A permutation encryption and decryption method and device suitable for homomorphic operations

Abstract

The embodiments of this specification provide a permutation encryption and decryption method and device suitable for homomorphic operations. When encrypting plaintext data m, a first operation is performed on the plaintext data m based on a key to obtain a first intermediate value x, and the first intermediate value x has a data structure that satisfies additive homomorphism. Then, the first intermediate value x is divided into η segments to obtain an array x′ containing η elements, and the elements in the array x′ are permuted according to the permutation rule π to obtain the ciphertext c of the plaintext data m. When decrypting the ciphertext c, the elements in the ciphertext c are reversely permuted according to the permutation rule π to obtain the array x′. Then, the η elements are spliced ​​according to the order of the elements in the array x′ to form a first intermediate value x, and an inverse operation related to the first operation is performed on the first intermediate value x based on the key, and the plaintext data m of the ciphertext c is determined from the obtained operation result. The homomorphic algorithm is implemented based on symmetric encryption and can be used in the field of data circulation.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to the field of data security technology, and in particular, to a permutation encryption and decryption method and device suitable for homomorphic operations. Background Art

[0002] Data circulation often requires the protection of data security and privacy, and its implementation relies on algorithms in different fields such as federated learning, multi-party secure computing, and homomorphic encryption. Some algorithms in these fields rely on additive homomorphic algorithms in homomorphic encryption algorithms. Additive homomorphic algorithms refer to adding multiple ciphertexts without decryption, which is equivalent to adding the corresponding plaintexts and then encrypting them. Existing additive homomorphic algorithms have the problems of large computational complexity and low computational efficiency.

[0003] Therefore, it is hoped that there will be an improved solution that can improve the efficiency and security of homomorphic addition operations. Summary of the invention

[0004] One or more embodiments of this specification describe a permutation encryption and decryption method and device applicable to homomorphic operations to improve the efficiency and security of additive homomorphic operations. The specific technical solution is as follows.

[0005] In a first aspect, the embodiment provides a permutation encryption method applicable to homomorphic operations, including:

[0006] Obtain the plaintext data m to be encrypted, the key, and the substitution rule π;

[0007] Performing a first operation on the plaintext data m based on the key to obtain a first intermediate value x, where the first intermediate value x has a data structure that satisfies additive homomorphism;

[0008] Divide the first intermediate value x into n segments to obtain an array x′ containing n elements;

[0009] The elements in the array x′ are permuted according to the permutation rule π to obtain the ciphertext c of the plaintext data m.

[0010] In one implementation, the first operation includes: using a first random number e to hide the plaintext data m to obtain a second intermediate value g; and using the key to perform a second operation on the second intermediate value g to obtain a first intermediate value x.

[0011] In one implementation, the step of hiding the plaintext data m using the first random number e includes: inserting the plaintext data m into a preset position in the first random number e.

[0012] In one embodiment, the key includes a first key a and a second key p; the step of using the key to perform a second operation on the second intermediate value g includes: calculating the product of the first key a and the second intermediate value g, taking the modulus of the product using the second key p to obtain a third intermediate value, and determining the first intermediate value x based on the third intermediate value.

[0013] In one implementation, the key includes a first key a, a second key p, and a third key q; the step of using the key to perform a second operation on the second intermediate value g includes:

[0014] Generate a second random number w, and use the Chinese remainder theorem to obtain the first intermediate value x based on the following conditions: calculate the product of the first key a and the second intermediate value g, so that the result of taking the product modulo the second key p is equal to the result of taking the first intermediate value x modulo the second key p, and so that the result of taking the second random number w modulo the third key q is equal to the result of taking the first intermediate value x modulo the third key q.

