A safe and efficient method for multi-server outsourcing polynomial calculation

Abstract

The application discloses a safe and efficient multi-server outsourcing polynomial calculation method, characterized in that the method comprises the following steps: using a homomorphic secret sharing method based on Paillier encryption to encrypt input x to obtain ciphertext; each calculation server has a calculation key, and operation is performed on the encrypted ciphertext, and two calculation servers respectively output respective partial calculation results; the two partial calculation results obtained in step 2 are respectively encrypted in a bilinear group; based on a non-interactive Schnorr proof method, random noise is added to the ciphertext obtained in step 3 through a random oracle; and a secret sharing marking technology in the SPDZ style is used for verification. The application uses homomorphic secret sharing technology, verifiable computation technology and zero-knowledge proof technology, realizes a public verifiable efficient outsourcing calculation scheme for protecting calculation privacy, result integrity and zero-knowledge, and simultaneously satisfies privacy, public verifiability, zero-knowledge and outsourceability.

Description

Technical Field

[0001] This invention relates to a method for protecting data and computation results in outsourced computing to ensure their privacy and integrity. Background Technology

[0002] With the continuous development of internet technology, new computing models such as cloud computing and edge computing have gradually become widespread and an indispensable part of modern society. These computing models require significant computing and storage resources due to the large scale of the computing tasks. However, for many small and medium-sized enterprises and individual users, building their own computing platform is costly; therefore, they typically choose to outsource computing tasks to cloud service providers or edge nodes.

[0003] In this computing model, the privacy and security issues of outsourced computing have become an important research direction. This is because cloud service providers or edge nodes may steal or tamper with data and computation results in outsourced computing, thereby threatening user privacy and security. Therefore, how to protect data and computation results in outsourced computing and ensure their privacy and integrity has become a crucial issue in the fields of cloud computing and edge computing.

[0004] Fully homomorphic encryption is the most commonly used method to protect the privacy of outsourced computation. It allows for the processing and computation of encrypted data without destroying the ciphertext, thus protecting data privacy. However, fully homomorphic encryption schemes are computationally inefficient, typically requiring significant time and computational resources. To address this issue, homomorphic secret sharing technology has been proposed, which reduces the computational overhead of performing calculations on encrypted data by introducing a new computational server.

[0005] Verifiable computing is the most commonly used method for protecting the integrity of outsourced computing. In outsourced computing, because the computation process is usually performed by cloud service providers, users cannot directly verify the correctness of the computation results. Verifiable computing requires the computing server to return evidence along with the computation results, allowing users to verify the received computation results and evidence with less time and computing resources, thus trusting that the received computation results are correct. Summary of the Invention

[0006] The purpose of this invention is to achieve safe and efficient polynomial outsourcing computation, while ensuring data privacy and the correctness and integrity of computation results.

[0007] To achieve the above objectives, the technical solution of the present invention provides a secure and efficient method for multi-server outsourced polynomial computation, characterized by comprising the following steps:

[0008] Step 1: A trusted third party generates a public key pk using a homomorphic secret-sharing method based on Paillier encryption. HSS And calculate keys ek0 and ek1, pk HSS This is public information; the computing keys ek0 and ek1 are sent to two computing servers respectively.

[0009] Step 2: A trusted third party uses a consensus generation algorithm based on the linear homomorphic commitment scheme to generate public information. Where g1,h are two generators in group G1. These are the offsets of g1 and h in group G1, respectively, by a factor of α. α is a random number, g2 is a generator in group G2, and e represents a bilinear mapping operation;

[0010] Step 3: The user uses the public key to perform a PK (player kill) attack. HSS The input x is encrypted with the computing key to obtain ciphertext, which is then distributed to two computing servers.

