Homomorphic encryption-based plaintext and ciphertext matrix multiplication calculation method

Abstract

The application is a plaintext and ciphertext matrix multiplication calculation method based on homomorphic encryption, belonging to the field of information security. The method comprises the following steps: S1: setting security parameters and related encryption and decryption parameters; S2: generating a public and private key pair and an operation key according to the security parameters; S3: the client encrypts the matrix after encoding, generates encrypted data, and sends; S4: the server encodes the matrix and transforms the encrypted data; S5: the server performs plaintext and ciphertext matrix multiplication calculation, obtains the ciphertext of the matrix multiplication result, and sends; S6: the client decrypts the ciphertext of the matrix multiplication result by using the private key. The application provides a plaintext and ciphertext matrix multiplication calculation method based on homomorphic encryption, which can realize fast and efficient matrix multiplication calculation of the server on the demand of the client under the privacy calculation framework of two parties, ensures the security of the model and data, and has strong generalization ability.

Description

Technical Field

[0001] This invention relates to a matrix multiplication method for plaintext and ciphertext based on homomorphic encryption, belonging to the field of information security, and is particularly applicable to matrix multiplication calculation of plaintext and ciphertext based on homomorphic encryption. Background Technology

[0002] Machine learning technology has been widely applied in many fields such as computer science, information security, and image processing. While machine learning has made significant strides in improving social productivity, the large-scale sharing of datasets has also brought serious privacy and security issues. This is because model owners do not want to disclose information related to the model, and data owners do not want to disclose data-related information. One typical application scenario is... Figure 1 As shown, the model owner (such as a company's cloud server) wants to use a large amount of user data to train the model and then provide the trained model to clients for data prediction services. This demonstrates that researching privacy-preserving machine learning can better serve various fields while ensuring data is not leaked.

[0003] Homomorphic encryption is an encryption scheme that allows operations on encrypted inputs and the result of decryption matches the result of the corresponding operation on the plaintext. It can provide provable security and quantum security, and theoretically achieves the optimal number of interactions, thus it is considered one of the most promising privacy protection solutions. Since C. Gentry proposed the first fully homomorphic encryption scheme in 2009, many improvements have emerged and efficiency has been continuously improved, and it has been widely used in processing privacy data. In order to improve the efficiency of the scheme, reference [1] proposed the introduction of Single Instruction Multiple Data (SIMD) batch processing technology in homomorphic encryption to process data in parallel, but this also makes it very difficult to calculate the inner product of vectors, resulting in low efficiency of multiplication between ciphertext matrices. To this end, references [2] and [3] respectively proposed new methods for ciphertext matrix multiplication and optimized the block strategy when processing large-scale data. However, these ciphertext calculation methods need to limit the size of the matrix, resulting in coding waste, and no specific solution is given when privacy protection machine learning involves two parties in the calculation. When considering computational tasks involving two parties, matrix multiplication of plaintext and ciphertext can be used to replace matrix multiplication of ciphertext and ciphertext to achieve more efficient multiplication operations. Therefore, researching efficient matrix multiplication of homomorphic plaintext and ciphertext has profound significance for applying homomorphic encryption to privacy-preserving machine learning.

[0004] [1] HALEVI S, SHOUP V. Algorithms in helib; proceedings of the Advances in Cryptology-CRYPTO 2014: 34th Annual Cryptology Conference, Santa Barbara, CA, USA, August 17-21, 2014, Proceedings, Part I 34, F, 2014.

[0005] [2]JIANG X, KIM M, LAUTER K, et al. Secure outsourced matrix computation and application to neural networks; proceedings of the Proceedings of the 2018ACM SIGSAC conference on computer and communications security.

