Lattice-based Additive Homomorphic Threshold Decryption Method

Abstract

The present invention discloses a lattice-based additive homomorphic threshold decryption method, which determines the organizations that need collaborative decryption and the members within each organization, and sets a threshold for collaborative decryption for each organization; the system is initialized to generate public parameters, a master public key, and a master private key. When generating the master private key, a polynomial is defined for each organization; for the members of each organization, user public keys and user private keys are generated according to the corresponding polynomial; the system encrypts the message, and when a member wants to decrypt the ciphertext, each organization must invite at least members exceeding the organization's threshold to form a decryption set to participate in the decryption, and the system will verify and collaboratively decrypt after the collaborative information is calculated. The present invention is more suitable for scenarios that require flexible access structures, such as banks, FL, etc. At the same time, compared with other lattice-based solutions, the present invention has higher computational efficiency, and compared with other solutions based on traditional problems, our invention can resist quantum attacks.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a lattice-based additive homomorphic threshold decryption method. Background Art

[0002] Federated learning is a new computing approach that allows users to collaboratively train more optimized models. Many users, such as mobile devices or organizations, collaborate to train a model under the coordination of a central server, while maintaining the decentralization and distribution of training data. It embodies the principles of centralized data collection and minimization, alleviating many of the privacy, security risks, and costs associated with traditional centralized machine learning and data science approaches. Consequently, research and applications in this area have garnered significant attention in recent years. However, in traditional centralized federated learning architectures, each participant has access to the final trained model, which may not meet practical needs.

[0003] For example, suppose two organizations, A1 and A2, both participate in building a federated model. A1 has n1 members, and A2 has n2 members. In a traditional centralized federated model architecture, all participating members have unconditional access to the trained federated learning model. However, in some cases, for example, due to commercial competition or confidentiality considerations, the two organizations may not allow individual members to independently access the training model results. However, the traditional (t, n) threshold scheme does not provide an effective solution. Summary of the Invention

[0004] The purpose of the present invention is to provide a lattice-based additive homomorphic threshold decryption method that solves the above problems, has more flexible multi-user set access control, and prevents quantum computing attacks.

[0005] In order to achieve the above object, the technical solution adopted by the present invention is as follows: a lattice-based additive homomorphic threshold decryption method, comprising the following steps;

[0006] (1) Determine the organizations that need collaborative decryption and the members in each organization, and set a threshold for collaborative decryption for each organization. The number of organizations is l, and for the gth organization A g , the threshold is t g , and t g No more than A g The number of members, g = 1 ~ l;

[0007] (2) System initialization: input security parameters, generate public parameters parmas = {p, q, H, t1, ..., t l}、Master public key MPK={A,u,B}、Master private key MSK={v1,...vg ,f1(x),..f l (x), T}, specifically including (21)-(26);

[0008] (21) From the set of positive integers Z + Select two parameters p and q, wherein the greatest common factor of p and q is gcd(p,q)=1;

[0009] (22) Define a hash function H, which is used to Mapping to Z q , is an n-dimensional vector, and each element in the vector comes from the residue class ring of integer modulo q, the Z q is a set of integers, and each element in the set comes from the residue class ring of integers modulo q;

[0010] (23) Generate a uniformly distributed first matrix Randomly generate the first vector e p ∈χ n and 1 with organizations A1~A l The corresponding second vector v1v l , v1v l All belong to in, represents an n-row and m-column matrix, and each element in the matrix comes from the residue class ring of integer modulo q, χ n represents the Gaussian distribution in n dimensions, represents an m-dimensional vector, and each element in the vector comes from the residue class ring of integers modulo q;

[0011] (24) Define a polynomial for each organization, where organization A g The polynomial f g (x) is:

[0012]

[0013] Where, is a randomly selected t g -1 vector, j=1~t g -1, x is the polynomial f g (x) variables;