[0011] Step 4: Each computing server uses its own computing keys ek0 and ek1 to perform calculations on the encrypted ciphertext, and outputs its respective partial calculation results, which are represented as ciphertext. <y>0 and ciphertext <y>1;

[0012] Step 5: Randomly select secret token A, and have each of the two computing servers hold the secret token. 0 and secret mark 1, and have 1- 0 = A, and the two computing servers use secret tags respectively. 0 and secret mark Step 4 yields two corresponding ciphertexts. <y> 0、 <y>1 performs calculation to obtain <Ay>0 and <Ay>1;

[0013] Step 6: A calculation server uses a linear homomorphic commitment scheme to <ay>0 and <ay>1. Mapping to a bilinear group yields group elements C0, C1 and commitment information υ0, υ1, where...

[0014] Step 7: Based on the non-interactive Schnorrproof zero-knowledge proof process, each computing server generates noise j, j0, j1 using a pseudo-random function, where j1 - j0 = j, and uses a random oracle to generate common random noise e = Hash(e(h)). j ,g2)), calculate τ0=j0-e·υ0,τ1=j1-e·υ1, at this time, τ0,τ1 are random numbers that appear to be uniformly distributed;

[0015] Step 8: Each computing server outputs ( <y> b C b ,e,τ b b∈{0,1};

[0016] Step 9: The verifier receives the output from both servers and first reconstructs the calculation result y = <y> 1- <y>0;

[0017] Step 10: The verifier first verifies whether the common noise e returned by the two servers is equal and whether C0 and C1 are in the correct commitment form. If the verification fails, the calculation result y is rejected.

[0018] Step 11: The verifier verifies the expression in the bilinear group. If the result y is not equal to the common noise e, the calculation result y is rejected; otherwise, the verification is passed.

[0019] This invention utilizes homomorphic secret sharing technology, verifiable computation technology, and zero-knowledge proof technology to achieve a publicly verifiable and efficient outsourced computation scheme that protects computational privacy, result integrity, and zero-knowledge proof. This invention simultaneously satisfies privacy, public verifiability, zero-knowledge proof, and outsourcing capability. Attached Figure Description

[0020] < / y> < / y> < / y> < / ay> < / ay> < / y> < / y> Figure 1 A model diagram of a secure and efficient multi-server outsourced polynomial computation scheme. Detailed Implementation

[0021] The present invention will be further illustrated below with reference to specific embodiments. It should be understood that these embodiments are for illustrative purposes only and are not intended to limit the scope of the invention. Furthermore, it should be understood that after reading the teachings of this invention, those skilled in the art can make various alterations or modifications to the invention, and these equivalent forms also fall within the scope defined by the appended claims.

[0022] Assuming the computation task is a polynomial P(x) and the input is x, this invention discloses a secure and efficient multi-server outsourced polynomial computation method. Firstly, it employs a homomorphic secret-sharing scheme based on Paillier encryption to protect input privacy. This scheme encrypts the privacy data and distributes it to two computation servers. Each server possesses a computation key, performs calculations on the encrypted ciphertext, and outputs a portion of the computation result.<P(x)> 0 and<P(x)> 1. The recipient of the calculation results can recover the plaintext calculation result P(x) from these partial calculation results.

[0023] To enable the recipient of the calculation results to efficiently verify the results, this invention employs the following three techniques:

[0024] The first technique is an SPDZ-style secret sharing token, where SPDZ is a general-purpose secure multi-party computation protocol designed to counter active attackers. In our protocol, we randomly select a secret token A, which is held by two computation servers respectively. 0 and 1, making 1- 0 = A. Let the server calculate separately.<A·P(x)> 0 and<A·P(x)> 1, making<A·P(x)> 1->A·P(x)>0=A·P(x). The core idea of ​​SPDZ verification is to check whether the last equation is equal. Since the server does not know A, it prevents malicious servers from passing the verification with incorrect calculation results.

[0025] The second technique is bilinear mapping. By mapping the equation verified by SDPZ onto a bilinear group, we can achieve the goal of keeping the secret sharing token A hidden from the verifier. That is, the verification of the result is performed on the encrypted data, and anyone can verify the correctness of the calculation result. Since the homomorphic secret sharing scheme based on Paillier encryption returns partial integer results, we can easily encrypt them into a bilinear group, transforming the SPDZ-verified equation into ciphertext verification within a bilinear group. Specifically, we use a standard bilinear mapping scheme to verify the equation. Are they equal?