[0006] [3]HUANG Z, HONG C, WENG C, et al.More Efficient Secure MatrixMultiplication for Unbalanced Recommender Systems[J].2023, 20(01): 551-62. Summary of the Invention

[0007] In view of this, such as Figure 2 As shown, this invention provides a method for calculating matrix multiplication of plaintext and ciphertext based on homomorphic encryption, aiming to reduce the time of ciphertext matrix multiplication and achieve efficient plaintext-ciphertext matrix multiplication.

[0008] To achieve the above objectives, the present invention first defines the symbols involved in the method as follows:

[0009] (1) For plaintext space and ciphertext space They can all be viewed as a set formed by n-dimensional vectors. Enc represents the encryption algorithm operation, Dec represents the decryption algorithm operation, and ⊙ represents the Hadamard product of vectors.

[0010] (2) The addition operation of c1 and c2 is as follows: Output the ciphertext c such that Dec(c1) + Dec(c2) = Dec(c).

[0011] (3) The matrix multiplication operation between plaintext m and ciphertext c is as follows: Output the ciphertext c′ such that Dec(c)⊙m=Dec(c′), where the plaintext m can be shorter than the ciphertext c, and the value of the plaintext m that exceeds the ciphertext c is 0.

[0012] (4) The addition operation of k ciphertexts is as follows: Input k ciphertexts c = i = 0, ..., k-1 i The output ciphertext c′ makes

[0013] (5) The rotation operation of ciphertext c is Input plaintext information Given the corresponding ciphertext c and an integer l, output the ciphertext c′=Enc(m′); where The new plaintext is obtained by rotating each component of m to the left by l plaintext slots. If l is negative, it means rotating to the right.

[0014] (6) The repeat padding operation is repeat(a, p): the input i-dimensional row vector a is repeated p times and concatenated, and the output is an i·p-dimensional row vector.

[0015] (7) The vector generation operation is GenV(m, n): Input positive integers m and n, output an m+n dimensional row vector s = (0, n) / n. m 1 n ); where 0 m Let m be a 0-dimensional row vector, 1 n It is an n-dimensional 1-row vector.

[0016] Based on this, given an n×m matrix A on the server and an m×p matrix B on the client, the invention implements the calculation of A×B on the server and decryption on the client to obtain the result, where n, m, and p are positive integers. The invention provides the following technical solution:

[0017] The matrix multiplication method for plaintext and ciphertext based on homomorphic encryption includes the following steps:

[0018] S1: Set the security parameter λ of the homomorphic encryption scheme ε=(Enc,Dec), and generate the relevant encryption and decryption parameters of the homomorphic encryption scheme based on the security parameter λ;

[0019] S2: The client generates a private key sk, a public key pk, and a computation key ek based on the encryption and decryption parameters;

[0020] S3: The client encodes matrix B into vector b, and uses the public key pk to encrypt vector b to obtain encrypted data c. b Then encrypt the data c bThe public key pk and the computation key ek are packaged and sent to the server;

[0021] S4: The server encodes matrix A to obtain the encoded matrix. A and encrypted data c b Perform the transformation to obtain the transformed encrypted data.

[0022] S5: The server utilizes the encoding matrix A and the transformed encrypted data The public key pk and the computation key ek are used to perform matrix multiplication of plaintext and ciphertext, resulting in the ciphertext c of the matrix multiplication result. x and c x Send to the user;

[0023] S6: The client uses the private key sk to decrypt c. x Then, the result of the matrix A×B is obtained by decoding.

[0024] Furthermore, step S1 specifically includes:

[0025] S101: Determine the security parameter λ, i.e., at least withstand 2 λ A rival in computational power for sub-bit operations;

[0026] S102: The client selects an integer p based on the sample data, and the value will not exceed p / 2 during the ciphertext calculation process;

[0027] S103: The user, based on the security parameter λ, and in accordance with the Homomorphic Encryption Security Standard (HESS)... http: / / homomorphicencryption.org / The suggestion in the document, selecting parameters m and q, determines the plaintext space of the homomorphic encryption scheme as follows: That is, polynomial ring with integer coefficients Modulus of m-th degree cyclotomic polynomial φ m The ideal residual ring obtained after generating (X) and integer p, the ciphertext space is:

[0028] Furthermore, step S2 specifically includes:

[0029] S201: The client generates a coefficient by randomly selecting an indeterminate variable X from the set {-1, 0, 1} with moderate probability, the number of times of selection does not exceed... A random polynomial f, where Let f represent the number of elements in the set {1, 2, ..., m} that are relatively prime to m. Then the private key sk = (1, f).

