to the Non-interactive Witness Indistinguishability proof (NIWI) algorithm. NIWI primarily comprises two algorithms: the proof generation algorithm NIWI.Proof and the verification algorithm NIWI.Verify.

[0057] NIWI.Proof(λ,x): Input security parameter λ, statement x, output proof π.

[0058] NIWI.Verify(λ,x,π): Input security parameter λ, statement x, and proof π. Output 1 if the proof is verified correctly, and output 0 if the proof is not verified.

[0059] The NIWI algorithm can be implemented based on technologies such as indistinguishable obfuscators. This invention does not limit the specific NIWI algorithm construction scheme.

[0060] This invention relates to the commitment scheme, which is a deterministic algorithm that mainly includes initialization (Com.Setup), commitment (Com.Commit), and commitment disclosure (Com.Revel).

[0061] Com.Setup(1 λ ): The system is initialized based on the safety parameter λ, and the common parameter pp is generated.

[0062] Com.Commit(pp,x,r): Generates a commitment c based on the common parameter pp, the message x, and the random number r.

[0063] Com.Revel(pp,c): Exposes x and r. If Com.Revel(pp,c) := (x,r), the verification passes and returns 1; otherwise, it returns 0.

[0064] In typical ciphertext computation scenarios, data flows in ciphertext form. The ciphertext computation process is often completed by a third-party service, and the verifiability of the ciphertext computation process must be guaranteed. For untrusted scenarios of ciphertext computation, encryption, and decryption, the present invention proposes a publicly verifiable homomorphic encryption method (PVHE).

[0065] In specific applications, the PVHE in the method of this invention mainly includes: key generation algorithm PVHE.Keygen, encryption algorithm PVHE.Enc, ciphertext calculation PVHE.Evaluate, ciphertext verification calculation PVHE.Verify Evaluate, and decryption algorithm PVHE.Dec.

[0066] For scenarios where ciphertext computation is untrusted, the Commitment scheme and the NIWI algorithm (non-interactive witness indistinguishability proof) are used for verification during homomorphic encryption, including:

[0067] The key generation process involves PVHE.Keygen(1 λ ): Utilizing the commitment scheme Commitment, based on the security parameter λ, execute the initialization Com.Setup(1 λ Generate common parameters pp and execute the homomorphic encryption key generation algorithm HE.Keygen(1 λ Generate a public key pk and a private key sk, and randomly select a random number u. f Using the commitment algorithm Com.Commit(pp,u f Generate commitment c f and return (pp, pk, sk, c) f ),

[0068] The encryption process involves PVHE.Enc(pp,m,pk): the encryptor uses the decryptor's public key pk to encrypt data m to obtain c, and returns c.

[0069] The encryption calculation process involves PVHE.Evaluate(pp,pk,ct,f,u) f ,c f Input public parameters pp, public key pk, original ciphertext ct, computation function f, and commitment c. f First, the ciphertext data ct is processed using a predetermined function f to obtain ct. * =f(ct), and then use the NIWI algorithm to calculate the corresponding proof π. f =NIWI.Proof(pp,pk,ct,f,u) f ,ct* ,c f ), return ct *

[0070] and π f ,

[0071] The verification calculation process involves PVHE.VerifyEvaluate(pp,pk,ct,f,ct) * ,π f Input public parameters pp, public key pk, original ciphertext ct, computation function f, and the computed ciphertext ct. * And proof of π f The verification algorithm NIWI.Verify is used to calculate v = NIWI.Verify(pp, pk, ct, f, ct). * ,π f The function returns v, where v = 1 if the validation passes and v = 0 if the validation fails.

[0072] The decryption process requires the input of the public parameter pp, the private key s, and the calculated ciphertext ct. * The private key sk is used to decrypt the data to obtain f(m). This also verifies the ciphertext calculation process.

[0073] For encrypted untrusted scenarios, the Commitment scheme and the NIWI algorithm, a non-interactive witness indistinguishability proof, are used for verification during homomorphic encryption, including:

[0074] The key generation process involves PVHE.Keygen(1 λ ): Generate additional random numbers u e Using the commitment algorithm Com.Commit(pp,u e Generate commitment c e Returns (pp, pk, sk, c) e ,c f ),

[0075] The encryption process involves PVHE.Enc(pp,m,pk,c) e ): Additionally, the NIWI algorithm is used to calculate the corresponding proof π. e =NIWI.Proof(pp,pk,m,ct,u) e ,c e ), returns ct and π e ,

[0076] Verify the encryption process during the computation: PVHE.VerifyEnc(pp,pk,ct,c) e ,πe Input public parameters pp, public key pk, ciphertext ct, computation function f, commitment c e And proof of π e The NIWI algorithm is used to calculate v = NIWI.Verify(pp, pk, ct, c). e ,π e The function returns v, where v = 1 indicates successful verification and v = 0 indicates failed verification. This also verifies the encryption process.

