A method, apparatus and system for processing data for privacy protection

Abstract

A data processing method, device and system for protecting privacy, the method comprising: a device of a first party performing the following operations: obtaining first ciphertext and second ciphertext; determining a first parameter value and a second parameter value based on a first number of first coefficients in first plaintext polynomials and second plaintext polynomials corresponding to the first ciphertext and the second ciphertext; performing homomorphic calculation based on the first parameter value, the second parameter value, the first ciphertext and the second ciphertext to obtain third ciphertext, the third ciphertext corresponding to a third plaintext polynomial including the first number of first coefficients; and sending the third ciphertext to a device of a second party; and the device of the second party decrypting the third ciphertext to obtain the third plaintext polynomial and obtaining the first number of first coefficients from the third plaintext polynomial.

Description

Technical Field

[0001] The embodiments in this specification belong to the field of data processing technology, and in particular relate to a data processing method, device and system for protecting privacy. Background Technology

[0002] In multi-party data processing scenarios, there are typically matrix holders and vector holders. These holders need to calculate the inner product of the matrix and vectors while protecting the privacy of all parties. Related technologies utilize on-ring fault-tolerant learning (RLWE) homomorphic encryption algorithms. This involves converting multiple row vectors in the matrix into multiple first plaintext polynomials, converting the target vector into a second plaintext polynomial, encrypting the second plaintext polynomials to obtain first ciphertext, and multiplying each first plaintext polynomial by the first ciphertext to obtain multiple second ciphertexts. The plaintext polynomials corresponding to these second ciphertexts include the inner product values ​​of each row vector in the matrix and the target vector. Summary of the Invention

[0003] The purpose of this invention is to provide a data processing solution that can save computing and storage resources and reduce communication traffic.

[0004] This specification provides a privacy-protecting data processing method, which is executed by a first party's device and a second party's device, wherein the second party possesses a public key for homomorphic encryption and a private key corresponding to the public key, and the method includes:

[0005] The first party's device performs the following operations:

[0006] Obtain the first ciphertext and the second ciphertext, which are respectively homomorphic ciphertexts of the first plaintext polynomial and the second plaintext polynomial. The first ciphertext and the second ciphertext correspond to the public key, and the first plaintext polynomial and the second plaintext polynomial are polynomials in the same polynomial space.

[0007] Based on the first number of first coefficients used as target coefficients in the first plaintext polynomial and the second plaintext polynomial, a first parameter value and a second parameter value are determined. The first parameter value is used in the homomorphic calculation of homomorphic substitution of the homomorphic ciphertext, and the second parameter value is used in the homomorphic calculation of homomorphic multiplication of the homomorphic ciphertext. Based on the first parameter value, the second parameter value, the first ciphertext, and the second ciphertext, a third ciphertext is obtained by performing homomorphic calculations. The third plaintext polynomial corresponding to the third ciphertext includes the first number of first coefficients.

[0008] Send the third ciphertext to the second party's device;

[0009] The second party's device decrypts the third ciphertext based on the private key to obtain the third plaintext polynomial, and extracts the first coefficient of the first number from the third plaintext polynomial.

[0010] The second aspect of this specification provides a data processing method for protecting privacy, including:

[0011] Obtain the first ciphertext and the second ciphertext, where the first ciphertext and the second ciphertext are homomorphic ciphertexts of the first plaintext polynomial and the second plaintext polynomial, respectively, and the first plaintext polynomial and the second plaintext polynomial are polynomials in the same polynomial space.

[0012] Based on the first number of the first coefficients that serve as target coefficients in the first plaintext polynomial and the second plaintext polynomial, a first parameter value and a second parameter value are determined. The first parameter value is used in the homomorphic calculation of homomorphic substitution of the homomorphic ciphertext, and the second parameter value is used in the homomorphic calculation of homomorphic multiplication of the homomorphic ciphertext.

[0013] Homomorphic computation is performed based on the first parameter value, the second parameter value, the first ciphertext, and the second ciphertext to obtain the third ciphertext. The third plaintext polynomial corresponding to the third ciphertext includes the first number of first coefficients.

[0014] A third aspect of this specification provides a computing device, comprising:

[0015] The acquisition unit is used to acquire a first ciphertext and a second ciphertext, wherein the first ciphertext and the second ciphertext are respectively homomorphic ciphertexts of a first plaintext polynomial and a second plaintext polynomial, and the first plaintext polynomial and the second plaintext polynomial are polynomials in the same polynomial space.

[0016] The determining unit is used to determine a first parameter value and a second parameter value based on the first number of first coefficients that are target coefficients in the first plaintext polynomial and the second plaintext polynomial. The first parameter value is used in the homomorphic calculation of homomorphic substitution of homomorphic ciphertext, and the second parameter value is used in the homomorphic calculation of homomorphic multiplication of homomorphic ciphertext.

[0017] The calculation unit is used to perform homomorphic computation based on the first parameter value, the second parameter value, the first ciphertext, and the second ciphertext to obtain a third ciphertext, wherein the third plaintext polynomial corresponding to the third ciphertext includes the first number of first coefficients.

[0018] A fourth aspect of this specification provides a privacy-protecting data processing system, the system comprising a first-party device and a second-party device, wherein the second party possesses a public key for homomorphic encryption and a private key corresponding to the public key.

[0019] The first party's device is used to perform the following operations:

[0020] Obtain the first ciphertext and the second ciphertext, which are respectively homomorphic ciphertexts of the first plaintext polynomial and the second plaintext polynomial. The first ciphertext and the second ciphertext correspond to the public key, and the first plaintext polynomial and the second plaintext polynomial are polynomials in the same polynomial space.

[0021] Based on the first number of the first coefficients that serve as target coefficients in the first plaintext polynomial and the second plaintext polynomial, a first parameter value and a second parameter value are determined. The first parameter value is used in the homomorphic calculation of homomorphic substitution of the homomorphic ciphertext, and the second parameter value is used in the homomorphic calculation of homomorphic multiplication of the homomorphic ciphertext.

[0022] Homomorphic computation is performed based on the first parameter value, the second parameter value, the first ciphertext, and the second ciphertext to obtain the third ciphertext. The third plaintext polynomial corresponding to the third ciphertext includes the first number of first coefficients.

[0023] Send the third ciphertext to the second party's device;

[0024] The second party's device is used to decrypt the third ciphertext based on the private key to obtain the third plaintext polynomial, and to obtain the first coefficient of the first number from the third plaintext polynomial.

[0025] The fifth aspect of this specification provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method described in the second aspect.

[0026] A sixth aspect of this specification provides a computing device including a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method described in the second aspect.

[0027] This specification provides a privacy-protecting data processing method. The method allows for homomorphic computation of multiple ciphertexts based on the number of target coefficients in each ciphertext. This enables the processing of two ciphertexts in a single data processing step, where the two ciphertexts are packaged into a single packaged ciphertext. The plaintext corresponding to this packaged ciphertext includes all the target coefficients corresponding to the two ciphertexts. This packaged ciphertext can then be sent to a second-party device, allowing the second-party device to obtain all the target coefficients corresponding to the two ciphertexts. Compared to existing methods, this method reduces the amount of communication data between the first and second-party devices while achieving the same effect, also reducing computational complexity and saving computational resources. Attached Figure Description

[0028] To more clearly illustrate the technical solutions of the embodiments in this specification, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0029] Figure 1 This is a system architecture diagram in one embodiment;

[0030] Figure 2 This is a flowchart of the data processing method in the embodiments of this specification;

[0031] Figure 3 Execute for matrix holder Figure 2 A schematic diagram of the process of the method shown;

[0032] Figure 4 This is a schematic diagram illustrating the process by which the matrix holder packages multiple ciphertexts in one embodiment of this specification.