[0015] In one embodiment, the first random number e includes a first number e1 and a second number e2; the key includes a first key a, a second key p and a third key q; the step of using the first random number e to hide the plaintext data m to obtain the second intermediate value g includes: splitting the plaintext data m into the first plaintext data m 11 and the second plaintext data m 22 ; Use the first number e1 to the first plaintext data m 11 To hide, use the second number e2 to hide the second plaintext data m 22 Hide and obtain two second intermediate values ​​g;

[0016] The step of performing a second operation on the second intermediate value g using the key includes: using the Chinese remainder theorem to solve the first intermediate value x based on the following conditions: calculating the product of the first key a and two second intermediate values ​​g respectively, so that a result after taking the modulus of one product using the second key p is equal to a result after taking the modulus of the first intermediate value x using the second key p, and so that a result after taking the modulus of another product using the third key q is equal to a result after taking the modulus of the first intermediate value x using the third key q.

[0017] In one embodiment, the permutation rule π is a joint permutation rule; the step of permuting the elements in the array x′ according to the permutation rule π includes: according to the permutation rule π, jointly permuting the elements in the array corresponding to other related plaintext data and the elements in the array x′.

[0018] In a second aspect, the embodiment provides a permutation decryption method applicable to homomorphic operations, including:

[0019] Obtain the ciphertext c to be decrypted and the corresponding key and substitution rule π; the ciphertext c is an array containing n elements;

[0020] According to the permutation rule π, reverse permutation is performed on the elements in the ciphertext c to obtain an array x′;

[0021] splicing n elements according to the order of elements in the array x′ to form a first intermediate value x, wherein the first intermediate value x has a data structure satisfying additive homomorphism;

[0022] An inverse operation related to the first operation is performed on the first intermediate value x based on the key, and the plaintext data m of the ciphertext c is determined from the obtained operation result.

[0023] In one embodiment, the permutation rule π is a joint permutation rule. The step of reversely permuting the elements in the ciphertext c according to the permutation rule π includes: reversely permuting the elements in other related ciphertexts and the elements in the ciphertext c according to the permutation rule π to obtain an array x′.

[0024] In one implementation, the step of performing an inverse operation related to the first operation on the first intermediate value x based on the key and determining the plaintext data m of the ciphertext c from the obtained operation result includes:

[0025] Using the key to perform an inverse operation of a second operation on the first intermediate value x, to obtain a second intermediate value g;

[0026] The plaintext data m is determined from the second intermediate value g.

[0027] In one implementation, the step of determining the plaintext data m from the second intermediate value g includes: reading preset position data of the second intermediate value g, and using the read data as the plaintext data m.

[0028] In one embodiment, the key includes a first key a and a second key p; the step of using the key to perform an inverse operation of a second operation on the first intermediate value x includes: calculating the product of the inverse of the first key a and the first intermediate value x, and taking the modulus of the product using the second key p to obtain a second intermediate value g.

[0029] In one embodiment, the key includes a first key a, a second key p and a third key q. The step of performing an inverse operation of a second operation on the first intermediate value x using the key includes: calculating the product of the first intermediate value x and the inverse of the first key a, taking a modulus of the product using the second key p, and obtaining the second intermediate value g.

[0030] In one implementation, the key includes a first key a, a second key p, and a third key q; the step of using the key to perform an inverse operation of a second operation on the first intermediate value x includes:

[0031] Calculate the product of the first intermediate value x and the inverse of the first key a, take the modulus of the product using the second key p to obtain a second intermediate value g; take the modulus of the product using the third key q to obtain another second intermediate value g;

[0032] The step of determining the plaintext data m from the second intermediate value g comprises:

[0033] Add the two second intermediate values ​​g to obtain a sum;

[0034] The preset position data of the sum value is read, and the read data is used as the plaintext data m.

[0035] In a third aspect, the embodiment provides a permutation encryption device suitable for homomorphic operations, including:

[0036] A plaintext acquisition module, configured to obtain plaintext data m to be encrypted, a key, and a substitution rule π;

[0037] an encryption operation module, configured to perform a first operation on the plaintext data m based on the key and the first random number e to obtain a first intermediate value x, wherein the first intermediate value x has a data structure satisfying additive homomorphism;

[0038] an array forming module, configured to divide the first intermediate value x into n segments to obtain an array x′ containing n elements;

[0039] The element replacement module is configured to replace the elements in the array x′ according to the replacement rule π to obtain the ciphertext c of the plaintext data m.