[0014] (25) Use TrapGen(q,m) algorithm to generate the second matrix The third matrix T∈Z m×m , Z m×m Represents an integer matrix with m rows and m columns;

[0015] (26) The system generates public parameters parmas = {p, q, H, t1, t2, ..., t l}、Master public key MPK={A,u,B}、Master private key MSK={v1,v2,...v l f1(x), f2(x), ...f l (x), T};

[0016] (3) Key generation phase: The system generates a user private key and a user public key for each member based on the public parameters, the master private key and the identity ID of each member, where organization A g The user private key of member i is sk i,g ={sk 1_i,g ,sk 2_i,g}, the user's public key is pk i,g ,sk 1_i,g The first part of the user's private key, sk 2_i,g The second part of the user's private key;

[0017] (4) Encryption phase: The system encrypts a message M that needs to be collaboratively decrypted using public parameters and the master public key, and outputs a ciphertext c = {c1, c2}, where c1 is the first ciphertext and c2 is the second ciphertext.

[0018] (5) When a member wants to decrypt the ciphertext, he invites several other members to form a decryption group, and each member in the decryption group becomes a decryption participant;

[0019] (6) Collaborative information computing;

[0020] (61) Each decryption participant randomly generates the first decryption vector. If the decryption participant is organization A g If member i is in the ciphertext, then the first decryption vector is e 3_i，g ∈x n ;

[0021] (62) The decryption participant calculates the second decryption vector based on the first decryption vector, and organization A g The second decryption vector of member i is c i,g =c1sk 1_i,g +pe 3_i,g ;

[0022] (7) System verification and collaborative decryption;

[0023] (71) Statistics of decryption participants in the decryption set in organizations A1~A l The number n1~n l ;

[0024] (72) If the decryption participant is in A1~A l are distributed in tissue Ag , if n g ≥t g , then proceed to the next step, otherwise the verification fails;

[0025] (73) For each decryption participant, calculate its Lagrange coefficient, for organization A g The Lagrange coefficient of the kth decryption participant is L k,g ;

[0026] (74) Calculate a sum for each organization, organization A g The sum of Where c k，g For Organization A g The second decryption vector of the kth decryption participant;

[0027] (75) Calculate the collaborative decryption message M′, M′=c2-SUM1-…-SUM l ;

[0028] (76) The message M is obtained according to the formula M≡M′(mod p) and sent to the decryption participant, where mod is the congruence symbol.

[0029] As a preference: the step (3) is specifically as follows;

[0030] (31) For each member, randomly select a different secret value, where organization A g The secret value of member i in is x i，g ∈Z q ;

[0031] (32) Generate an error vector for each secret value, where the secret value x i，g Vector error

[0032] (33) Substitute the secret value of each user into the polynomial f g (x), generate a membership polynomial, where organization A g The member polynomial corresponding to member i in The generation method is to let f g (x) where x=x i，g , solve

[0033] (34) Using algorithms Generate user vector and θ is the length constraint of the user vector, Z m is an m-dimensional vector, and each element in the vector is an integer;

[0034] (35) Generate user private key and user public key and send them to corresponding members, among which organization A g The user private key of member i in is

[0035] As a preference: the step (4) is specifically as follows;

[0036] (41) Randomly select the fourth matrix Encryption matrix e1, encryption vector e2∈χ n ,in, represents an n-row and n-column matrix, where each element comes from the residue class ring of integers modulo 2, and e1 is an n×m matrix where each element conforms to the Gaussian distribution;

[0037] (42) Calculate the first part of the ciphertext c1 = RA + pe1 and the second part of the ciphertext c2 = Ru + m + pe2;

[0038] (43) Construct ciphertext c = {c1, c2}.