[0033] Figure 5 A flowchart of a data processing method according to another embodiment of this specification is shown;

[0034] Figure 6 This is an architectural diagram of a computing device as described in an embodiment of this specification. Detailed Implementation

[0035] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0036] The schemes in the embodiments of this specification are based on homomorphic encryption algorithms. Homomorphic encryption algorithms include the following six algorithms:

[0037] (1) Key generation algorithm (KeyGen), which is used to generate private key sk and public key pk.

[0038] Let plaintext space be a polynomial space In this polynomial space, the degree is less than N, where N is a power of 2, for example, it can take values ​​such as 4096, 8192, etc., and the coefficients are integers in [0, q). The ciphertext space corresponding to this plaintext space is... R can be randomly generated using a key generation algorithm.q A polynomial, sk, is a private key , where each coefficient of the polynomial follows a standard deviation of χ. σ The discrete Gaussian distribution is then used. A public key pk = (-a*sk + e, a) can then be generated, where a is a discrete Gaussian distribution in R. q A randomly generated polynomial, e ← χ σ .

[0039] (2) Encoding algorithm, used to encode plaintext vectors Transform into a polynomial v∈R q .

[0040] (3) Encryption algorithm, used to encrypt the plaintext polynomial v into ciphertext (the ciphertext is in the form of two polynomials) using a public key. Specifically, let pk = (p0, p1), then the ciphertext... Here, c1 = u*p1 + e1, c0 = u*p0 + e0 + v, where v is a plaintext polynomial.

[0041] (4) Decryption algorithm: This decryption algorithm is used to decrypt ciphertext into plaintext polynomial. Let the ciphertext ct = (c0, c1), then v ≈ (c0 + c1 * sk) mod q is the decrypted plaintext polynomial.

[0042] (5) Decode algorithm, which is used to convert plaintext polynomials into plaintext vectors.

[0043] (6) Homomorphic computation, including homomorphic addition, homomorphic multiplication, homomorphic substitution, etc.

[0044] Specifically, in homomorphic addition, for plaintext polynomials m and t, E(m+t) = E(m) + E(t), where plaintext polynomials m and t are polynomials in the same polynomial space, and E(t) represents the ciphertext obtained by homomorphically encrypting the ciphertext polynomial; in homomorphic multiplication, E(t*m) = t*E(m), and in one type of homomorphic multiplication, E(x) = t*E(m). i *m)=x i *E(m); In homomorphic substitution, suppose the ciphertext of polynomial m(x) is ct(x), then ct(x) t )=E(m(x t )).

[0045] Figure 1 This is a system architecture diagram of one embodiment. For example... Figure 1As shown, the system may include device 101, which holds a matrix P0, and device 102, which holds a vector P1. Device 101 stores an m x n matrix owned by matrix holder P0, and device 102 stores an n-dimensional vector owned by vector holder P1. To protect the privacy data of matrix holder P0 and vector holder P1 respectively, device 102 can generate a private key sk and a public key pk for homomorphic encryption. Device 102 can use the public key pk to homomorphically encrypt the vector, generating ciphertext of the vector (i.e., ciphertext of the plaintext polynomial corresponding to the vector), and send the ciphertext to device 101. Device 101 can convert each row vector of the matrix into at least one plaintext polynomial, and then calculate the ciphertext containing the inner product result based on the at least one plaintext polynomial and the ciphertext of the vector, and send the ciphertext containing the inner product result to device 102. Device 102 can then use the private key sk to homomorphically decrypt the ciphertext containing the inner product result, thereby obtaining the inner product of each row vector of the matrix with the vector. In this context, ciphertext containing an inner product refers to plaintext polynomials that include an inner product.

[0046] The embodiments described in this specification can be applied to scenarios such as multi-party collaborative modeling. In this scenario, the matrix holder P0 is, for example, a model provider offering the model, and the matrix held by the model is, for example, the parameter matrix in the model. The vector holder is, for example, a data provider offering feature data. After the data provider sends ciphertext containing the vectors to the model provider, the model provider can input the ciphertext into the model, thereby outputting ciphertext containing the inner product.

[0047] The embodiments in this specification can also be used in scenarios involving privacy information retrieval. In this scenario, the device 101 of the matrix holder P0 is, for example, a server storing a database containing matrix-style data, and the device 102 is a user device. When the user device needs to query the i-th column of the matrix, it can construct a vector for querying the data, where the i-th component of the vector is 1 and the other components are 0.

[0048] For example, the matrix holder owns a matrix W that is, for example, a 4x4 matrix:

[0049]

[0050] W can be considered to contain four row vectors.

[0051] When device 102 needs to query data in the second column of the matrix, it can construct a vector for querying the data.

[0052] in, Representing vectors with vector The inner product, specifically, is

[0053]

[0054] In other words, by using vectors As described above, the vector can be calculated by comparing the matrix W with the vector. The product of these elements yields a column of matrix W. The calculation of matrix W and vectors... During multiplication, the matrix W is calculated by multiplying the row vectors and vectors within it. The inner product of the vectors gives the matrix W and the vector W. The product of the matrix and the vector. Therefore, to protect the privacy of both the matrix holder and the vector holder, the above calculation can be performed using a homomorphic encryption algorithm.

[0055] Specifically, the vector holder can transfer the vector Convert to the polynomial v = 0 + x + 0x 2 +0x 3 =x, using the homomorphic encryption public key pk to encrypt the polynomial v, obtaining the ciphertext Cv = E(v) of the polynomial v, where E() represents the homomorphic encryption algorithm, and the ciphertext Cv includes two ciphertext polynomials (C v0 C v1 The vector holder can send the ciphertext Cv to the matrix holder.

[0056] The matrix holder can include the four row vectors of matrix W. Convert to 4 polynomials:

[0057] w0 = 1 - 4x - 3x 2 -2x 3 ,

[0058] w1 = 3 - 6x - 5x 2 -4x 3 ,

[0059] w² = 2 - 5x - 4x 2 -3x 3 ,

[0060] w3 = 4 - 7x - 6x 2 -5x 3 .

[0061] Where, w0×v=(1-4x-3x) 2 -2x 3 )×(0+x+0x 2 +0x 3 )

[0062] =(1×0-4x×0x) 3 -3x 2 ×0x 2-2x 3 ×x)+…

[0063] =(1×0-4×0x) 4 -3×0x 4 -2×1x 4 )+… (1)

[0064] In the above formula (1), “…” represents other terms raised to powers of x, which will not be specifically written here. As mentioned above, in the homomorphic encryption algorithm, the plaintext space is a polynomial space R. q The degree in this polynomial space is less than 4, where N = 4. In the polynomial space of N = 4, we can set x... 4 =-1, therefore, the above formula (1) can be converted to:

[0065]

[0066] That is, the constant term in the polynomial of w0×v is

[0067] Similar to formula (2), it can be concluded that

[0068]

[0069]

[0070]

[0071] According to the homomorphic encryption algorithm, E(w×v) ← w×E(v). Therefore, the matrix holder can calculate the polynomial w. i The product w of (i is any value from 0 to 3) and the homomorphic ciphertext Cv of polynomial v. i ×Cv, obtain w i ×v corresponds to the ciphertext C wi =E(w i ×v)=w i ×Cv, and can convert four ciphertexts C w0 ~C w3 Send to the vector holder. Wherein, the polynomial w... i The product of the homomorphic ciphertext Cv with polynomial v is w i ×(C v0 C v1 )=(w i ×C v0 ,w i ×C v1 The vector holder can access four ciphertexts C. w0 ~C w3 Deciphering yields the various polynomials w. i ×v, which can be derived from various polynomials wi ×v retrieves the constant term, thereby obtaining each... This allows us to obtain the second column of matrix W. In this way, during the data query process, the server cannot know the specific data queried by the user, protecting user privacy. At the same time, the user cannot access the data in other columns of matrix W, thus protecting the server's data privacy.