[0077] For decryption of untrusted scenarios, the Commitment scheme and the NIWI algorithm, a non-interactive witness indistinguishability proof, are used for verification during homomorphic encryption, including:

[0078] The key generation process involves PVHE.Keygen(1 λ ): Generate additional random numbers u d Using the commitment algorithm Com.Commit(pp,u d Generate commitment c d Returns (pp, pk, sk, c) e ,c d ,c f ),

[0079] The decryption process involves PVHE.Dec(pp,sk,ct*,c) d ): Additionally, the NIWI algorithm is used to calculate the corresponding proof π. d =NIWI.Proof(pp,pk,f(m),ct*,u d ,c d Return f(m) and π. d ,

[0080] Verification of the decryption process during the calculation: PVHE.VerifyDec(pp,pk,ct,c) d ,π d Input public parameters pp, public key pk, ciphertext ct, computation function f, commitment c d And proof of π d The NIWI algorithm is used to calculate v = NIWI.Verify(pp, pk, ct, f(m), c). d ,π d The function returns v, where v = 1 if the verification passes and v = 0 if the verification fails. This also verifies the decryption process.

[0081] This invention also provides a publicly verifiable homomorphic encryption system, including a homomorphic encryption service module and an auditing service module.

[0082] Based on homomorphic encryption, a verifiable homomorphic encryption process includes key generation, encryption, ciphertext calculation, verification calculation, and decryption.

[0083] The homomorphic encryption service module and the audit service module are applied to the verifiable homomorphic encryption process. They respectively use the Commitment scheme and the NIWI algorithm for verification in the homomorphic encryption process for untrusted ciphertext computation scenarios, untrusted encryption scenarios, and untrusted decryption scenarios.

[0084] The information interaction and execution process between the modules in the above system are based on the same concept as the method embodiment of the present invention, and the specific details can be found in the description in the method embodiment of the present invention, and will not be repeated here.

[0085] Similarly, the system of the present invention utilizes the commitment scheme and non-interactive witness indistinguishability to prove that the NIWI algorithm can be publicly verified for homomorphic encryption computation process, preventing the computation provider from not strictly following the agreed requirements for computation, and avoiding untrusted encryption and decryption parties from maliciously interfering with the encryption and decryption process.

[0086] It should be noted that not all steps and modules in the above processes and system structure diagrams are mandatory; some steps or modules can be omitted as needed. The execution order of each step is not fixed and can be adjusted as required. The system structure described in the above embodiments can be a physical structure or a logical structure. That is, some modules may be implemented by the same physical entity, or some modules may be implemented by multiple physical entities, or they may be jointly implemented by certain components in multiple independent devices.

[0087] This invention also provides an application of a publicly verifiable homomorphic encryption system, which is deployed on a homomorphic encryption client and applied to outsourced computing scenarios and data-sharing computing scenarios for homomorphic encryption verification.

[0088] The homomorphic encryption client involved in this invention is not limited to forms such as APP, Web, or proprietary clients, and mainly has functions such as generating public and private keys, homomorphic encryption, decryption, and optional proof generation. (See reference.) Figure 1 .

[0089] In the application of this invention system, the data owner (encryptor) is responsible for homomorphically encrypting the original data (HE) and uploading the ciphertext. The public key used for encryption depends on the circumstances.

[0090] Ciphertext computation service provider: responsible for ciphertext hosting and ciphertext computation.

[0091] The public auditor is responsible for publicly verifying and auditing the encryption, decryption, and ciphertext calculation processes, without disclosing the original data during this process.

[0092] Data user (decryptor): Initiates a ciphertext calculation request and downloads the ciphertext calculation result.

[0093] In outsourced computing scenarios, there is no data user; the encryptor and decryptor are the same user, and all encryption uses the data owner's own public key.

[0094] In data-sharing computing scenarios, if the computed ciphertext needs to be processed directly by the data user, it can be encrypted directly using the data user's public key. However, it is important to note that if the original data is sensitive information or the data owner does not want the data user to obtain it, the original ciphertext needs to be protected.

[0095] When the system of this invention is deployed on a local client and applied to outsourced computing scenarios, refer to... Figure 2 The main process is as follows:

[0096] Step 1: The user generates public and private keys using the PVHE.Keygen algorithm on their local client. The public key is sent to the ciphertext calculation server, which binds the UUID to the user's public key; the private key is stored locally. Optionally, the user can generate multiple public and private key pairs, which can be used in different scenarios.