[0030] S202: Client from R qRandomly select a polynomial a of an indeterminate X from a uniform distribution, and randomly select a noise polynomial e of the indeterminate X from an error distribution χ. Then the public key pk = (-[(a·f + e)] , a), where [.] q represents the polynomial obtained by taking the coefficients of the polynomial in the square brackets modulo q; q

[0031] S203: The client generates the operation key ek required for noise control during ciphertext operations according to the selected homomorphic encryption scheme.

[0032] Further, step S3 is specifically as follows:

[0033] S301: The client encodes the matrix B m×p , regards each column of the matrix as a vector, that is Then arrange the elements of each column of the matrix B in order to obtain a vector b = (b0, b1,..., b p-1 ), where T is the transpose; the length of b i | i＝0，...,p-1 is all m, and the length of the b vector is m·p;

[0034] S302: The client calls the encryption algorithm operation to encrypt the vector b and obtains c b = Enc(pk, b);

[0035] S303: The client sends the encrypted data c b , the public key pk and the operation key ek to the server.

[0036] Further, step S4 is specifically as follows:

[0037] S401: The server fills the A matrix with zeros to supplement it into a square matrix A′; specifically, if n < m, add all-zero rows to A to supplement the matrix into a matrix of size m×m; if n > m, then add all-zero columns to A to supplement the matrix into a matrix of size n×n;

[0038] S402: The server encodes the square matrix A′ = [a i,j 0≤i≤k,0≤j≤k and obtains a (2k - 1)×kp-dimensional encoded matrix A ; where k = max(m, n);

[0039] S403: When n > m, transform the encrypted data c b to obtain the transformed encrypted data When n ≤ m,

[0040] ​Furthermore, the encoding in step S402 is row-by-row for the elements of the square matrix A' = [a i，j 0≤i≤k,0≤j≤k to obtain the encoding matrix A , and the specific process is as follows:

[0041] S4021: For 0 ≤ i < k, calculate the row vector of the i-th row of the encoding matrix where the k-dimensional row vector 0 i is an i-dimensional row vector of 0;

[0042] S4022: For k ≤ i < 2k - 1, calculate the row vector of the i-th row of the encoding matrix A i = repeat(φ k (a i-k+1，0 ), p); where the k-dimensional row vector 0 i-k is an (i - k)-dimensional row vector of 0.

[0043] Furthermore, step S403 is specifically as follows:

[0044] S4031: After performing a rotation operation on the ciphertext of the encrypted data c b , and then performing an addition operation with the encrypted data c b , to obtain the 2kp-dimensional ciphertext c' b = Add(c b , Rot(c b , -kp));

[0045] S4032: Calculate the transformed encrypted data according to the formula where is rounding up,

[0046] Further, step S5 is specifically as follows:

[0047] A S501: The server performs a multiplication calculation of plaintext and ciphertext row by row according to the input (2k-1)×kp and When 0 ≤ i < k, calculate<71]]

[0048] When k ≤ i < 2k - 1, calculate

[0049] Preferably, if A i ​​If the code is all zeros, then skip the calculation in step S501.

[0050] S502: Server Computing The ciphertext c of the matrix multiplication result is obtained. x and c x Send to the user.

[0051] Furthermore, the client uses the private key sk to decrypt c. x And decode to obtain the calculation result m = Dec(sk, c) of matrix A×B. x ).