[0072] In the above process, the matrix holder calculates four ciphertexts C. w0 ~C w3 Next, the four ciphertexts need to be sent to the vector holder so that the vector holder can obtain the constant terms in the plaintext polynomials corresponding to the four ciphertexts. Therefore, the amount of communication data between the matrix holder and the vector holder is relatively large.

[0073] This specification provides a privacy-protecting data processing method. A server can package multiple ciphertexts into a single ciphertext, ensuring that the plaintext polynomial corresponding to the packaged ciphertext includes all coefficients that need to be retained from the plaintext polynomials corresponding to the multiple ciphertexts. The server then sends the packaged ciphertext to the user equipment. Compared to related technologies, the data processing method provided in this specification reduces the amount of communication data.

[0074] Figure 2 This is a flowchart of a privacy-protecting data processing method according to an embodiment of this specification, which is performed, for example, by a vector holder and a matrix holder.

[0075] like Figure 2 As shown, in step S210, the vector holder generates the ciphertext Cv of the vector.

[0076] As mentioned above, the vector holder can pre-generate a private key sk and a public key pk for homomorphic encryption. The vector holder can then transfer the vectors they possess. Convert the plaintext polynomial v to plaintext polynomial v, and encrypt the plaintext polynomial v using the public key pk to obtain the ciphertext Cv of the plaintext polynomial v, where the ciphertext Cv includes two ciphertext polynomials.

[0077] Specifically, in one implementation, as described above, the vector For example, a 4-dimensional vector, i.e. Figure 1 In n=4, It can be converted into a polynomial v = 0 + x + 0x 2 +0x 3 =x, the vector holder uses the public key pk to encrypt the plaintext polynomial v, obtaining the ciphertext Cv.

[0078] In step S520, the vector holder sends the ciphertext Cv to the matrix holder.

[0079] In step S530, the matrix holder converts its matrix W into multiple plaintext polynomials, and multiplies each plaintext polynomial with the ciphertext Cv to obtain multiple ciphertexts.

[0080] Specifically, matrix W is, for example, a 4x4 matrix.

[0081]

[0082] The matrix holder can include the four row vectors of matrix W. Convert to 4 polynomials:

[0083] w 10 =1-4x 5 -3x 6 -2x 7 ,

[0084] w 11 =3-6x 5 -5x 6 -4x 7 ,

[0085] w 12 =2-5x 5 -4x 6 -3x 7 ,

[0086] w 13 =4-7x 5 -6x 6 -5x 7 .

[0087] Subsequently, the matrix holder can base their decision on the plaintext polynomial w. 10 and w 12 Generate plaintext polynomial y0 based on w 11 and w 13 Generate plaintext polynomial y1:

[0088] y0 = w 10 +x 4 ×w 12 =1 + 5x + 4x 2 +3x 3 +2x 4 -4x 5 -3x 6 -2x 7 ,

[0089] y1 = w 11 +x 4 ×w 13 =1 + 7x + 6x 2 +5x 3 +4x 4 -6x5 -5x 6 -4x 7 .

[0090] In this context, the degree of the polynomial space to which the plaintext polynomials y0 and y1 belong is set to be less than 8, i.e., the N of the polynomial space is 8, and x is in this polynomial space. 8 =-1.

[0091] The matrix holder can obtain two ciphertexts, y0×Cv and y1×Cv, by multiplying the plaintext polynomials y0 and y1 with the ciphertext Cv respectively. These two ciphertexts can be represented as C1 and C2 respectively. As mentioned above, y0×Cv=E(y0×v), y1×Cv=E(y1×v).

[0092] in,

[0093]

[0094] in, Representing vectors with vector The inner product of.

[0095] In other words, the coefficients of the constant term in the plaintext polynomial y0×v corresponding to the ciphertext C1 are row vectors. with vector The inner product of the ciphertext C1 and the plaintext polynomial y0×v, where x is the inner product. 4 The coefficients of the terms are row vectors with vector The inner product, the coefficients of the constant term in the plaintext polynomial corresponding to ciphertext C1, and x 4 The term coefficients need to be provided to the vector holder.

[0096] Similarly, we can conclude that

[0097]

[0098] In other words, the coefficients of the constant term in the plaintext polynomial y1×v corresponding to ciphertext C2 are row vectors. with vector The inner product of the ciphertext C2 and the plaintext polynomial y1×v, where x is the inner product. 4 The coefficients of the terms are row vectors with vector The inner product of the ciphertext C2, the coefficients of the constant term in the plaintext polynomial, and x 4 The term coefficients need to be provided to the vector holder.

[0099] It is understandable that the matrix W and vector mentioned above... These are merely exemplary embodiments and not intended to limit the scope of the embodiments described in this specification. In one implementation, the matrix W2 of the matrix holder includes, for example, […]. There are a total of 8 row vectors. Similar to the above, the row vectors can be... Convert them to polynomials w respectively 20 w 21 ...w 27 .

[0100] Similar to the above, the matrix holder can base it on the plaintext polynomial w. 20 and w 24 Generate plaintext polynomial y 20 Based on w 21 and w 25 Generate plaintext polynomial y 21 Based on plaintext polynomial w 22 and w 26 Generate plaintext polynomial y 22 Based on plaintext polynomial w 23 and w 27 Generate plaintext polynomial y 23 ,Right now:

[0101] y 20 =w 20 +x 4 ×w 24 ,

[0102] y 21 =w 21 +x 4 ×w 25 ,

[0103] y 22 =w 22 +x 4 ×w 26 ,

[0104] y 23 =w 23 +x 4 ×w 27 ,

[0105] Similarly, by using the plaintext polynomial y 20 ~y 23 Multiplying each of these by the ciphertext Cv yields four ciphertexts y. 20 ×Cv~y 23 ×Cv, which can be represented as C respectively. 21 ~C 24 .

[0106] Referring to formulas (3) and (4) above, similarly, the ciphertext C can be obtained. 21 ~C 24The four corresponding plaintext polynomials are:

[0107]

[0108]

[0109]

[0110]

[0111] In other words, ciphertext C 21 ~C 24 The coefficients of the constant term in each of the four corresponding plaintext polynomials and x 4 The term coefficients need to be provided to the vector holder.

[0112] In step S240, the matrix holder packages multiple ciphertexts to obtain ciphertext Cq.

[0113] In one instance, the matrix holder obtains the ciphertext C1 and ciphertext C2 as described above. As mentioned above, the number of coefficients (i.e., target coefficients) that need to be provided to the vector holder in the plaintext polynomials corresponding to ciphertext C1 and ciphertext C2 are two, respectively.

[0114] like Figure 2 As shown, the matrix holder can package ciphertext C1 and ciphertext C2 by performing steps S241 and S243.

[0115] Specifically, in step S241, the matrix holder determines the first parameter value and the second parameter value based on the number of target coefficients in the plaintext polynomials Vi and Vj corresponding to the ciphertext Ci and ciphertext Cj.