[0040] In a fourth aspect, the embodiment provides a permutation decryption device suitable for homomorphic operation, including:

[0041] A ciphertext acquisition module, configured to acquire a ciphertext c to be decrypted and a corresponding key and a substitution rule π; the ciphertext c is an array containing n elements;

[0042] A reverse permutation module, configured to perform reverse permutation on the elements in the ciphertext c according to the permutation rule π to obtain an array x′;

[0043] an element concatenation module, configured to concatenate n elements according to the order of elements in the array x′ to form a first intermediate value x, wherein the first intermediate value x has a data structure satisfying additive homomorphism;

[0044] The decryption operation module is configured to perform an inverse operation related to the first operation on the first intermediate value x based on the key, and determine the plaintext data m of the ciphertext c from the obtained operation result.

[0045] In a fifth aspect, an embodiment provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute any one of the methods in the first to second aspects.

[0046] In a sixth aspect, an embodiment provides a computing device, comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method described in any one of the first aspect to the second aspect is implemented.

[0047] In the method and device provided in the embodiments of this specification, after the plaintext data is initially encrypted using a key, the obtained first intermediate value x is converted into an array, and then the elements in the array are permuted to obtain the ciphertext c. After the elements in the array are permuted, the attacker cannot put the individual element segments together to restore the original array, nor can he infer the private data information from the individual element segments. Since the first intermediate value x satisfies homomorphism, the array after splitting and permuting it also has homomorphism, which enables the obtained ciphertext to be used for homomorphic operations. The above encryption method reduces the consumption of ciphertext addition from modular multiplication to modular addition, greatly reduces the amount of calculated data, and has high security. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0049] Figure 1 A schematic diagram of an implementation scenario of an embodiment disclosed in this specification;

[0050] Figure 2 A schematic diagram of a flow chart of a permutation encryption method applicable to homomorphic operations provided in an embodiment;

[0051] Figure 3 A flowchart of a permutation decryption method applicable to homomorphic operations provided in an embodiment;

[0052] Figure 4 A schematic block diagram of a permutation encryption device suitable for homomorphic operation provided in an embodiment;

[0053] Figure 5 A schematic block diagram of a permutation decryption device suitable for homomorphic operations provided in an embodiment. DETAILED DESCRIPTION

[0054] The solution provided in this specification is described below in conjunction with the accompanying drawings.

[0055] Homomorphic encryption (HE) is a special encryption algorithm that allows users to perform certain types of calculations on encrypted data without decrypting it. This encryption method maintains the encrypted state of the data while allowing operations such as addition and multiplication to be performed, and the results are consistent with the results of the same operation on the original data after decryption. Homomorphic encryption algorithms include additive homomorphic algorithms and multiplicative homomorphic algorithms.

[0056] In the additive homomorphic algorithm, the addition operation of encrypted data can be mapped to the addition operation of original data, that is, Enc(a)+Enc(b) can be decrypted to a+b. Enc represents the corresponding encryption algorithm, Enc(a) and Enc(b) are the encrypted data, and a and b are the plaintext data. The data encrypted by the additive homomorphic algorithm, such as Enc(a) and Enc(b) here, has additive homomorphism.

[0057] In the multiplication homomorphic algorithm, the multiplication operation of encrypted data can be mapped to the multiplication operation of the original data, that is, Enc(a)×Enc(b) can be decrypted to a×b. The data encrypted using the multiplication homomorphic algorithm, such as Enc(a) and Enc(b) here, has multiplication homomorphism.

[0058] The encryption method provided in this specification is an additive homomorphic algorithm in the homomorphic encryption algorithm. The additive homomorphic algorithm generally includes the following parts: key, encryption, ciphertext addition and decryption. Among them, encryption refers to the generation of ciphertext based on the key and plaintext. Ciphertext addition refers to the addition of two ciphertexts to generate a new ciphertext. Decryption refers to obtaining the plaintext based on the ciphertext and the key.