[0052] Preferably, the homomorphic encryption scheme described in step S1 can be one of all schemes using SIMD technology, such as the BGV scheme, the B / FV scheme, and the CKKS scheme. The BGV scheme reference is as follows: Brakerski, Z., Gentry, C., Vaikuntanathan, V.: (Leveled) fully homomorphic encryption without bootstrapping. ACM Transactions on Computation Theory 6(3), 13:1-13:36 (2014). https: / / doi.org / 10.1145 / 2633600 The B / FV scheme references are as follows: Junfeng Fan and Frederik Vercauteren. Somewhat Practical Fully Homomorphic Encryption. CryptologyePrint Archive, Report 2012 / 144, 2012. https: / / eprint.iacr.org / 2012 / 144 ; CKKS scheme references are as follows: CHEON JH, KIM A, KIMM, et al. Homomorphic encryption for arithmetic of approximate numbers; proceedings of the Advances in Cryptology-ASIACRYPT2017: 23rd International Conference on the Theory and Applications of Cryptology and Information Security, Hong Kong, China, December 3-7, 2017, Proceedings, Part I 23, F, 2017[C]. Springer. https: / / doi.org / 10.1007 / 978-3-319-70694_815 .

[0053] Preferably, the safety parameter λ is taken as λ = 128 or 256; the error distribution χ is taken as a discrete Gaussian distribution.

[0054] The beneficial effects of this invention are as follows: This invention provides a matrix multiplication calculation method based on homomorphic encryption for plaintext and ciphertext. Within a privacy-preserving computation framework involving two parties, it enables fast and efficient matrix multiplication calculations for client requests. The server only processes encrypted data and has no access to any client matrix information, thus ensuring the security of both the model and the data. Furthermore, the matrix multiplication calculation result is consistent with the client's encoding, allowing for direct initiation of the next matrix multiplication, demonstrating strong generalization ability. In particular, when n ≤ m, it can achieve matrix multiplication calculations for larger p values ​​without increasing time overhead. Attached Figure Description

[0055] To illustrate the objectives and technical solutions of this invention, the following figures are provided:

[0056] Figure 1 A framework diagram of the existing technical solution;

[0057] Figure 2 This is a framework diagram of the technical solution of the present invention;

[0058] Figure 3 This is a flowchart of Embodiment 1 of the present invention;

[0059] Figure 4 This is a technical solution framework diagram of Embodiment 2 of the present invention;

[0060] Figure 5 This is a flowchart of Embodiment 2 of the present invention. Detailed Implementation

[0061] Example 1: In a typical encrypted matrix multiplication, to achieve privacy protection, the client encodes and encrypts its data, then sends the ciphertext to the server; the server performs calculations on the ciphertext data to obtain the matrix multiplication result; the client decrypts the ciphertext to obtain the matrix multiplication result.

[0062] In this embodiment, it is assumed that the server "Li Si" has a matrix A. 3×2 The client "Zhang San" has a matrix B. 2 ×4 The specific values ​​of the matrix are as follows:

[0063]

[0064] Assuming both parties select CKKS as the homomorphic encryption scheme, this invention provides a "matrix multiplication calculation method for plaintext and ciphertext based on homomorphic encryption".

[0065] The preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0066] like Figure 3 As shown, the steps of this invention are as follows:

[0067] Step 1: Zhang San sets the parameters of the CKKS homomorphic encryption scheme.

[0068] (1) Select the safety parameter λ = 128;

[0069] (2) Select a prime number p = 40;

[0070] (3) According to the homomorphic encryption standard, the parameter q is a product of four randomly selected odd prime numbers with a bit length between 40 and 60. The bit length of q is approximately 200.

[0071] It should be noted that the CKKS scheme differs slightly from other schemes. Furthermore, under these security parameters, based on the best attack methods currently documented, it can resist attacks with 2... 137 A rival in computational power for sub-bit operations.

[0072] Step 2: Zhang San generates a key based on the security parameters.