[0026] The third technique is zero-knowledge proof. Based on the non-interactive Schnorrproof process, we propose a non-interactive zero-knowledge proof scheme for secret sharing between two servers. By adding random noise and a random oracle, we make the output of the computation server appear uniformly distributed, thus hiding potentially leaked information. This ensures that the verifier can only verify the result as true and cannot obtain any additional information. Specifically, we replace the standard bilinear mapping scheme with a linear homomorphic commitment scheme with extractability to verify the equation. Whether the left and right sides are equal, where τ0, τ1, and e are random numbers randomly distributed in the plaintext space, and c0 and c1 are the values ​​of A·P(x)>0 respectively.<A·P(x)> The promise of 1.

[0027] By employing these three technologies, we have added public verifiability, zero-knowledge capability, and outsourcing capability to the Paillier-based homomorphic secret sharing scheme, thereby obtaining an efficient and publicly verifiable homomorphic secret sharing scheme. This enables a secure and efficient multi-server outsourced polynomial computation, specifically including the following steps:

[0028] Step 1: A trusted third party generates a public key pk using a homomorphic secret-sharing method based on Paillier encryption. HSS And calculate keys ek0 and ek1, pk HSS This is public information; the computing keys ek0 and ek1 are sent to each computing server respectively.

[0029] Step 2: A trusted third party uses a consensus generation algorithm based on the linear homomorphic commitment scheme to generate public information.

[0030] Step 3: The user uses the public key to perform a PK (player kill) attack. HSS The input x is encrypted with the computing key to obtain ciphertext, which is then distributed to two computing servers.

[0031] Step 4: Each computing server uses its own computing key to perform calculations on the encrypted ciphertext and outputs its own partial calculation results. <y>0 and <y>1;

[0032] Step 5: Randomly select secret token A, and have each of the two computing servers hold the secret token.< / y> < / y> 0 and secret mark 1, and have 1- 0 = A, and the two computing servers use secret tags respectively. 0 and secret mark 1 Calculate the two corresponding ciphertexts obtained in step 4 to obtain <Ay>0 and <ay>1;

[0033] Step 6: The computing server uses a linear homomorphic commitment scheme to... <ay>0 and <ay>1. Mapping to a bilinear group yields group elements C0, C1 and commitment information υ0, υ1, where...

[0034] Step 7: Based on the non-interactive Schnorrproof zero-knowledge proof process, each computing server generates noise j, j0, j1 using a pseudo-random function, where j1 - j0 = j, and uses a random oracle to generate common random noise e = Hash(e(h)). j ,g2)), calculate τ0=j0-e·υ0,τ1=j1-e·υ1, at this time, τ0,τ1 are random numbers that appear to be uniformly distributed;

[0035] Step 8: Each computing server outputs ( <y> b C b ,e,τ b b∈{0,1};

[0036] Step 9: The verifier receives the output from both servers and first reconstructs the calculation result y = <y> 1- <y>0;

[0037] Step 10: The verifier first verifies whether the common noise e returned by the two servers is equal and whether C0 and C1 are in the correct commitment form. If the verification fails, the calculation result y is rejected.

[0038] Step 11: The verifier verifies the expression in the bilinear group. If the result y is not equal to the common noise e, the calculation result y is rejected; otherwise, the verification is passed.

[0039] Copyright protection is a crucial means of protecting intellectual property rights, especially important for the cultural industry and digital media sector. The aforementioned outsourced computing technologies can provide effective solutions for copyright protection, achieving copyright protection, privacy protection, public verifiability, and zero-knowledge protection. The following section uses digital rights management (DRM) protection as an example to introduce a specific implementation plan based on outsourced computing.