[0059] The encryption process can be divided into symmetric encryption and asymmetric encryption. In symmetric encryption, the same key is used for encryption and decryption. Asymmetric encryption, also known as public key encryption, uses a pair of keys: a public key and a private key. The public key can be shared publicly, while the private key must be kept secret. Asymmetric encryption uses different keys for encryption and decryption.

[0060] In actual business applications, data circulation often relies on algorithms in different fields such as federated learning, multi-party secure computing, and homomorphic encryption. Some algorithms in these fields rely on additive homomorphic algorithms. For example, some federated learning relies on additive homomorphism to complete gradient aggregation, such as the security enhancement model (SecureBoost); some multi-party secure computing relies on additive homomorphism to complete the underlying secret multiplication; if homomorphic encryption only needs to support addition, using "additive homomorphism" has significant performance advantages over using "full homomorphism".

[0061] Unlike in the past, some data circulation scenarios only require additive homomorphic algorithms under symmetric key systems, but existing additive homomorphic algorithms are all designed based on asymmetric encryption systems. Since additive homomorphic algorithms under asymmetric encryption systems contain modular idempotent operations, their performance is relatively slow. In order to reduce the amount of calculation and improve processing efficiency, the embodiments of this specification provide additive homomorphic algorithms with higher performance under symmetric key systems.

[0062] The additive homomorphic encryption algorithm provided in the embodiments of this specification is based on a symmetric key system. Figure 1 This is a schematic diagram of an implementation scenario of an embodiment disclosed in this specification, which includes device 1 and device 2. Device 1 has private data or N plaintext data m1…m2 that need to be encrypted. N , device 1 performs homomorphic encryption on these plaintexts and obtains N ciphertexts c1…c N , and sends these N ciphertexts to device 2. Device 2 selects some ciphertexts from the N ciphertexts, for example, selects c i and c j Device 2 sends the ciphertext and value c to device 1. Device 1 performs homomorphic decryption on the ciphertext c and obtains the plaintext and value m. i +m j In this scenario, encryption and decryption are performed by the same party. Figure 1 Device 1 and device 2 are just examples. In actual applications, the number of devices using homomorphic encryption can exceed 2. In this scenario, device 1 has private data and data such as keys for homomorphic encryption. When decrypting, device 1 can decrypt ciphertext and value based on the keys it has.

[0063] For example, device 1 has N sample data (i.e., N plaintext data). After homomorphically encrypting the N sample data, device 1 sends the ciphertext to device 2. Device 2 receives N ciphertexts, but it does not know the specific data in the N ciphertexts, nor can it infer the data features and other information in the N ciphertexts. Device 2 selects some ciphertexts from the N ciphertexts and takes the sum, and sends the sum value to device 1. Device 1 decrypts the sum value using the key it has and the permutation rule to obtain the sum value of some ciphertext data.

[0064] In order to improve the simplicity of encryption and decryption operations, the embodiments of this specification provide a permutation encryption method and a permutation decryption method suitable for homomorphic operations. Figure 2 The process of the encryption method is described in detail.

[0065] Figure 2 A flowchart of a permutation encryption method suitable for homomorphic computing provided in an embodiment. The method is executed by a computing device, and the computing device can be implemented by any device, equipment, platform, device cluster, etc. with computing and processing capabilities. The method includes the following steps.

[0066] Step S210, obtaining the plaintext data m to be encrypted, the key, and the substitution rule π.

[0067] Step S220: performing a first operation on the plaintext data m based on the key to obtain a first intermediate value x, where the first intermediate value x has a data structure that satisfies additive homomorphism.

[0068] Step S230, dividing the first intermediate value x into n segments to obtain an array x′ containing n elements.

[0069] Step S240, permuting the elements in the array x' according to the permutation rule π to obtain the ciphertext c of the plaintext data m.

[0070] The above steps are described in detail below.

[0071] In step S210, the key and the replacement rule are both keys in a broad sense, that is, data that needs to be kept confidential. In order to more clearly illustrate this embodiment, the variables used are first appropriately illustrated by way of example, and the data involved in this embodiment are all illustrated in binary form.

[0072] Random number: β bits, for example β=128.