[0116] The first parameter is the number of times x is raised to the power of x to perform homomorphic substitution on x in the ciphertext, and the second parameter is the number of times x is raised to the power of x to perform homomorphic multiplication on the ciphertext.

[0117] In one implementation, the number of coefficients to be retained in the plaintext polynomials Vi and Vj is 2. s ,2 s It should be less than or equal to N, so the value of the first parameter can be determined to be 2. s +1, the second parameter value is N / 2 s .

[0118] Figure 3 This is a schematic diagram illustrating the process of executing step S240 for the matrix holder. (See diagram below.) Figure 3As shown, assuming that ciphertext C1 corresponds to the plaintext polynomial V1 (i.e., y0 × v), and ciphertext C2 corresponds to the plaintext polynomial V2 (i.e., y1 × v), the form of the plaintext polynomial V1 corresponding to ciphertext C1 is, for example, V1 = v0 + v1x + ... v N x N Assume N = 8, Figure 3 The boxes arranged in sequence represent the coefficients of each term in the plaintext polynomial V1, where "*" indicates the coefficients of terms that are not of interest in V1. In the example above, V1 can be in the form V1 = 2 + ... + 3x 4 +…, the specific form of V2 can be V2==4+…+5x 4 +… Wherein, as mentioned above, the coefficients of the constant terms in plaintext polynomials V1 and V2, and the N / 2th term (i.e., x…) 4 The coefficients of the terms are vector dot products, i.e. Figure 3 In V1, coefficients 2 and 3 are located in boxes 1 and 5 respectively, and in V2, coefficients 4 and 5 are located in boxes 1 and 5 respectively. Therefore, the total number of target coefficients to be retained in plaintext polynomials V1 and V2 is 2 + 2 = 4. Accordingly, the first parameter value can be determined to be 5, and the second parameter value to be 8 / 4 = 2.

[0119] In step S243, the matrix holder performs homomorphic computation based on the first parameter value, the second parameter value, the ciphertext Ci, and the ciphertext Cj to obtain the ciphertext Ck.

[0120] refer to Figure 3 The matrix holder can first perform homomorphic substitution on both ciphertext C1 and ciphertext C2 based on the first parameter value, that is, replace x in ciphertext C1 with x. 5 Replace x in ciphertext C2 with x 5 Specifically, the x in both polynomials included in the ciphertext C1 is replaced with x. 5 Replace x in the two polynomials included in the ciphertext C2 with x 5 .

[0121] Specifically, based on the principle of homomorphic substitution, x in the ciphertext C1 is replaced with x. 5 This is equivalent to replacing x in the plaintext polynomial V1 with x 5 This requires transforming the plaintext polynomial V1 into the following form:

[0122] V1(x 5 )=v0+v1x 5 +…v N x 5N (5)

[0123] Among them, the plaintext polynomial V1(x) 5The constant terms in ) are the same as the constant terms in the plaintext polynomial V1.

[0124] For formula (5) mod(x) N +1), which is the x in formula (5) N Replace with -1 so that V1(x) 5 The polynomial space of ) corresponds to the polynomial space of the plaintext polynomial. After this processing, the polynomial space of formula (5) is... In other words, after homomorphic substitution, the equation (5) becomes... The coefficients of the terms become the plaintext polynomial V1 The negative of the coefficient of the term. Similarly, in formula (5) In other words, after homomorphic substitution, the equation (5) becomes... The coefficients of the terms become the plaintext polynomial V1 The negative of the coefficient of the term. Additionally, in formula (5) In other words, after homomorphic substitution, the equation (5) becomes... The coefficients of the terms and the plaintext polynomial V1 The coefficients of the terms are the same.

[0125] When N=8, refer to Figure 3 After performing a homomorphic substitution on the ciphertext C1, we obtain the polynomial V1(x) that is identical to the plaintext polynomial. 5 The corresponding ciphertext C1(x) 5 ), plaintext polynomial V1(x 5 Compared to plaintext polynomial V1, plaintext polynomial V1(x) 5 constant term and x 4 (Right now The coefficient of the term is the same as the corresponding term in the plaintext polynomial V1, and the plaintext polynomial V1(x) 5 x in ) 2 (Right now ) terms and x 6 (Right now The coefficients of the terms are the negatives of the coefficients of the corresponding terms in the plaintext polynomial V1.

[0126] In this way, by combining ciphertext C1 with ciphertext C1(x) 5 Adding these together, we get the corresponding plaintext polynomial V1 + V1(x) 5 The constant term and x 4 The coefficient of the term is twice the coefficient of the corresponding term in the plaintext polynomial V1, that is, as... Figure 3 As shown, the plaintext polynomial (V1+V1(x)) 5 The constant term of )) / 2 and x 4The coefficient of the term is the same as the coefficient of the corresponding term in the plaintext polynomial V1, and its x 2 (Right now ) terms and x 6 (Right now The coefficient of the term becomes zero. Specifically, the ciphertext C1 and ciphertext C1(x) are... 5 Specifically, adding the first polynomial of the ciphertext C1 to C1(x) is... 5 Add the first polynomial of ) to the second polynomial of the ciphertext C1 and C1(x) 5 The two polynomials of the new ciphertext are obtained by adding the second polynomial of the ciphertext.

[0127] Similarly, processing the ciphertext C2 yields the ciphertext (C2+C2(x)). 5 )) / 2, which corresponds to the plaintext polynomial (V2+V2(x) / 2. 5 )) / 2, such as Figure 3 As shown, the plaintext polynomial (V2+V2(x) 5 The constant term of )) / 2 and x 4 The coefficient of the term is the same as the corresponding term in the plaintext polynomial V2, and its x 2 (Right now ) and x 6 (Right now The coefficient of ) becomes zero.

[0128] Then, the ciphertext (C2+C2(x) can be processed based on the second parameter value. 5 Performing homomorphic multiplication on )) / 2 yields the ciphertext x. 2 ×(C2+C2(x 5 )) / 2, this ciphertext corresponds to the plaintext polynomial x 2 ×(V2+V2(x 5 )) / 2, specifically, x 2 respectively with (C2+C2(x) 5 Multiplying the two polynomials ()) / 2 yields two new polynomials for the ciphertext. (See reference) Figure 3 plaintext polynomial x 2 ×(V2+V2(x 5 The coefficients in )) / 2 are obtained by applying the plaintext polynomial (V2+V2(x) to the polynomial (V2+V2(x)). 5 The coefficients in )) / 2 are obtained by processing them as follows: the plaintext polynomial (V2+V2(x) is obtained by processing the plaintext polynomial (V2+V2(x)) / 2. 5 In )) / 2, each of the coefficients from the first to the sixth term is shifted two spaces to the right. The seventh and eighth terms are multiplied by -1 and shifted to the first and second spaces respectively. After this homomorphic multiplication, x 2 ×(V2+V2(x 5 The coefficients to be retained in ()) / 2 and (V1+V1(x) 5The position of the term with a coefficient of 0 in )) / 2 corresponds to x 2 ×(V2+V2(x 5 The terms with a coefficient of zero in ()) / 2 and (V1+V1(x) 5 The positions of the coefficients that need to be retained in )) / 2 correspond. Therefore, refer to... Figure 3 By (C1+C1(x) 5 )) / 2 and ciphertext x 2 ×(C2+C2(x 5 Adding )) / 2 yields the ciphertext C3, whose corresponding plaintext polynomial is (V1+V1(x) / 2. 5 )) / 2+x 2 ×(V2+V2(x 5 The ciphertext C3 / 2 (i.e., plaintext polynomial V3) includes all the coefficients that need to be retained in plaintext polynomials V1 and V2, namely 2, 4, 3, and 5. According to formulas (3) and (4) above, the ciphertext C3 corresponds to the plaintext polynomial V3 / 2. In other words, the coefficients of the plaintext polynomial V3 include the row vectors and vectors of matrix W. The inner product of.