[0073] (1) From the coefficients {-1, 0, 1}, the number of times does not exceed A polynomial f is uniformly and randomly selected from the set of single-variable polynomials, and the private key sk = (1, f) is set.

[0074] (2) Uniformly and randomly select a polynomial a from the set of single-variable polynomials with coefficients {0, 1, 2, ..., q-1} and a degree not exceeding 8192. Select a noise polynomial e from a discrete Gaussian distribution with a standard deviation of 3.2 on the set of polynomials with integer coefficients and a degree not exceeding 8192. Let the public key pk = (-[(a·f+e)] q , a);

[0075] (3) Generate the operation key ek for noise control of ciphertext operation based on the private key sk and the public key pk.

[0076] Step 3: Zhang San encodes matrix B into vector b, and uses the public key pk to encrypt the vector to obtain encrypted data c. b Finally, the encrypted data c b The public key pk and the computation key ek are sent to Li Si.

[0077] (1) Encode matrix B into an 8-dimensional vector b = (0.1, 0.5, 0.2, 0.6, 0.3, 0.7, 0.4, 0.8).

[0078] (2) Encrypt vector b to c b =Enc pk (b) Obtain the encryption result c b =(c1,c2,c3,c4,c5,c6,c7,c8).

[0079] (3) Zhang San will c b The public key pk and the computation key ek are sent to Li Si.

[0080] Step 4: Li Si encodes matrix A to obtain the encoded matrix. A and encrypted data c b Perform the transformation to obtain the transformed encrypted data.

[0081] (1) Li Si determined that the size of the calculation is 3>2, therefore k=3, and the supplementary square matrix A is... 3×3 as follows:

[0082]

[0083] (2) Li Si's pair of matrix A 3×3 Encode to obtain A 5×12 Encoding matrix:

[0084]

[0085] (3) For the ciphertext c b To perform the transformation, first calculate c′. b = (c1, c2, c3, c4, c5, c6, c7, c8, c1, c2, c3, c4, c5, c6, c7, c8). Then, choosing l = 2 and z = 2, the following calculation process can be obtained by expanding the formula:

[0086]

[0087] By calculating, the ciphertext c is changed b The dimension is obtained

[0088] Step 5: Li Si uses the encoding matrix A 5×12 and the transformed encrypted data The public key pk and the computation key ek are used to perform matrix multiplication of plaintext and ciphertext, resulting in the ciphertext c of the matrix multiplication result. x and c x Send it to Zhang San.

[0089] (1) When 0 ≤ i < 3, calculate the following expression:

[0090]

[0091] Preferred options are available. A 2 is all 0, so the calculation is skipped; when 3 ≤ i < 5, the following expression is calculated:

[0092]

[0093] (2) Calculation The following result was obtained, c x = (c1+2c2, 3c1+4c2, 5c1+6c2, c3+2c4, 3c3+4c4, 5c3+6c4, c5+2c6, 3c5+4c6, 5c5+6c6, c7+2c8, 3c7+4c8, 5c7+6c8), and set c x Send it to Zhang San.

[0094] Step Six: Zhang San uses his private key sk to decrypt c. x Decrypt plaintext m = Dec(sk, c) x This yields the vector m = (1.1, 2.3, 3.5, 1.4, 3.0, 4.6, 1.7, 3.7, 5.7, 2.0, 4.4, 6.8), and finally, the matrix multiplication result is obtained.

[0095]

[0096] Example 2: In a typical privacy-preserving machine learning model, to achieve privacy protection, the client encrypts its data and sends the ciphertext to the server; the server inputs the ciphertext data into the model for prediction, obtains the ciphertext of the prediction result, and sends it to the client; the client decrypts the ciphertext to obtain the prediction result. Figure 4 As shown, the above matrix multiplication calculation method is applied to a Bayesian classifier to achieve the classification prediction task. Therefore, the Bayesian method needs to be optimized by adding additional operations for the classification task. This invention provides a "classification prediction method based on matrix multiplication calculation of plaintext and ciphertext using homomorphic encryption".