[0073] Plaintext data m: Assume that the length is ρ, and β is a public parameter. Generally, β is at most α-β bits, which is the length set to support the accumulation operation of a large amount of plaintext.

[0074] Keys in a broad sense: the first key a, the second key p, and the third key q, all of which are α bits, and the permutation rule π for n elements. For example, α can be 256, and n can be 128. The high 32 bits of the second key p are 1. Generally speaking, n must be divisible by α, so γ=α / η, γ=2. The second key p and the third key q can be set to be coprime numbers.

[0075] The key and the replacement rule π can be preset. The first random number e, the plaintext data m, and the bit value of the key can also be other values, and the above content is only an example. The number of bits of the random number and the plaintext data m can be the same or different. The number of bits of the first key a, the second key p, and the third key q can be the same or different, and generally take a large positive integer when taking values.

[0076] In a data flow scenario, a computing device (e.g., Figure 1 Device 1) in the embodiment has plaintext data m, a key and a substitution rule π. In this embodiment, a plaintext data m is used as an example for explanation. The substitution rule is a rule for replacing the positions of some or all of the n elements, for example, the 5th element is replaced to the position of the 9th element, the 9th element is replaced to the position of the 3rd element, and so on.

[0077] In step S220, the first operation performed on the plaintext data m based on the key is a preliminary encryption process of the plaintext data m. The encrypted first intermediate value x cannot be directly used as a ciphertext for additive homomorphic operations, and subsequent steps are required to perform further encryption operations on the first intermediate value x.

[0078] The first operation is an algorithm that satisfies the additive homomorphic property. The first intermediate value x obtained by the first operation has a data structure that satisfies additive homomorphism, that is, the first intermediate value x has an algebraic structure that is additively homomorphic and has homomorphism. Homomorphism is an important concept in mathematics and cryptography, which describes the ability of a structure to maintain its operational properties under a mapping (such as an encryption function). For example, for any two plaintext data m1 and m2, f(m1+ m2)=f(m1)+f(m2). f(m1) is the first intermediate value obtained by the plaintext data m1 after the first operation f, and f(m2) is the first intermediate value obtained by the plaintext data m2 after the first operation f. When f(m1+ m2)=f(m1)+f(m2) holds, it is considered that f(m1) or f(m2) has a data result that satisfies additive homomorphism and has homomorphism.

[0079] That is, the first operation is an additive homomorphic algorithm: a sum operation is performed on the ciphertext data, and the sum is equal to the sum of the corresponding plaintext data before encryption. The first operation can be, for example, a linear transformation, that is, multiplying the first key a by the plaintext data m, or performing a discrete Fourier transform on the plaintext data using the key.

[0080] This embodiment provides a simple and highly secure first operation method. The first operation may include the following steps 1 and 2.

[0081] Step 1, using the first random number e to hide the plaintext data m to obtain a second intermediate value g;

[0082] Step 2: Use the key to perform a second operation on the second intermediate value g to obtain the first intermediate value x.

[0083] In step 1, the plaintext data m can be inserted into a preset position in the first random number e. The preset position, like the key and the permutation rule, is important confidential data of the encryption algorithm. The preset position includes the high position, low position or middle position of the first random number e. For example,

[0084] High position: g = 2 β m + e;

[0085] Low: g = 2 z e + m;

[0086] Middle: g = 2 u e1 +2 v m+e2, e1 and e2 are random numbers.

[0087] Among them, the above data are all binary numbers, 2 β m means adding β zeros to the right of m, thereby pushing m to a higher position. z, u and v are all set values. The first random number e includes e1 and e2.

[0088] The second operation in step 2 may include multiple implementations when being implemented.

[0089] In one embodiment, the key includes a first key a and a second key p. The second operation may include:

[0090] The product of the first key a and the second intermediate value g is calculated, the product is modulo the second key p to obtain a third intermediate value, and the first intermediate value x is determined based on the third intermediate value.

[0091] The multiplication of the first key a and the second intermediate value g is to expand the second intermediate value g, thereby smoothing out a part of the features in the plaintext data m, such as the sample. Then, the second key p is used to take the modulus, which can further smooth out the feature information in the plaintext data m.