[0097] Step 2: The user encrypts the data using the PVHE.Enc algorithm via the client and uploads the ciphertext to the ciphertext server. Optionally, to facilitate ciphertext retrieval, metadata information should be included when uploading the ciphertext.

[0098] Step 3: The ciphertext server hashes the "ciphertext data + timestamp" to generate a unique DUID for the ciphertext, binds it to the user's UUID, and stores it in the database.

[0099] Step 4: Users create computation tasks according to their needs, such as computation method f and the corresponding ciphertext DUID. Verifiable computation methods are enabled by default.

[0100] Step 5: After completing authentication and verification of the legitimacy of f, the ciphertext computation service obtains the corresponding ciphertext data based on DUID and initiates ciphertext computation. Simultaneously, the ciphertext computation server completes ciphertext computation and proof generation based on the PVHE.Evaluate algorithm.

[0101] Step 6: Upon completion of the ciphertext computation and proof generation, an audit message is automatically sent to the audit server. The audit server verifies the proof based on the PVHE.VerifyEvaluate algorithm, signs the verified result, and sends it to the ciphertext computation server. Optionally, to prevent the ciphertext computation service from viewing or tampering with the audit result, the audit service can encrypt the audit result using the user's public key.

[0102] Step 7: After the calculation task is completed, the user can download the calculated encrypted text and audit results.

[0103] Step 8: If the audit results are correct, decrypt using the local private key.

[0104] Optionally, since the encrypted computation service stores relevant verification information, audit triggering can also be performed manually.

[0105] When the system of this invention is deployed on a local client and applied in a data sharing computing scenario, refer to... Figure 3 The main process is as follows:

[0106] Step 1: The data provider generates public and private keys through a local client. The public key is sent to the encrypted computing server, which binds the UUID and the user's public key. The private key is stored locally.

[0107] Step 2: The data provider performs homomorphic encryption on the data via the client and uploads the ciphertext to the ciphertext server. Optionally, to facilitate ciphertext retrieval, metadata information should be included during ciphertext upload. Optionally, the provider generates an encryption certificate locally and sends the encryption certificate to the audit server.

[0108] Step 3: The audit server performs encryption audit and sends the encryption audit results to the ciphertext calculation service.

[0109] Step 4: The ciphertext server hashes the "ciphertext data + timestamp" to generate a unique DUID for the ciphertext, binds it with the user's UUID and the encryption audit result, and stores it in the database.

[0110] Step 5: The user retrieves data based on metadata or UUID, selects the encrypted data DUID to be calculated, defines the calculation function f, and creates and initiates the calculation task.

[0111] Step 6: Based on the request information, the encrypted computation service initiates an authorization request to the data provider. After the provider grants authorization, the encrypted computation service loads the corresponding encrypted data according to the DUID and performs encrypted computation. Simultaneously, the encrypted computation server generates corresponding proof for the encrypted computation process.

[0112] Step 7: After the ciphertext computation is complete and the proof is generated, an audit message is automatically sent to the audit server. The audit server performs proof verification based on the PVHE.VerifyEvaluate algorithm, signs the verification result, and sends it to the ciphertext computation server.

[0113] Step 8: After the calculation task is completed, the user can view the calculated ciphertext DUID in the task details, and then initiate a decryption request based on the DUID.

[0114] Step 9: The ciphertext server sends a decryption request to the corresponding user's client.

[0115] Step 10: After receiving the request, the client verifies it, decrypts the calculated ciphertext, and then encrypts it using the data user's public key.

[0116] Step 11: The data user downloads the corresponding ciphertext and decrypts it using their local private key.

[0117] For data-sharing computing scenarios with many data providers but few data users, the process is as follows, compared to the aforementioned data-sharing computing scenarios. Figure 4 As shown, the main changes are as follows:

[0118] Step 1: The data provider encrypts the data using the public key of the data user.

[0119] Step 2: When creating a computation task, the computation function f needs to be security verified to prevent the risk of data leakage through function reverse engineering.

[0120] Step 3: The data user cannot obtain the original ciphertext, but only the calculated ciphertext.

[0121] Step 4: The data user can directly decrypt the data without the data provider needing to do so.

[0122] The above-described embodiments are merely preferred embodiments provided to fully illustrate the present invention, and the scope of protection of the present invention is not limited thereto. Equivalent substitutions or modifications made by those skilled in the art based on the present invention are all within the scope of protection of the present invention. The scope of protection of the present invention is defined by the claims.