[0129] In one implementation, the ciphertext C3 can be transformed by the following homomorphic computation:

[0130] C3=(C1+C1(x 5 )+x 2 ×(C2+C2(x 5 ))) / 2=(C1+x 2 ×C2+(C1(x 5 )+x 2 ×C2(x 5 ))) / 2

[0131] =(C1+x 2 ×C2+(C1(x 5 )-x 2+8 ×C2(x 5 ))) / 2

[0132] =(C1+x 2 ×C2+(C1(x 5 )-(x 5 ) 2 ×C2(x 5 ))) / 2

[0133] =(C1+x 2 ×C2+(C1-x 2 ×C2)(x 5 )) / 2 (6)

[0134] According to formula (6), the matrix holder can first perform homomorphic multiplication on the ciphertext C2 to obtain x. 2 ×C2, then the matrix holder can compute the ciphertext C1-x 2 ×C2, then only the ciphertext C1-x needs to be processed. 2 ×C2 performs a homomorphic substitution, which transforms the ciphertext C1-x 2 Replace x in ×C2 with x 5 This will yield the ciphertext C3, thus saving computational resources.

[0135] It is understood that the embodiments in this specification are not limited to setting the first parameter value to 2. s +1, set the value of the second parameter to N / 2 s For example, in 2 s+1 If the value is less than or equal to N, the first parameter can be set to 2. s+1 +1, setting the second parameter value accordingly based on the first parameter value. For example, in a polynomial space with a degree less than 16, setting the first parameter value to 9 will perform x on one of the two ciphertexts. 9 The homomorphic substitution allows for a similar transformation of the ciphertext as described above, resulting in the coefficients of the 2nd (i.e., 16 / 8th) term, 6th (i.e., 16*3 / 8th) term, 10th (i.e., 16*5 / 8th) term, and 14th (i.e., 16*7 / 8th) term of the plaintext polynomial corresponding to the transformed ciphertext being set to 0. By setting the second parameter value accordingly based on the first parameter value, the coefficients that need to be retained in the plaintext polynomial corresponding to the other ciphertext can be packaged into at least one of the coefficients of the 2nd, 6th, 10th, and 14th terms of the plaintext polynomial corresponding to the final ciphertext.

[0136] In the case where the matrix holder only packages the two ciphertexts C1 and C2, the resulting ciphertext C3 is also the ciphertext Cq that will be sent to the vector holder.

[0137] In another scenario, the matrix holder obtains, for example, the four ciphertexts C mentioned above. 21 ~C 24 The matrix holder can execute iteratively. Figure 2 Steps S241 and S243 are used to encrypt the four ciphertexts C. 21 ~C 24 Pack them into a single ciphertext, such that the resulting ciphertext contains four ciphertext C's. 21 ~C 24 All coefficients that need to be retained in the corresponding plaintext polynomial.

[0138] Figure 4 This is a schematic diagram illustrating the process of packaging four encrypted texts in an embodiment of this specification. Figure 4 As shown, assuming that the two values ​​in the plaintext polynomial corresponding to each ciphertext are the coefficients that need to be retained in the plaintext polynomial, the matrix holder can first process the ciphertext C. 21 and C 23 implement Figure 2 In step S241, where with Figure 3 The process shown is similar, with plaintext polynomial C 21 and V 25 The number of coefficients to be retained is 4; therefore, the first parameter value is 5, and the second parameter value is 2. Then, the matrix holder executes step S243, thereby... Figure 3 The process shown is similar, yielding ciphertext C. 25 The encrypted text C 25 The corresponding plaintext polynomial V 25 It includes plaintext polynomial V 21 and V 25 The four coefficients that need to be retained.

[0139] Then, the matrix holder can access the ciphertext C. 22 and C 24 implement Figure 2 In step S241, the plaintext polynomial C 22 and V 24 The number of coefficients to be retained is 4; therefore, the first parameter value is 5, and the second parameter value is 2. Afterwards, the matrix holder executes step S243 to obtain the ciphertext C. 26 The encrypted text C 26 The corresponding plaintext polynomial V 26 It includes plaintext polynomial V 22 and V 24 The four coefficients that need to be retained.

[0140] After obtaining the ciphertext C 25 and C 26 Afterwards, the matrix holder can access the ciphertext C. 25 and C 26 implement Figure 2 In step S241, the ciphertext C 25 The corresponding plaintext polynomial C 25 and ciphertext C 26 The corresponding plaintext polynomial V 26 The number of coefficients to be retained is 4 + 4 = 8. Therefore, the value of the first parameter is 8 + 1 = 9, and the value of the second parameter is 8 / 8 = 1. In this case, s = l + h, where 2 l The number of ciphertexts initially involved in this data processing process (i.e., C) 21 ~C 24 (Total 4), 2 hThe number of coefficients (i.e., 2) that need to be retained in the plaintext polynomial corresponding to each initial ciphertext. l+h =2 l ×2 h That is, the total number of coefficients that need to be retained in all the ciphertexts initially involved in the data processing.

[0141] Then, the matrix holder executes step S243, and... Figure 3 Similarly, as shown, the matrix holder can transmit the ciphertext C 25 and C 26 Replace x with x 9 and the ciphertext C 26 +C 26 (x 9 Perform a homomorphic multiplication with x to obtain x × (C) 26 +C 26 (x 9 )), and C 25 +C 25 5(x 9 ) and x×(C 26 +C 26 (x 9 Adding the two together, we get the ciphertext C. 27 =((C 25 +C 25 (x 9 ))+x×(C 26 +C 26 (x 9 ))) / 2, the plaintext polynomial V corresponding to this ciphertext. 27 =((V) 25 +V 25 (x 9 ))+x×(V 26 +V 26 (x 9 ))) / 2 as Figure 4 As shown, it includes the plaintext polynomial V 21 ~V 24 All coefficients that need to be retained in the matrix. In this case, the ciphertext C obtained by the matrix holder... 27 This is the ciphertext Cq that will be sent to the vector holder.

[0142] In other words, the matrix holder can package multiple ciphertexts in the form of a binary tree, so that the final ciphertext includes the coefficients that need to be retained in each plaintext polynomial corresponding to all ciphertexts.

[0143] refer to Figure 4 The processing procedure shown applies to the four sequentially arranged ciphertexts C. 21 ~C 24By separately packaging the odd-numbered and even-numbered items in the four ciphertexts, the resulting ciphertext C is obtained. 27 The corresponding plaintext polynomial V 27 In the text, the coefficients of the first to fourth terms, arranged in sequence, are respectively the plaintext polynomial V. 21 ~V 24 The four constant terms, and the coefficients of these four terms in the plaintext polynomial V 27 The positional order in the text and their corresponding plaintext polynomials V 21 ~V 24 The order of arrangement (i.e., ciphertext C) 21 ~C 24 The order of the terms is consistent, and the coefficients of the 5th to 8th terms are respectively the plaintext polynomial V. 21 ~V 24 The four x 4 The coefficients of the four terms, and these four coefficients in the plaintext polynomial V 27 The positional order in the text and their corresponding plaintext polynomials V 21 ~V 24 The order of arrangement is consistent.

[0144] In step S250, the matrix holder sends the ciphertext Cq to the vector holder.