[0039] Compared with the prior art, the advantages of the present invention are:

[0040] A lattice-based additively homomorphic threshold decryption scheme with special access control is proposed. It is used to solve the defect of poor confidentiality in the traditional centralized federated learning model architecture, in which each participant can obtain the final trained model. The present invention divides users into multiple organizations and provides threshold control for each organization. Only when each organization meets the threshold can collaborative decryption be performed. The present invention is more suitable for scenarios that require flexible access structures, such as banks, FL, etc. At the same time, compared with other lattice-based schemes, the present invention has higher computational efficiency, and compared with other schemes based on traditional difficult problems, our invention can resist quantum attacks. This scheme also has the property of additive homomorphism and high scalability, and can perform computational operations on encrypted data while maintaining data privacy. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 It is a flow chart of the present invention. DETAILED DESCRIPTION

[0042] The present invention will be further described below with reference to the accompanying drawings.

[0043] Example 1: See Figure 1 ,A lattice-based additive homomorphic threshold decryption method, comprising the following steps;

[0044] (1) Determine the organizations that need collaborative decryption and the members in each organization, and set a threshold for collaborative decryption for each organization. The number of organizations is l, and for the gth organization A g , the threshold is tg , and t g No more than A g The number of members, g = 1 ~ l;

[0045] (2) System initialization: input security parameters, generate public parameters parmas = {p, q, H, t1, ..., t l}、Master public key MPK={A,u,B}、Master private key MSK={v1,...v a， f1(x),...f l (x), T}, specifically including (21)-(26);

[0046] (21) From the set of positive integers Z + Select two parameters p and q, wherein the greatest common factor of p and g is gcd(p,q)=1;

[0047] (22) Define a hash function H, which is used to Mapping to Z q , is an n-dimensional vector, and each element in the vector comes from the residue class ring of integer modulo q, the Z q is a set of integers, and each element in the set comes from the residue class ring of integers modulo q;

[0048] (23) Generate a uniformly distributed first matrix Randomly generate the first vector e p ∈χ n and 1 with organizations A1~A l The corresponding second vector v1~v l , v1~v l All belong to in, represents an n-row and m-column matrix, and each element in the matrix comes from the residue class ring of integer modulo q, χ n represents the Gaussian distribution in n dimensions, represents an m-dimensional vector, and each element in the vector comes from the residue class ring of integers modulo q;

[0049] (24) Define a polynomial for each organization, where organization A g The polynomial f g (x) is:

[0050]

[0051] Where, is a randomly selected t g -1 vector, j=1~t g -1, x is the polynomial fg (x) variables;

[0052] (25) Use TrapGen(q,m) algorithm to generate the second matrix The third matrix T∈Z m×m , Z m×m Represents an integer matrix with m rows and m columns;

[0053] (26) The system generates public parameters parmas = {p, q, H, t1, t2, ..., t l}、Master public key MPK={A,u,B}、Master private key MSK={v1,v2,...v l f1(x), f2(x), ...f l (x), T};

[0054] (3) Key generation phase: The system generates a user private key and a user public key for each member based on the public parameters, the master private key and the identity ID of each member, where organization A g The user private key of member i is sk i,g ={sk 1_i，g ,sk 2_i，g}, the user's public key is pk i，g ,sk 1_i，g The first part of the user's private key, sk 2_i，g The second part of the user's private key;

[0055] (4) Encryption phase: The system encrypts a message M that needs to be collaboratively decrypted using public parameters and the master public key, and outputs a ciphertext c = {c1, c2}, where c1 is the first ciphertext and c2 is the second ciphertext.

[0056] (5) When a member wants to decrypt the ciphertext, he invites several other members to form a decryption group, and each member in the decryption group becomes a decryption participant;

[0057] (6) Collaborative information computing;

[0058] (61) Each decryption participant randomly generates the first decryption vector. If the decryption participant is organization A g If member i is in the ciphertext, then the first decryption vector is e 3_i,g ∈x n ;

[0059] (62) The decryption participant calculates the second decryption vector based on the first decryption vector, and organization A g The second decryption vector of member i is c i,g =c1sk 1_i,g +pe 3_i,g ;

[0060] (7) System verification and collaborative decryption;