Claims

1. A publicly verifiable homomorphic encryption method, characterized in that: Based on homomorphic encryption, a verifiable homomorphic encryption process includes key generation, encryption, ciphertext calculation, verification calculation, and decryption. We verify the homomorphic encryption process using the Commitment scheme and the NIWI algorithm, a non-interactive witness indistinguishability proof, for untrusted scenarios of ciphertext computation, encryption, and decryption. For scenarios where ciphertext computation is untrusted, the Commitment scheme and the NIWI algorithm, which provides indistinguishability proofs without interactive witnesses, are used for verification during homomorphic encryption. This includes: during key generation, the Commitment scheme is used, and based on the security parameter λ, initialization is performed using Com.Setup(1). λ Generate common parameters pp and execute the homomorphic encryption key generation algorithm HE.Keygen (1 λ Generate a public key pk and a private key sk, and randomly select a random number u. f Using the commitment algorithm Com.Commit(pp,u f Generate commitment c f and return (pp, pk, sk, c) f ), During the encryption process, the encryptor uses the decryptor's public key pk to encrypt the data m to obtain c, and then returns c. During the encryption computation, the inputs are the public parameter pp, the public key pk, the original ciphertext ct, the computation function f, and the commitment c. f First, the ciphertext data ct is processed using a predetermined function f to obtain ct*=f(ct). Then, the corresponding proof π is calculated using the NIWI algorithm. f = NIWI.Proof(pp, pk, ct, f, u) f , ct*, c f ), returns ct* and π f , Verify the ciphertext calculation process using PVHE.Verify Evaluate (pp, pk, ct, f, ct*, π) f Input: public parameter pp, public key pk, original ciphertext ct, computation function f, and the computed ciphertext ct*, as well as the proof of π. f The NIWI algorithm uses the verification algorithm NIWI.Verify to calculate v = NIWI.Verify(pp, pk, ct, f, ct*, π). f The function returns v, where v=1 indicates successful validation and v=0 indicates failed validation. During the decryption process, the inputs are the public parameter pp, the private key s, and the calculated ciphertext ct*. The private key sk is used to decrypt the ciphertext to obtain f(m).

2. The publicly verifiable homomorphic encryption method according to claim 1, characterized in that: For encrypted untrusted scenarios, the Commitment scheme and the NIWI algorithm, a non-interactive witness indistinguishability proof, are used for verification during homomorphic encryption, including: An additional random number u is generated during the key generation process. e Using the commitment algorithm Com.Commit(pp, u e Generate commitment c e Returns (pp, pk, sk, c) e ,c f ), During the encryption process, the NIWI algorithm is additionally used to calculate the corresponding proof π. e = NIWI.Proof(pp, pk, m, ct, u) e ,c e ), returns ct and π e , Verify the encryption process during the computation: PVHE.VerifyEnc(pp, pk, ct, c) e , π e Input public parameters pp, public key pk, ciphertext ct, computation function f, commitment c e And proof of π e The NIWI algorithm is used to calculate v = NIWI.Verify(pp, pk, ct, c). e , π e The function returns v, where v=1 indicates successful verification and v=0 indicates failed verification.

3. A publicly verifiable homomorphic encryption method according to claim 1, characterized in that, for untrusted decryption scenarios, verification is performed during the homomorphic encryption process using the Commitment scheme and the Non-Interactive Witness Indistinguishability Proof (NIWI) algorithm, including: An additional random number u is generated during the key generation process. d Using the commitment algorithm Com.Commit(pp, u d Generate commitment c d Returns (pp, pk, sk, c) e ,c d , c f ), During the decryption process, the NIWI algorithm is additionally used to calculate the corresponding proof π. d = NIWI.Proof(pp,pk ,f(m), ct*,u d , c d Return f(m) and π. d , Verify the decryption process during the verification calculation: PVHE.VerifyDec (pp, pk, ct, c) d , π d Input public parameters pp, public key pk, ciphertext ct, computation function f, commitment c d And proof of π d The NIWI algorithm is used to calculate v = NIWI.Verify(pp, pk, ct, f(m), c) using the NIWI verification algorithm. d , π d The function returns v, where v=1 indicates successful verification and v=0 indicates failed verification.