[0145] In step S260, the vector holder decrypts the ciphertext Cq to obtain the plaintext polynomial Vq, and obtains multiple vector inner products from the plaintext polynomial Vq.

[0146] Specifically, in one of the above examples, the vector holder can use the private key sk to decrypt the ciphertext C3, obtaining the plaintext polynomial V3, and thus can extract the constant term and x from V3. 2 Item, x 4 Term and x 6 The coefficients of the terms yield the row vectors and vectors of matrix W. The inner product of.

[0147] In another example above, the vector holder can use the private key sk to access the ciphertext C. 27 Decryption yields the plaintext polynomial V. 27 Thus, it is possible to obtain V 27 The coefficients of the 8 terms in the matrix W2 are used to obtain the row vectors and vectors of the matrix W2. The inner product of.

[0148] By using the scheme in this embodiment, the matrix holder can provide the vector holder with multiple target coefficients included in the multiple plaintext polynomials corresponding to the multiple ciphertexts by packaging multiple ciphertexts into one ciphertext, and only needs to send one ciphertext to the vector holder, without having to send multiple ciphertexts to the vector holder, thereby reducing the amount of communication data between the matrix holder and the vector holder.

[0149] Understandable. Figure 2 The application scenario shown is merely an example of a data processing scheme in one embodiment of this specification. The embodiments in this specification are not limited to this, but can be applied to other scenarios that require packaging multiple ciphertexts. Figure 5 A flowchart of a data processing method according to another embodiment of this specification is shown. This method can be executed by any computing device.

[0150] like Figure 5 As shown, in step S510, the ciphertext Ci corresponding to the plaintext polynomial Vi and the ciphertext Cj corresponding to the plaintext polynomial Vj are obtained.

[0151] Here, ciphertext Ci and ciphertext Cj are ciphertexts based on the same homomorphic encryption public key pk. i0 +v i1 x+…v iN x N The plaintext polynomial Vj corresponding to the ciphertext Cj has the form, for example, Vj = v j0 +v j1 x+…v jN x N In one scenario, ciphertext Ci and ciphertext Cj can be ciphertexts obtained by directly encrypting the corresponding plaintext polynomial using the public key pk. In another scenario, ciphertext Ci and ciphertext Cj can be ciphertexts obtained by performing homomorphic computation on homomorphically encrypted ciphertext, such as the ciphertext Cj mentioned above. 25 and C 26 .

[0152] In step S520, the first parameter value and the second parameter value are determined based on the number of target coefficients in the plaintext polynomial Vi and the plaintext polynomial Vj.

[0153] The first parameter is the number of times x is raised to the power of x to perform homomorphic substitution on x in the ciphertext, and the second parameter is the number of times x is raised to the power of x to perform homomorphic multiplication on the ciphertext.

[0154] In one implementation, the number of coefficients to be retained in the plaintext polynomials Vi and Vj is 2. s ,2 s It should be less than or equal to N, so the value of the first parameter can be determined to be 2. s +1, the second parameter value is N / 2 s It is understood that the embodiments in this specification are not limited to setting the first parameter value to 2. s +1, set the value of the second parameter to N / 2 s For example, in 2 s+1If the value is less than or equal to N, the first parameter can be set to 2. s+1 +1, set the second parameter value accordingly based on the first parameter value.

[0155] For example, there are a total of 4 target coefficients to be retained in plaintext polynomials Vi and Vj, which determines that the first parameter value is 5 and the second parameter value is N / 4.

[0156] In one implementation, s = l + h, where 2 l The number of ciphertexts initially involved in this data processing process, 2 h The number of coefficients to be retained in the plaintext polynomial corresponding to each initial ciphertext, 2 l+h =2 l ×2 h That is, the total number of coefficients that need to be retained in all the ciphertexts initially involved in the data processing.

[0157] In step S230, homomorphic computation is performed based on the first parameter value, the second parameter value, the ciphertext Ci, and the ciphertext Cj to obtain the ciphertext Ck.

[0158] Assuming the first parameter is 5 and the second parameter is N / 4, the computing device can first perform homomorphic substitution on both ciphertext Ci and ciphertext Cj based on the first parameter value, that is, replace x in ciphertext Ci with x. 5 Replace x in the ciphertext Cj with x 5 Specifically, it involves replacing x in both polynomials included in the ciphertext Ci with x. 5 Replace x in the two polynomials included in the ciphertext Cj with x 5 .

[0159] Specifically, based on the principle of homomorphic substitution, x in the ciphertext Ci is replaced with x. 5 This is equivalent to replacing x in the plaintext polynomial Vi with x 5 Even if the plaintext polynomial Vi is transformed into the following form:

[0160] Vi(x 5 )=v0+v1x 5 +…v N x 5N

[0161] Referring to the derivation above, after homomorphic substitution, the plaintext polynomial Vi(x) 5 In ) The coefficients of the terms and the plaintext polynomial Vi The coefficients of the terms are the same, and the plaintext polynomial Vi(x) 5 In ) Item and The coefficients of the terms are the negatives of the coefficients of the corresponding terms in the plaintext polynomial Vi.

[0162] In this way, by combining the ciphertext Ci with the ciphertext Ci(x) 5 Adding these together, the resulting ciphertext corresponds to the plaintext polynomial Vi + Vi(x). 5 The constant term and x 4 The coefficient of the term is twice the coefficient of the corresponding term in the plaintext polynomial Vi. and The coefficient of the term becomes zero. Specifically, the ciphertext Ci is compared with the ciphertext Ci(x). 5 Specifically, adding the first polynomial of the ciphertext Ci to Ci(x) is... 5 Add the first polynomial of ) to the second polynomial of Ci and Ci(x) 5 The two polynomials of the new ciphertext are obtained by adding the second polynomial of the ciphertext.

[0163] Similarly, processing the ciphertext Cj yields the ciphertext Cj+Cj(x). 5 ), whose corresponding plaintext polynomial is Vj+Vj(x 5 The constant term and The coefficient of the term is twice the coefficient of the corresponding term in the plaintext polynomial Vj. and The coefficient of the term becomes zero.

[0164] Then, the ciphertext (Cj+Cj(x)) can be processed based on the second parameter value. 5 Performing homomorphic multiplication on )) / 2 yields the ciphertext. This ciphertext corresponds to the plaintext polynomial. Specifically, it is to respectively with (Cj+Cj(x) 5 Multiplying two polynomials by )) / 2 yields two polynomials for the new ciphertext. After this homomorphic multiplication process, The coefficients that need to be retained in Vj+Vj(x) 5 The positions of terms with a coefficient of 0 in the () correspond to the positions of the terms. The terms with a coefficient of zero in Vi + Vi(x) 5 The positions of the coefficients that need to be retained in (Ci+Ci(x)) correspond. Therefore, by... 5 )) / 2 and ciphertext Adding them together yields the ciphertext Ck, whose corresponding plaintext polynomial. It includes all the coefficients that need to be retained in the plaintext polynomials Vi and Vj.

[0165] In one implementation, the transformation can be performed using the following homomorphic computation:

[0166]

[0167] According to the above formula, the computing device can first perform homomorphic multiplication on the ciphertext Cj to obtain... Then, the computing device can compute the ciphertext. Then all that's needed is the ciphertext. Perform a homomorphic substitution, that is, ciphertext Replace x with x 5 This allows us to obtain the ciphertext Ck, thus saving computational resources.