[0097] In this embodiment, it is assumed that user "Zhang San" holds four sample data points x1 = (0, 0), x2 = (0, 1), x3 = (1, 0), and x4 = (1, 1) to be classified, with possible classification labels of 0, 1, and 2. That is, the data has two features and may be classified into three different categories. It is further assumed that each feature takes a value in the set {0, 1}. It is assumed that server "Li Si" has model data with prior probability a. p= (0.4, 0.4, 0.2), and the likelihood matrix is:

[0098]

[0099] The Bayesian model is improved by taking the logarithm of both the prior probability and the likelihood matrix, and then concatenating the likelihood matrices into a single large matrix A. For all the feature values ​​of the samples to be predicted, the index corresponding to each feature value is set to 1, and all others are set to 0, concatenating these into matrix B.

[0100]

[0101] a p = (-0.916, -0.916, -1.609);

[0102] Therefore, we only need to calculate the matrix multiplication result of A×B, and then add the prior probability a to each column of the result. p Finally, the values ​​are decrypted and compared. It's important to note that, to avoid revealing model information, the same random noise is added to each column of the resulting matrix.

[0103] The preferred application examples of the present invention will now be described in detail with reference to the accompanying drawings.

[0104] like Figure 5 As shown, the application steps of this invention in Bayesian classification prediction are as follows:

[0105] Step 1: Zhang San sets the parameters of the CKKS homomorphic encryption scheme.

[0106] (1) Select the safety parameter λ = 128;

[0107] (2) Select a prime number p = 40;

[0108] (3) According to the homomorphic encryption standard, the parameter q is a product of four randomly selected odd prime numbers with a bit length between 40 and 60. The bit length of q is approximately 200.

[0109] It should be noted that the CKKS scheme differs slightly from other schemes. Furthermore, under these security parameters, based on the best attack methods currently documented, it can resist attacks with 2... 137 A rival in computational power for sub-bit operations.

[0110] Step 2: Zhang San generates a key based on the security parameters.

[0111] (1) From the coefficients {-1, 0, 1}, the number of times does not exceed A polynomial f is uniformly and randomly selected from the set of single-variable polynomials, and the private key sk = (1, f) is set.

[0112] (2) Uniformly and randomly select a polynomial a from the set of single-variable polynomials with coefficients {0, 1, 2, ..., q-1} and a degree not exceeding 8192. Select a noise polynomial e from a discrete Gaussian distribution with a standard deviation of 3.2 on the set of polynomials with integer coefficients and a degree not exceeding 8192. Let the public key pk = (-[(a·f+e)] q , a);

[0113] (3) Generate the operation key ek for noise control of ciphertext operation based on the private key sk and the public key pk.

[0114] Step 3: Zhang San encodes matrix B into vector b, and uses the public key pk to encrypt the vector to obtain encrypted data c. b Finally, the encrypted data c b The public key pk and the computation key ek are sent to Li Si.

[0115] (1) Encode matrix B into a 16-dimensional vector b = (1, 0, 1, 0, 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 0, 1).

[0116] (2) Encrypt vector b to c b =Enc pk (b) yields ciphertext c with a length of 16 dimensions. b = (c1, c2, ..., c 16 ).

[0117] (3) Zhang San will c b The public key pk and the computation key ek are sent to Li Si.

[0118] Step 4: Li Si encodes matrix A to obtain the encoded matrix. A and encrypted data c b Perform the transformation to obtain the transformed encrypted data.

[0119] (1) Li Si determined that the size of the calculation is 3 < 4, therefore k = 4, and the supplementary square matrix A is... 4×4 as follows:

[0120]

[0121] (2) Li Si's pair of matrix A 4×4 Encode to obtain A 7×16 Encoding matrix:

[0122]

[0123] (3) Li Si calculates based on the fact that 3 < 4.