[0061] (71) Statistics of decryption participants in the decryption set in organizations A1~A l The number n1~n l ;

[0062] (72) If the decryption participant is in A1~A l are distributed in tissue A g , if n g ≥t g , then proceed to the next step, otherwise the verification fails;

[0063] (73) For each decryption participant, calculate its Lagrange coefficient, for organization A g The Lagrange coefficient of the kth decryption participant is L k，g ;

[0064] (74) Calculate a sum for each organization, organization A g The sum of Where c k，g For Organization A g The second decryption vector of the kth decryption participant;

[0065] (75) Calculate the collaborative decryption message M′, M′=c2-SUM1-…-SUM i ;

[0066] (76) The message M is obtained according to the formula M≡M′(mod p) and sent to the decryption participant, where mod is the congruence symbol.

[0067] The step (3) is specifically as follows:

[0068] (31) For each member, randomly select a different secret value, where organization A g The secret value of member i in is x i，g ∈Z q ;

[0069] (32) Generate an error vector for each secret value, where the secret value x i，g Vector error

[0070] (33) Substitute the secret value of each user into the polynomial f g (x), generate a member polynomial, where organization A g The member polynomial corresponding to member i in The generation method is to let f g (x) where x=x i，g , solve

[0071] (34) Using algorithms Generate user vector and θ is the length constraint of the user vector, Z m is an m-dimensional vector, and each element in the vector is an integer;

[0072] (35) Generate user private key and user public key and send them to corresponding members, among which organization A g The user private key of member i in is

[0073] The step (4) is specifically as follows:

[0074] (41) Randomly select the fourth matrix Encryption matrix e1, encryption vector e2∈χ n ,in, represents an n-row and n-column matrix, where each element comes from the residue class ring of integers modulo 2, and e1 is an n×m matrix where each element conforms to the Gaussian distribution;

[0075] (42) Calculate the first part of the ciphertext c1 = RA + pe1 and the second part of the ciphertext c2 = Ru + m + pe2;

[0076] (43) Construct ciphertext c = {c1, c2}.

[0077] Example 2: See Figure 1 ,Based on Example 1, we provide a specific implementation method, a lattice-based additive homomorphic threshold decryption method,,including the following steps;

[0078] (1) Determine the organizations that need collaborative decryption. There are three organizations, namely A1, A2, and A3. A1 has 10 members, A2 has 12 members, and A3 has 15 members. The thresholds for collaborative decryption of A1, A2, and A3 are t1=3, t2=4, and t3=5.

[0079] (2) System initialization, input security parameter 1 λ , generate public parameters parmas = {p, q, H, t1, t2, t3}, master public key MPK = {A, u, B}, master private key MSK = {v1, v2, v3, f1(x), f2(x), f3(x), T}, where f1(x), f2(x), f3(x) are the polynomials of organizations A1, A2, and A3 respectively. According to the formula You can get:

[0080] f1(x)=v1+a 1,1 x+a 2,1 x2 ;

[0081] f2(x)=v2+a 1，2 x+a 2，2 x 2 +a 3,2 x 3 ;

[0082] f3(x)=v3+a 1,3 x+a 2,3 x 2 +a 3,3 x3 +a 4,3 x4 .

[0083] (3) Key generation phase: The system generates a user private key and a user public key for each member based on the public parameters, the master private key and the identity ID of each member. The user private keys of the 10 members in organization A1 are sk 1，1 ={sk 1_1,1 ,sk 2_1，1} to sk 10，1 ={sk 1_10，1 ,sk 2_10,1}; The user private keys of the 12 members in organization A2 are sk in order 1,2 ={sk 1_1,2 ,sk 2_1,2} to sk 12,2 ={sk 1_12,2 ,sk 2_12,2}; The user private keys of the 15 members in organization A3 are sk in order 1,3 ={sk 1_1,3 ,sk 2_1,3} to sk 15,3 ={sk 1_15,3 ,sk 2_15，3}.