[0092] The third intermediate value can be expressed as a g%p, where is the multiplication sign, which is sometimes omitted, and % is the modulus sign. β When m + e, the third intermediate value can be expressed as

[0093] a(2 β m + e)%p

[0094] The third intermediate value can be directly used as the first intermediate value x, or noise can be added to the third intermediate value to obtain the first intermediate value x. That is, the first intermediate value x can be expressed as

[0095] x = ag%p=a(2 β m + e)%p (1)

[0096] x = ag%p +rp=a(2 β m + e)%p + rp (2)

[0097] Where r is a random number and the added noise is the product of the random number and the second key p.

[0098] Since the first intermediate value x is related to the remainder after taking the modulus with the second key p, in order to enhance the privacy of the first intermediate value x, the preset high bit of the second key p can be set to the maximum value within the acceptable range. When the second key q is a 256-bit binary number, the preset high bit can be, for example, the upper 32 bits. In binary, the acceptable range of each bit value is 0 or 1, that is, the upper 32 bits are set to 1. In this way, the high bits of the remainder can have more possibilities, thereby increasing the difficulty for attackers to maliciously speculate the remainder.

[0099] In one embodiment, the key includes a first key a, a second key p and a third key q, and the second intermediate value g or the explanatory text data m can be hidden in the coordinates of the Chinese remainder theorem. Alternatively, the second intermediate value g or the explanatory text data m can be split and hidden in the coordinates of the Chinese remainder theorem.

[0100] In the first case, the second intermediate value g or the explanatory text data m is directly hidden in the coordinates of the Chinese remainder theorem. The second operation may specifically include:

[0101] Generate the second random number w, and use the Chinese remainder theorem to solve the first intermediate value x based on the following conditions:

[0102] Calculate the product of the first key a and the second intermediate value g, so that the result of taking the product modulo the second key p is equal to the result of taking the first intermediate value x modulo the second key p, and so that the result of taking the second random number w modulo the third key q is equal to the result of taking the first intermediate value x modulo the third key q.

[0103] The above conditions can be expressed by the following congruence equations:

[0104] x ≡ [a(2 β m +e)] % p

[0105] x ≡ w % q (3)

[0106] Among them, ≡ is the congruence symbol, and the second intermediate value g=2 β m +e, [] is a bracket, and % is a modulus symbol. The first intermediate value x can be uniquely determined by solving the above congruence equations using the Chinese remainder theorem.

[0107] In the first case, the second intermediate value g or the explanatory text data m is split and hidden in the coordinates of the Chinese remainder theorem. The first random number e includes a first number e1 and a second number e2. The above step 1 may include:

[0108] Split the plaintext data m into the first plaintext data m 11 and the second plaintext data m 22 ;

[0109] Use the first number e1 to 11 To hide, use the second number e2 to hide the second plaintext data m 22 Hiding is performed to obtain two second intermediate values ​​g.

[0110] Accordingly, the second operation may specifically include:

[0111] Using the Chinese remainder theorem, we can solve the first intermediate value x based on the following conditions:

[0112] Calculate the product of the first key a and the two second intermediate values ​​g respectively, so that the result of taking a modulus of one product using the second key p is equal to the result of taking a modulus of the first intermediate value x using the second key p, and the result of taking a modulus of the other product using the third key q is equal to the result of taking a modulus of the first intermediate value x using the third key q.

[0113] The above conditions can be expressed by the following congruence equations:

[0114] x ≡ [a(2 β m 11 +e1)] % p

[0115] x ≡ [a(2 β m 22 +e2)] % q (4)

[0116] Among them, m 11 +m 22 =m, ≡ is the congruence symbol, a second intermediate value g=2 β m 11 +e1, another second intermediate value g=2 β m 22 +e2, [] are brackets, and % is the modulus symbol. Using the Chinese remainder theorem to solve the above congruence equations, the first intermediate value x can be uniquely determined. Using the Chinese remainder theorem to solve the above congruence equations, the first intermediate value x can be uniquely determined.