[0168] Referring to the description above, when a computing device packages M ciphertexts, it can do so based on a binary tree structure. When M is a power of 2, the ciphertexts are first paired to obtain multiple ciphertext pairs. Each ciphertext pair is then packaged to obtain M / 2 ciphertexts. This process is repeated until a single ciphertext Cq is obtained, ensuring that the plaintext polynomial corresponding to Cq includes all the coefficients that need to be retained from the M plaintext polynomials corresponding to the M ciphertexts. It is understandable that even when M is not a power of 2, multiple ciphertexts can still be packaged based on a binary tree structure. For example, when M=3, assuming the ciphertexts Ci, Cj, and Ck are packaged, the computing device can first package the ciphertexts Ci and Cj to obtain the ciphertext Ct, and then package the ciphertexts Ct and Ck to obtain the final ciphertext Cq, so that the plaintext polynomial corresponding to the ciphertext Cq includes all the coefficients that need to be retained in the three plaintext polynomials corresponding to the ciphertexts Ci, Cj, and Ck.

[0169] After processing multiple ciphertexts to obtain ciphertext Cq, the computing device can send ciphertext Cq to another device to provide the other device with multiple target coefficients in the plaintext polynomial corresponding to ciphertext Cq.

[0170] The scheme of this embodiment can perform homomorphic computation on multiple ciphertexts based on the number of coefficients that need to be retained in each ciphertext. This allows the two ciphertexts to be packaged into a single packaged ciphertext during a single packaging process. The plaintext polynomial corresponding to the packaged ciphertext includes all the target coefficients that need to be retained for the two ciphertexts. This saves computational complexity, saves storage resources needed to store the ciphertexts, and reduces the amount of communication data required to provide the target coefficients to other devices.

[0171] Figure 6 This is an architecture diagram of a computing device according to an embodiment of this specification, including:

[0172] The acquisition unit 61 is used to acquire the first ciphertext and the second ciphertext, wherein the first ciphertext and the second ciphertext are respectively homomorphic ciphertexts of the first plaintext polynomial and the second plaintext polynomial, and the first plaintext polynomial and the second plaintext polynomial are polynomials in the same polynomial space.

[0173] The determining unit 62 is used to determine a first parameter value and a second parameter value based on the first number of first coefficients that need to be retained in the first plaintext polynomial and the second plaintext polynomial. The first parameter value is used in the homomorphic calculation of homomorphic substitution of homomorphic ciphertext, and the second parameter value is used in the homomorphic calculation of homomorphic multiplication of homomorphic ciphertext.

[0174] The calculation unit 63 is used to perform homomorphic calculations based on the first parameter value, the second parameter value, the first ciphertext, and the second ciphertext to obtain a third ciphertext, wherein the third plaintext polynomial corresponding to the third ciphertext includes the first number of first coefficients.

[0175] This specification also provides a computer-readable storage medium storing a computer program thereon, which, when executed in a computer, causes the computer to perform actions such as... Figure 2 or Figure 5 The method shown.

[0176] This specification also provides a computing device in its embodiments, including a memory and a processor. The memory stores executable code, and when the processor executes the executable code, it implements, as described above. Figure 2 or Figure 5 The method shown.

[0177] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0178] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0179] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or physical entities, or by products with certain functions. A typical implementation device is a server system. Of course, this application does not exclude the possibility that, with the future development of computer technology, the computer implementing the functions of the above embodiments can be, for example, a personal computer, a laptop computer, an in-vehicle human-machine interaction device, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or any combination of these devices.

[0180] While one or more embodiments of this specification provide the operational steps of the methods described in the embodiments or flowcharts, more or fewer operational steps may be included based on conventional or non-inventive means. The order of steps listed in the embodiments is merely one possible order of execution among many steps and does not represent the only possible order. In actual device or end product execution, the methods shown in the embodiments or drawings may be executed sequentially or in parallel (e.g., in a parallel processor or multi-threaded processing environment, or even a distributed data processing environment). The terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, product, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, product, or apparatus. Without further limitations, the presence of other identical or equivalent elements in the process, method, product, or apparatus that includes the elements is not excluded. For example, the use of terms such as "first," "second," etc., is to denote names and does not indicate any particular order.

[0181] For ease of description, the above devices are described in terms of function, divided into various modules. Of course, when implementing one or more of these specifications, the functions of each module can be implemented in one or more software and / or hardware components, or a module that performs the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between devices or units, and may be electrical, mechanical, or other forms.

[0182] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0183] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0184] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0185] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0186] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0187] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage, graphene storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0188] Those skilled in the art will understand that one or more embodiments of this specification can be provided as a method, system, or computer program product. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0189] One or more embodiments of this specification can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a particular task or implement a particular abstract data type. One or more embodiments of this specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0190] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, system embodiments are basically similar to method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments. In the description of this specification, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this specification. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described can be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0191] The above description is merely an embodiment of one or more embodiments of this specification and is not intended to limit the scope of these embodiments. Various modifications and variations can be made to these embodiments by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims.

Claims

1. A privacy-protecting data processing method, said method being performed by a first party's device and a second party's device, wherein, The second party possesses a public key for homomorphic encryption and a private key corresponding to the public key. The method includes: The first party's device performs the following operations: Obtain the first ciphertext and the second ciphertext, which are respectively homomorphic ciphertexts of the first plaintext polynomial and the second plaintext polynomial. The first ciphertext and the second ciphertext correspond to the public key, and the first plaintext polynomial and the second plaintext polynomial are polynomials in the same polynomial space. Based on the first number of first coefficients (target coefficients) in the first and second plaintext polynomials, a first parameter value and a second parameter value are determined. The first parameter value is used in homomorphic computation for homomorphic substitution of the homomorphic ciphertext, and the second parameter value is used in homomorphic computation for homomorphic multiplication of the homomorphic ciphertext. Homomorphic computation is performed based on the first parameter value, the second parameter value, the first ciphertext, and the second ciphertext to obtain a third ciphertext. The third plaintext polynomial corresponding to the third ciphertext includes the first number of first coefficients. The target coefficients are the coefficients to be provided to the second party. The first parameter value is equal to the first number plus 1, and the second parameter value is equal to N / the first number. The degree of the polynomials included in the polynomial space is less than N, where N is a power of 2. Send the third ciphertext to the second party's device; The second party's device decrypts the third ciphertext based on the private key to obtain the third plaintext polynomial, and obtains the first coefficient of the first number from the third plaintext polynomial; The homomorphic computation based on the first parameter value, the second parameter value, the first ciphertext, and the second ciphertext includes: performing a homomorphic multiplication on the second ciphertext based on the second parameter value to obtain a seventh ciphertext; performing a homomorphic substitution on the difference between the first ciphertext and the seventh ciphertext based on the first parameter value to obtain an eighth ciphertext; and adding the first ciphertext to the seventh ciphertext and the eighth ciphertext to obtain the third ciphertext.

2. The method according to claim 1, wherein the first coefficient serving as the target coefficient in the first plaintext polynomial and the second plaintext polynomial at least includes a constant term coefficient and x. N / 2 The coefficient of the term.

3. The method according to claim 1, further comprising: The second-party device uses the public key to homomorphically encrypt the ninth plaintext polynomial to obtain the ninth ciphertext, where the coefficients of the ninth plaintext polynomial correspond to the first vector. The ninth ciphertext is then sent to the first-party device. The first party's device multiplies the tenth plaintext polynomial and the eleventh plaintext polynomial with the ninth ciphertext, respectively, to obtain the first ciphertext and the second ciphertext, wherein the coefficients of the tenth plaintext polynomial correspond to the second and third vectors, and the coefficients of the eleventh plaintext polynomial correspond to the fourth and fifth vectors. The first coefficient of the first number includes the inner product of the second vector and the first vector, the inner product of the third vector and the first vector, the inner product of the fourth vector and the first vector, and the inner product of the fifth vector and the first vector.