4. A publicly verifiable homomorphic encryption system, characterized in that: Includes a homomorphic encryption service module and an audit service module. Based on homomorphic encryption, a verifiable homomorphic encryption process includes key generation, encryption, ciphertext calculation, verification calculation, and decryption. The homomorphic encryption service module and audit service module are applied to the verifiable homomorphic encryption process. They respectively utilize the Commitment scheme and the NIWI algorithm for non-interactive witness indistinguishability proof during the homomorphic encryption process to verify the encryption in scenarios where ciphertext computation is untrusted, encryption is untrusted, and decryption is untrusted. For scenarios where ciphertext computation is untrusted, the Commitment scheme and the NIWI algorithm (non-interactive witness indistinguishability proof) are used for verification during homomorphic encryption, including: During key generation, the homomorphic encryption service module utilizes the commitment scheme, based on the security parameter λ, to execute the initialization Com.Setup(1 λ Generate common parameters pp and execute the homomorphic encryption key generation algorithm HE.Keygen (1 λ Generate a public key pk and a private key sk, and randomly select a random number u. f Using the commitment algorithm Com.Commit(pp, u f Generate commitment c f and return (pp, pk, sk, c) f ), During the encryption process, the homomorphic encryption service module uses the public key pk of the decryptor to encrypt the data m to obtain c, and then returns c. During the encryption computation, the homomorphic encryption service module takes into account the public parameter pp, the public key pk, the original ciphertext ct, the computation function f, and the commitment c. f First, the ciphertext data ct is processed using a predetermined function f to obtain ct*=f(ct). Then, the corresponding proof π is calculated using the NIWI algorithm. f = NIWI.Proof(pp, pk, ct, f, u) f , ct*, c f ), returns ct* and π f , The audit service module verifies the encrypted calculation process using PVHE.VerifyEvaluate(pp, pk, ct, f, ct*, π). f Input: public parameter pp, public key pk, original ciphertext ct, computation function f, and the computed ciphertext ct*, as well as the proof of π. f The NIWI algorithm uses the verification algorithm NIWI.Verify to calculate v = NIWI.Verify(pp, pk, ct, f, ct*, π). f The function returns v, where v=1 indicates successful validation and v=0 indicates failed validation. During the decryption process, the homomorphic encryption service module takes into account the public parameter pp, the private key s, and the calculated ciphertext ct*, and uses the private key sk to decrypt it to obtain f(m).

5. A publicly verifiable homomorphic encryption system according to claim 4, characterized in that: For encrypted untrusted scenarios, the Commitment scheme and the NIWI algorithm, a non-interactive witness indistinguishability proof, are used for verification during homomorphic encryption, including: During the key generation process, the homomorphic encryption service module additionally generates a random number u. e Using the commitment algorithm Com.Commit(pp, u e Generate commitment c e Returns (pp, pk, sk, c) e ,c f ), During the encryption process, the homomorphic encryption service module additionally uses the NIWI algorithm to calculate the corresponding proof π. e = NIWI.Proof(pp, pk, m, ct, u) e , c e ), returns ct and π e , The audit service module verifies the encryption process during the verification calculation using PVHE.VerifyEnc(pp, pk, ct, c). e ,π e Input public parameters pp, public key pk, ciphertext ct, computation function f, commitment c e And proof of π e The NIWI algorithm is used to calculate v = NIWI.Verify(pp, pk, ct, c). e , π e The function returns v, where v=1 indicates successful verification and v=0 indicates failed verification.

6. A publicly verifiable homomorphic encryption system according to claim 4, characterized in that, for untrusted decryption scenarios, verification is performed during the homomorphic encryption process using the Commitment scheme and the Non-Interactive Witness Indistinguishability Proof (NIWI) algorithm, including: During the key generation process, the homomorphic encryption service module additionally generates a random number u. d Using the commitment algorithm Com.Commit(pp, u d Generate commitment c d Returns (pp, pk, sk, c) e ,c d , c f ), During the decryption process, the homomorphic encryption service module additionally uses the NIWI algorithm to calculate the corresponding proof π. d = NIWI.Proof(pp,pk ,f(m), ct*, u d , c d Return f(m) and π. d , The audit service module verifies the decryption process during the verification calculation: PVHE.VerifyDec(pp, pk, ct, c) d , π d Input public parameters pp, public key pk, ciphertext ct, computation function f, commitment c d And proof of π d The NIWI algorithm is used to calculate v = NIWI.Verify(pp, pk, ct, f(m), c) using the NIWI verification algorithm. d , π d The function returns v, where v=1 indicates successful verification and v=0 indicates failed verification.

7. An application method for a publicly verifiable homomorphic encryption system, characterized in that: The publicly verifiable homomorphic encryption system according to any one of claims 4-6 is deployed on a homomorphic encryption client, and the publicly verifiable homomorphic encryption system is applied to outsourced computing scenarios and data sharing computing scenarios respectively for homomorphic encryption verification.

Images