[0117] When the plaintext data m is split, it can also be split into more parts. The corresponding implementation method can be easily obtained based on the above implementation method, so it will not be described in detail.

[0118] The above formulas (1) to (4) illustrate various implementations of step 2. These implementations can all use the key to encrypt the second intermediate value g or the explanatory text data m to obtain the first intermediate value x that can be subjected to additive homomorphic operations. In practical applications, the above various implementations can also be combined. For example, the encryption result obtained by using a certain implementation can be used as the second intermediate value g or the explanatory text data m, and then encrypted using another implementation to obtain the final first intermediate value x. The specific process will not be repeated here.

[0119] In step S230, when the first intermediate value x is segmented, the first intermediate value x may be equally divided into n segments, and the bits of each segment are the same; or the first intermediate value x may be unequally divided into n segments, and the bits of the n segments are not completely the same. When x is equally divided into n segments, each segment has γ bits. Each segment constitutes an element in the array x′. x′[η] represents the entire array.

[0120] In order to improve security, the bit value of each segment in the divided n segments is less than a preset value. The preset value can be set to 2 to 5, for example.

[0121] In step S240, the permutation rule π includes the permutation order and the permutation position of the elements. By permuting the elements in the array x′ according to the permutation rule π, a ciphertext c can be obtained. The ciphertext c is an array containing n elements. That is, the ciphertext c can be expressed as

[0122] c[η]=π(x′[η]) (5)

[0123] In order to improve security, the substitution rule π can be set as a joint substitution rule. That is, when performing element substitution, the plaintext data m and the elements in the array corresponding to other related plaintext data are jointly substituted according to the substitution rule π. The related here refers to the selected object to be jointly substituted with the plaintext data m. The array corresponding to the related plaintext data is also obtained according to the operations of the above steps S210 to S230. The other related plaintext data can be one or more.

[0124] For example, in the joint permutation rule, some elements in the array x′1 corresponding to the plaintext data m1 are permuted into the array x′2 corresponding to the plaintext data m2.

[0125] In the implementation scenario corresponding to this embodiment, when the device 2 selects multiple ciphertexts, the ciphertext c1 corresponding to the plaintext data m1 and the ciphertext c2 corresponding to the plaintext data m2 are selected in a binding manner, that is, if the ciphertext c1 is selected, the ciphertext c2 will also be selected at the same time.

[0126] In this embodiment, since the random number e is a relatively large number generated randomly, this makes x approximately uniformly distributed between (0, p). α -1 are the same, statistically speaking, x is close to (0, 2 α -1). Therefore, each segment x′[i] of x is approximately η -1), that is, c[i] is approximately uniformly distributed on (0, 2 η -1). Therefore, the ciphertext c has a strong ability to resist attacks.

[0127] The above content is an explanation of the encryption method. Figure 3 The process of the decryption method is described in detail. Figure 3 is Figure 2 The embodiments obtained based on the embodiments, the related descriptions therein can be referred to each other.

[0128] Figure 3 A flowchart of a permutation decryption method applicable to homomorphic operations provided in an embodiment. The method is executed by a computing device. The method includes the following steps.

[0129] Step S310, obtain the ciphertext c to be decrypted and the corresponding key and substitution rule π. The ciphertext c is an array containing n elements.

[0130] Step S320: Perform reverse permutation on the elements in the ciphertext c according to the permutation rule π to obtain an array x′.

[0131] Step S330, concatenating n elements in the order of elements in the array x′ to form a first intermediate value x;

[0132] Step S340: performing an inverse operation related to the first operation on the first intermediate value x based on the key, and determining the plaintext data m of the ciphertext c from the obtained operation result.

[0133] The above steps are described in detail below.

[0134] The key and replacement rule in step S310 use the key and replacement rule in the encryption phase. For details, see Figure 2 The description of step S210 in the embodiment. The ciphertext c can be the sum of multiple ciphertexts or a ciphertext, and the ciphertext c corresponds to the plaintext data m. If c1[η] and c2[η] are two ciphertexts, then their sum c[η] satisfies

[0135] c[i]= c1[i]+ c2[i], i∈[0, η-1]

[0136] Among them, c[i] represents the i-th element in the ciphertext c[η], and the other parameters have similar meanings.