[0040] Suppose a company owns a digital media work and needs digital rights management (DRM) protection to prevent piracy and illegal distribution. The company can utilize our outsourced computing technology to delegate the DRM task to a cloud service provider. The specific implementation process is as follows:

[0041] The first step involves the company using the aforementioned outsourced computing technology to encrypt the digital media works, ensuring data privacy and security, and generating a public key and a computing key. The encrypted digital media works and encryption key are then sent to two different cloud service providers, with the public key being made public.

[0042] The second step involves each cloud server provider using outsourced computing technology to embed a watermark into the encrypted digital media work, publishing the calculation results, and then recombining the calculation results from the two cloud servers to obtain the complete watermarked digital media work.

[0043] The third step involves any entity holding the public key using outsourced computational verification algorithms to verify and track digital copyright protection. Each entity possessing the public key can verify whether the copyright of a digital media work is protected and track its usage. When a digital media work is used, the watermark key and watermark information can be verified to confirm whether the work has been pirated or illegally distributed.

[0044] By employing the outsourced computing technology provided by this invention, digital rights management (DRM) can achieve privacy protection, public verifiability, and zero-knowledge nature, significantly improving the efficiency and security of copyright protection. Furthermore, this outsourced computing technology for DRM can also be applied to other industries and fields, such as medical data protection and financial data security.< / y> < / y> < / y> < / ay> < / ay> < / ay> < / y> < / y>

Claims

1. A secure and efficient method for multi-server outsourced polynomial computation, characterized in that, Includes the following steps: Step 1: A trusted third party generates a public key pk using a homomorphic secret-sharing method based on Paillier encryption. HSS And calculate keys ek0 and ek1, pk HSS This is public information; the computing keys ek0 and ek1 are sent to two computing servers respectively. Step 2: A trusted third party uses a consensus generation algorithm based on the linear homomorphic commitment scheme to generate public information. Where g1 and h are two generators in group G1. These are the α-fold offsets of g1 and h in group G1, respectively. α is a random number, g2 is a generator in group G2, and e represents a bilinear mapping operation; Step 3: The user uses the public key to perform a PK (player kill) attack. HSS The input x is encrypted with the computing key to obtain ciphertext, which is then distributed to two computing servers. Step 4: Each computing server uses its own computing keys ek0 and ek1 to perform calculations on the encrypted ciphertext, and outputs its respective partial calculation results, which are represented as ciphertext. <y>0 and ciphertext <y> 1；< / y> < / y> Step 5: Randomly select secret token A, and have each of the two computing servers hold the secret token. 0 and secret mark 1, and have 1- 0 = A, and the two computing servers use secret tags respectively. 0 and secret mark Step 4 yields two corresponding ciphertexts. <y> 0、 <y>1. Perform calculations to obtain... <ay>0 and <ay> 1；< / ay> < / ay> < / y> < / y> Step 6: The computing server uses a linear homomorphic commitment scheme to... <ay>0 and <ay>1. Mapping to a bilinear group yields group elements C0, C1 and commitment information υ0, υ1, where... < / ay> < / ay> Step 7: Based on the non-interactive Schnorrproof zero-knowledge proof process, each computing server generates noise j, j0, j1 using a pseudo-random function, where j1-j0=j, and uses a random oracle to generate common random noise e=Hash(e(h j ,g2)), calculate τ0=j0-e·υ0,τ1=j1-e·υ1,at this time, τ0,τ1 are random numbers that appear to be uniformly distributed; Step 8: Each computing server outputs ( <y> b ,C b ,e,t b ),b∈{0,1};< / y> Step 9: The verifier receives the output from both servers and first reconstructs the calculation result y = <y> 1- <y> 0；< / y> < / y> Step 10: The verifier first verifies whether the common noise e returned by the two servers is equal and whether C0 and C1 are in the correct commitment form. If the verification fails, the calculation result y is rejected. Step 11: The verifier verifies the expression in the bilinear group. If the result y is not equal to the common noise e, the calculation result y is rejected; otherwise, the verification is passed.

Images