[0084] (4) Encryption stage: Same as step (4) in Example 1, ciphertext c = {c1, c2} is obtained.

[0085] (5) When a member wants to decrypt the ciphertext, based on the limitations of this invention, the decryption set must include at least 3 members of organization A1, 4 members of organization A2, and 5 members of organization A3. This means there should be at least 3+4+5=12 members in the decryption set. Therefore, the member who wants to decrypt must invite at least 11 people to form the decryption set with him. It is worth noting that a member can belong to organizations A1, A2, and A3 at the same time.

[0086] (6) Collaborative information calculation, same as step (6) of Example 1, each cryptographic participant generates a second decryption vector.

[0087] (7) System verification and collaborative decryption, including steps (71)-(76).

[0088] (71) Count the number of decryption participants in organizations A1 to A3 in the decryption set, n1 to n3. Assume that in the decryption set, there are n1 = 5 members belonging to organization A1, n2 = 5 members belonging to organization A2, and n3 = 7 members belonging to organization A3.

[0089] (72) Statistics show that the decryption participants are distributed in A1~A3, and n1=5>t1=3, n2=5>t2=4, n3=7>t3=5, then the verification is passed and the next step is carried out. At this time, if the statistics show that any of the above conditions is not met, the verification fails and the verification program is exited without proceeding to the next step.

[0090] (73) For each decryption participant, calculate its Lagrange coefficient, for organization A g The Lagrange coefficient of the kth decryption participant is L k，g , then in A1, the Lagrange coefficients of these five people are L 1，1 to L 5，1 ; The Lagrange coefficients of the decryption participants in A2 and A3 can be obtained similarly.

[0091] (74) Same as step (74) of Example 1, when calculating the sum, since n1=5>t1=3, we only need to select 3 people from n1 to participate in the calculation of SYM1. Similarly, we select 4 people from n2 to participate in the calculation of SUM2, and select 5 people from n3 to participate in the calculation of SUM3.

[0092] (75) Calculate the collaborative decryption message M′=c2-SUM1-SUM2-SUM3;

[0093] (76) Same as step (76) of embodiment 1, use the formula M≡M′(mod p) to obtain message M. Finally, the member to be decrypted in step (5) obtains message M.

[0094] The present invention divides users into multiple organizations and provides threshold control for each organization, that is, setting a threshold t g ,Only after each organization meets the threshold can collaborative decryption be performed.

[0095] We will organize A1~A l Considering it as a set of organizations, when in step (5), the member who wants to obtain the ciphertext cannot invite members in each organization that meet the threshold to participate in decryption, it means that the member's identity is not recognized. According to the method of the present invention, he cannot pass the verification in step (72) and ultimately cannot obtain the decrypted message M.