[0124] Step 5: Li Si uses the encoding matrix A 7×16 and the transformed encrypted data The public key pk and the computation key ek are used to perform matrix multiplication of plaintext and ciphertext, resulting in the ciphertext c of the matrix multiplication result. x .

[0125] (1) When 0 ≤ i < 4, calculate the following expression:

[0126]

[0127] Preferred A 2 is all 0, so the calculation is skipped; when 4 ≤ i < 7, the following expression is calculated:

[0128]

[0129] (2) Calculation Obtain the ciphertext c x .

[0130] Step Six: Extend the prior probability a using Li Si. p And generate a random number sequence a rand And update the ciphertext c of the matrix multiplication calculation result. x middle.

[0131] (1) Li Si's prior probability a p To expand, first add a 0, then add a... p Repeat 4 times to update and obtain the 12-dimensional a. p Then, four random numbers {0.1, 0.3, 0.2, 0.4} are randomly selected, and each random number is repeated three times, with a 0 added between each number, generating a 12-dimensional random sequence 'a'. rand :

[0132] a p = (-0.916, -0.916, -1.609, 0, -0.916, ..., 0),

[0133] a rand = (0.1, 0.1, 0.1, 0, 0.3, 0.3, ..., 0);

[0134] (2) Update c x , making c x =c x +a p +a rand , where addition represents the addition operation between ciphertext and plaintext.

[0135] This step is an additional operation performed to complete the Bayesian classification, in which random numbers are added to ensure that the information of the Bayesian model is not leaked.

[0136] Step 7: Zhang San uses his private key sk to decrypt c. x Decrypt plaintext m = Dec(sk, c x The decryption result is as follows:

[0137] m=(-3.341, -2.713, -2.713, 0, -1.755, -2.513, -2.918, 0, -2.836, -1.766, -2.613, 0, -1.250, -1.566, -2.818, 0),

[0138] Then, the first three values ​​of every four data points from the 16 data points are compared. The index of the maximum value is the classification result. Therefore, the classification result for the four samples is: {1, 0, 1, 0}. It is evident that the method of this invention can accurately achieve client-side data classification prediction under privacy protection, consistent with the calculation results of plaintext classification prediction methods.

[0139] Finally, it should be noted that the above preferred embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail through the above preferred embodiments, those skilled in the art should understand that various changes can be made to it in form and detail without departing from the scope defined by the claims of the present invention.