4. The method according to claim 1, further comprising: Obtain the twelfth and thirteenth ciphertexts, which are homomorphic ciphertexts of the twelfth and thirteenth plaintext polynomials, respectively. The twelfth and thirteenth ciphertexts correspond to the public key, and the twelfth and thirteenth plaintext polynomials are polynomials in the polynomial space. Based on the second number of the second coefficients that serve as target coefficients in the twelfth plaintext polynomial and the thirteenth plaintext polynomial, the third parameter value and the fourth parameter value are determined. The third parameter value is used in the homomorphic calculation of homomorphic substitution of the homomorphic ciphertext, and the fourth parameter value is used in the homomorphic calculation of homomorphic multiplication of the homomorphic ciphertext. The third parameter value is equal to the second number plus 1, and the fourth parameter value is equal to N divided by the second number; Homomorphic computation is performed based on the third parameter value, the fourth parameter value, the twelfth ciphertext, and the thirteenth ciphertext to obtain the first ciphertext.

5. The method according to claim 1, wherein the first number is a power of 2, and the first number is less than or equal to N.

6. A privacy-protecting data processing method, comprising: Obtain the first ciphertext and the second ciphertext, where the first ciphertext and the second ciphertext are homomorphic ciphertexts of the first plaintext polynomial and the second plaintext polynomial, respectively, and the first plaintext polynomial and the second plaintext polynomial are polynomials in the same polynomial space. Based on the first number of the first coefficients that serve as target coefficients in the first plaintext polynomial and the second plaintext polynomial, a first parameter value and a second parameter value are determined. The first parameter value is used in the homomorphic calculation of homomorphic substitution of the homomorphic ciphertext, and the second parameter value is used in the homomorphic calculation of homomorphic multiplication of the homomorphic ciphertext. The target coefficients are the coefficients that need to be retained; the first parameter value is equal to the first number plus 1, and the second parameter value is equal to N / the first number; the degree of the polynomials included in the polynomial space is less than N, and N is a power of 2; Homomorphic computation is performed based on the first parameter value, the second parameter value, the first ciphertext, and the second ciphertext to obtain the third ciphertext. The third plaintext polynomial corresponding to the third ciphertext includes the first number of first coefficients. The homomorphic computation based on the first parameter value, the second parameter value, the first ciphertext, and the second ciphertext includes: performing a homomorphic multiplication on the second ciphertext based on the second parameter value to obtain a seventh ciphertext; performing a homomorphic substitution on the difference between the first ciphertext and the seventh ciphertext based on the first parameter value to obtain an eighth ciphertext; and adding the first ciphertext to the seventh ciphertext and the eighth ciphertext to obtain the third ciphertext.

7. The method of claim 6, wherein the method is performed by a first party's device, and the method further comprises: The third ciphertext is sent to the device of the second party, wherein the second party possesses the private key corresponding to the third ciphertext.

8. The method according to claim 6, wherein obtaining the first ciphertext and the second ciphertext includes obtaining a first set of ciphertext pairs and a second set of ciphertext pairs, each set of ciphertext pairs including the first ciphertext and the second ciphertext; obtaining the third ciphertext includes obtaining the third ciphertext corresponding to the first set of ciphertext pairs and the third ciphertext corresponding to the second set of ciphertext pairs; the method further includes: Using the two third ciphertexts as the first and second ciphertexts in the third ciphertext pair, the homomorphic computation is performed to obtain the third ciphertext corresponding to the third ciphertext pair. The plaintext polynomial corresponding to the third ciphertext pair includes the target coefficients in the plaintext polynomials corresponding to the first and second ciphertext pairs.

9. The method according to claim 8, further comprising: Obtain the four ciphertexts arranged in order. Combine the two ciphertexts in the first and third positions to form the first ciphertext pair, and combine the two ciphertexts in the second and fourth positions to form the second ciphertext pair.

10. A computing device, comprising: The acquisition unit is used to acquire a first ciphertext and a second ciphertext, wherein the first ciphertext and the second ciphertext are respectively homomorphic ciphertexts of a first plaintext polynomial and a second plaintext polynomial, and the first plaintext polynomial and the second plaintext polynomial are polynomials in the same polynomial space. The determining unit is used to determine a first parameter value and a second parameter value based on the first number of first coefficients that are target coefficients in the first plaintext polynomial and the second plaintext polynomial. The first parameter value is used in the homomorphic calculation of homomorphic substitution of homomorphic ciphertext, and the second parameter value is used in the homomorphic calculation of homomorphic multiplication of homomorphic ciphertext. The target coefficients are the coefficients that need to be retained; the first parameter value is equal to the first number plus 1, and the second parameter value is equal to N / the first number; The polynomial space contains polynomials of degree less than N, where N is a power of 2. The calculation unit is used to perform homomorphic computation based on the first parameter value, the second parameter value, the first ciphertext and the second ciphertext to obtain a third ciphertext, wherein the third plaintext polynomial corresponding to the third ciphertext includes the first number of first coefficients. The computing unit is specifically used to perform homomorphic multiplication on the second ciphertext based on the second parameter value to obtain the seventh ciphertext, to perform homomorphic substitution on the difference between the first ciphertext and the seventh ciphertext based on the first parameter value to obtain the eighth ciphertext, and to obtain the third ciphertext by adding the first ciphertext, the seventh ciphertext, and the eighth ciphertext.

11. A privacy-protecting data processing system, the system comprising a first-party device and a second-party device, wherein, The second party possesses a public key for homomorphic encryption and a corresponding private key. The first party's device is used to perform the following operations: Obtain the first ciphertext and the second ciphertext, which are respectively homomorphic ciphertexts of the first plaintext polynomial and the second plaintext polynomial. The first ciphertext and the second ciphertext correspond to the public key, and the first plaintext polynomial and the second plaintext polynomial are polynomials in the same polynomial space. Based on the first number of the first coefficients that serve as target coefficients in the first plaintext polynomial and the second plaintext polynomial, a first parameter value and a second parameter value are determined. The first parameter value is used in the homomorphic calculation of homomorphic substitution of the homomorphic ciphertext, and the second parameter value is used in the homomorphic calculation of homomorphic multiplication of the homomorphic ciphertext. The target coefficient is the coefficient that needs to be provided to the second party. The first parameter value is equal to the first number plus 1, and the second parameter value is equal to N / the first number. The polynomial space contains polynomials of degree less than N, where N is a power of 2. Homomorphic computation is performed based on the first parameter value, the second parameter value, the first ciphertext, and the second ciphertext to obtain the third ciphertext. The third plaintext polynomial corresponding to the third ciphertext includes the first number of first coefficients. Send the third ciphertext to the second party's device; The second party's device is used to decrypt the third ciphertext based on the private key to obtain the third plaintext polynomial, and to obtain the first coefficient of the first number from the third plaintext polynomial; The homomorphic computation based on the first parameter value, the second parameter value, the first ciphertext, and the second ciphertext includes: performing a homomorphic multiplication on the second ciphertext based on the second parameter value to obtain a seventh ciphertext; performing a homomorphic substitution on the difference between the first ciphertext and the seventh ciphertext based on the first parameter value to obtain an eighth ciphertext; and adding the first ciphertext to the seventh ciphertext and the eighth ciphertext to obtain the third ciphertext.

12. A computing device comprising a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method of any one of claims 6-9.

Images