[0096] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A lattice-based additive homomorphic threshold decryption method, characterized by: The following steps are included: (1) Determine the organizations that need collaborative decryption and the members in each organization, and set a threshold for collaborative decryption for each organization. The number of organizations is l, and for the gth organization A g , the threshold is t g , and t g No more than A g The number of members, g = 1 ~ l; (2) System initialization: input security parameters, generate public parameters parmas = {p, q, H, t1, ..., t l }、Master public key MPK={A,u,B}、Master private key MSK={v1,...v g ,f1(x),...f l (x), T}, specifically including (21)-(26); (21) From the set of positive integers Z + Select two parameters p and q, wherein the greatest common factor of p and g is gcd(p,q)=1; (22) Define a hash function H, which is used to Mapping to Z q , is an n-dimensional vector, and each element in the vector comes from the residue class ring of integer modulo q, the Z q is a set of integers, and each element in the set comes from the residue class ring of integers modulo q; (23) Generate a uniformly distributed first matrix Randomly generate the first vector e p ∈χ n and 1 with organizations A1~A l The corresponding second vector v1~v l , v1~v l All belong to in, represents an n-row and m-column matrix, and each element in the matrix comes from the residue class ring of integer modulo q, χ n represents the Gaussian distribution in n dimensions, represents an m-dimensional vector, and each element in the vector comes from the residue class ring of integers modulo q; (24) Define a polynomial for each organization, where organization A g The polynomial f g (x) is: Where, is a randomly selected t g -1 vector, j=1~t g -1, x is the polynomial f g (x) variables; (25) Use TrapGen(q,m) algorithm to generate the second matrix The third matrix T∈Z m×m , Z m×m Represents an integer matrix with m rows and m columns; (26) The system generates public parameters parmas = {p, q, H, t1, t2, ..., t l }、Master public key MPK={A,u,B}、Master private key MSK={v1,v2,...v l ,f1(x),f2(x),...f l (x), T}; (3) Key generation phase: The system generates a user private key and a user public key for each member based on the public parameters, the master private key and the identity ID of each member, where organization A g The user private key of member i is sk i,g ={sk 1_i,g ,sk 2_i,g }, the user's public key is pk i,g ,sk 1_i,g The first part of the user's private key, sk 2_i,g The second part of the user's private key; (4) Encryption phase: The system encrypts a message M that needs to be collaboratively decrypted using public parameters and the master public key, and outputs a ciphertext c = {c1, c2}, where c1 is the first ciphertext and c2 is the second ciphertext. (5) When a member wants to decrypt the ciphertext, he invites several other members to form a decryption group, and each member in the decryption group becomes a decryption participant; (6) Collaborative information computing; (61) Each decryption participant randomly generates the first decryption vector. If the decryption participant is organization A g If member i is in the ciphertext, then the first decryption vector is e 3_i，g ∈x n ; (62) The decryption participant calculates the second decryption vector based on the first decryption vector, and organization A g The second decryption vector of member i is c i,g =c1sk 1_i,g +pe 3_i,g ; (7) System verification and collaborative decryption; (71) Statistics of decryption participants in the decryption set in organizations A1~A l The number n1~n l ; (72) If the decryption participant is in A1~A l are distributed in tissue A g , if n g ≥t g , then proceed to the next step, otherwise the verification fails; (73) For each decryption participant, calculate its Lagrange coefficient, for organization A g The Lagrange coefficient of the kth decryption participant is L k，g ; (74) Calculate a sum for each organization, organization A g The sum of Where c k，g For Organization A g The second decryption vector of the kth decryption participant; (75) Calculate the collaborative decryption message M′, M′=c2-SUM1-…-SUM l ; (76) The message M is obtained according to the formula M≡M′(mod p) and sent to the decryption participant, where mod is the congruence symbol.

2. The lattice-based additive homomorphic threshold decryption method according to claim 1, characterized in that: The step (3) is specifically as follows: (31) For each member, randomly select a different secret value, where organization A g The secret value of member i in is x i，g ∈Z q ; (32) Generate an error vector for each secret value, where the secret value x i，g Vector error (33) Substitute the secret value of each user into the polynomial f g (x), generate a membership polynomial, where organization A g The member polynomial corresponding to member i in The generation method is to let f g (x) where x=x i，g , solve (34) Using algorithms Generate user vector and θ is the length constraint of the user vector, Z m is an m-dimensional vector, and each element in the vector is an integer; (35) Generate user private key and user public key and send them to corresponding members, among which organization A g The user private key of member i in is 3. The lattice-based additive homomorphic threshold decryption method according to claim 2, characterized in that: The step (4) is specifically as follows: (41) Randomly select the fourth matrix Encryption matrix e1, encryption vector e2∈χ n ,in, represents an n-row and n-column matrix, where each element of the matrix comes from the residue class ring of integers modulo 2, and e1 is an n×m matrix where each element conforms to the Gaussian distribution; (42) Calculate the first part of the ciphertext c1 = RA + pe1 and the second part of the ciphertext c2 = Ru + m + pe2; (43) Construct ciphertext c = {c1, c2}.

Images