Claims

1. A matrix multiplication method for plaintext and ciphertext based on homomorphic encryption, characterized in that, The method includes the following steps: S1: Set the security parameter λ of the homomorphic encryption scheme ε=(Enc,Dec), and generate the relevant encryption and decryption parameters of the homomorphic encryption scheme based on the security parameter λ; S2: The client generates a private key sk, a public key pk, and a computation key ek based on the encryption and decryption parameters; S3: The client encodes matrix B into vector b, and uses the public key pk to encrypt vector b to obtain encrypted data c. b Then encrypt the data c b The public key pk and the computation key ek are packaged and sent to the server; S4: The server encodes matrix A to obtain the encoded matrix. A and encrypted data c b Perform the transformation to obtain the transformed encrypted data. S5: The server uses the encoding matrix A and the transformed encrypted data The public key pk and the computation key ek are used to perform matrix multiplication of plaintext and ciphertext, resulting in the ciphertext c of the matrix multiplication result. x and c x Send to the user; S6: The client uses the private key sk to decrypt c. x And decode it to obtain the calculation result of matrix A×B; Enc represents the encryption algorithm, and Dec represents the decryption algorithm; The specific steps of S1 are as follows: S101: Determine the security parameter λ, i.e., at least withstand 2 λ A rival in computational power for sub-bit operations; S102: The user selects an integer p based on the sample data; S103: Based on the security parameter λ and following the recommendations in the Homomorphic Encryption Security Standard, the user selects parameters m and q to determine the plaintext space of the homomorphic encryption scheme. That is, polynomial ring with integer coefficients Modulus of m-th degree cyclotomic polynomial φ m The ideal residual ring obtained after generating (X) and integer p, the ciphertext space is: The specific steps of S2 are as follows: S201: The client generates a coefficient by randomly selecting an indeterminate variable X from the set {-1, 0, 1} with moderate probability, the number of times of selection does not exceed... A random polynomial f, where Let f represent the number of elements in the set {1, 2, ..., m} that are relatively prime to m. Then the private key sk = (1, f). S202: Client from R q From a uniform distribution, a polynomial a of an indeterminate variable X is randomly selected. If a noise polynomial e is randomly selected from the error distribution χ with respect to an indeterminate variable X, then the public key pk = (-[(a·f+e)]). q , a), where [·] q This represents the polynomial obtained by modulo q the coefficients of the polynomial in square brackets. S203: The client generates the computation key ek required for noise control during the ciphertext operation based on the selected homomorphic encryption scheme; The specific steps of step S3 are as follows: S301: Client accesses matrix B m×p Encode the matrix by treating each column as a vector, i.e. Then, arrange the elements of each column of matrix B in order to obtain the vector b = (b0, b... 1， …,b p-1 ),in, T For transpose; b i | i＝0，...，p-1 The length of each vector is m, and the length of vector b is m·p; S302: The client calls the encryption algorithm to encrypt vector b, obtaining c. b =Enc(pk, b); S303: The client will encrypt the data c b The public key pk and the computation key ek are sent to the server; The specific steps of S4 are as follows: S401: The server fills matrix A with zeros to make it a square matrix A′; specifically, if n < m, a row of all zeros is added to A to make the matrix an m×m matrix; if n > m, a column of all zeros is added to A to make the matrix an n×n matrix. S402: The server faces matrix A′ = [a i，j ] 0≤i≤k,0≤j≤k Encoding is performed to obtain a (2k-1)×kp dimensional encoding matrix. A Where, k = max(m, n); S403: When n > m, for encrypted data c b Perform the transformation to obtain the transformed encrypted data. When n≤m The specific steps of S402 are as follows: S4021: For 0 ≤ i < k, calculate the row vector of the i-th row of the encoding matrix. Wherein, k-dimensional row vectors 0 i Let i be an i-dimensional row vector of size 0; S4022: For k ≤ i < 2k-1, calculate the row vector of the i-th row of the encoding matrix. A i =repeat(φ k (a i-k+1,0 ), p); where k-dimensional row vectors 0 i-k Let (ik) be a row vector of dimension 0; The specific steps of S403 are as follows: S4031: For encrypted data c b After performing a rotation operation on the ciphertext, it is then combined with the encrypted data c. b Performing the addition operation yields the 2kp-dimensional ciphertext c′. b =Add(c b Rot(c) b ,-kp)); S4032: According to the formula Calculate the transformed encrypted data in, To round up, The specific steps of step S5 are as follows: S501: The server, based on the input... A (2k-1)×kp and Perform the plaintext-ciphertext multiplication row by row; when 0 ≤ i < k, calculate... When k ≤ i < 2k-1, calculate S502: Server Computing The ciphertext c of the matrix multiplication result is obtained. x and c x Send to the user.

2. The matrix multiplication method for plaintext and ciphertext based on homomorphic encryption according to claim 1, characterized in that, The homomorphic encryption scheme described in step S1 is any one of all schemes that use SIMD technology.

3. The matrix multiplication method for plaintext and ciphertext based on homomorphic encryption according to claim 1, characterized in that, The safety parameter λ is set to λ = 128 or 256; the error distribution χ is set to a discrete Gaussian distribution.

4. The matrix multiplication method for plaintext and ciphertext based on homomorphic encryption according to claim 1, characterized in that, If in step S501 A i If the code is all zeros, then skip the calculation in step S501.

Images