[0137] In step S320, the elements in the ciphertext c are reversely permuted according to the permutation order and permutation position of the elements contained in the permutation rule, that is, the corresponding elements are permuted to the corresponding positions in the reverse order of the permutation order. The array x′ can be expressed as

[0138] x′[η] = π -1 (c[η]) (6)

[0139] When the permutation rule π is a joint permutation rule, the elements in other related ciphertexts and the elements in ciphertext c are reversely permuted according to the permutation rule π to obtain the array x′. Other related ciphertexts refer to ciphertexts that have a permutation relationship with ciphertext c, and the corresponding information is stored in the computing device.

[0140] In step S330, n elements are concatenated into a complete value according to the order of elements in the array x′, that is, the first intermediate value x is obtained, that is, x can be expressed as

[0141] x = ∑ 0 η-1 x ' [i] 2 iγ (7)

[0142] Here, x takes values ​​between 0 and η-1, γ is the number of bits of each element, and x′[i] represents the i-th element in x′[η].

[0143] In step S340, since the implementation methods of the first operation in the encryption stage may include multiple ones, when performing the inverse operation related to the first operation, the corresponding inverse operation may be performed according to different first operations. For example, when the first operation selects to use an algorithm such as multiplying the first key a by the plaintext data m, or performing a discrete Fourier transform on the plaintext data using the key, the corresponding inverse operation may be used to calculate and obtain the plaintext data m.

[0144] In one embodiment, when the encryption phase is adopted Figure 2 When steps 1 and 2 in the embodiment perform the first operation, the present embodiment adopts the following steps 3 and 4 to perform the inverse operation related to the first operation.

[0145] Step 3, using the key to perform an inverse operation of the second operation on the first intermediate value x to obtain a second intermediate value g;

[0146] Step 4: Determine the plaintext data m from the second intermediate value g.

[0147] In the encryption stage, the second intermediate value g is obtained by inserting the plaintext data m into the preset position in the first random number e. When the preset position is a high bit, the second intermediate value g can be expressed as

[0148] g=2 β m + e

[0149] In the decryption stage, the preset position data of the second intermediate value g may be read, and the read data may be used as the plaintext data m.

[0150] Since the second operation of step 2 includes multiple implementations, the above step 3 also includes multiple implementations accordingly.

[0151] In one embodiment, the key includes a first key a and a second key p. The inverse operation of the second operation includes:

[0152] The product of the inverse of the first key a and the first intermediate value x is calculated, and the product is modulo the second key p to obtain the second intermediate value g.

[0153] When the first intermediate value in the encryption process is expressed in the form of formula (1) or formula (2), in the decryption process, the first intermediate value x, the first key a and the second key b are known, and the solution expression of the second intermediate value g can be obtained based on formula (1) or formula (2):

[0154] g=(a -1 x)%p (8)

[0155] In general, g is smaller than p. The second intermediate value g can be solved using equation (8).

[0156] In one embodiment, the key includes a first key a, a second key p, and a third key q. Correspondingly, the plaintext data m is hidden in the coordinates of the Chinese remainder theorem. The inverse operation of the second operation includes: calculating the product of the first intermediate value x and the inverse of the first key a, taking the modulus of the product using the second key p, and obtaining the second intermediate value g.

[0157] This implementation corresponds to the encryption method corresponding to formula (3). In the encryption stage, when the first intermediate value x is represented by the congruence equation group shown in formula (3), the solution expression of the second intermediate value g can be obtained by the formula x%p= (ag)%p corresponding to formula (3):

[0158] g=(xA -1 )%p (9)

[0159] When the plaintext data m is split and hidden in the coordinates of the Chinese remainder theorem, the inverse operation of the second operation includes:

[0160] The product of the first intermediate value x and the inverse of the first key a is calculated, and the product is modulo the second key p to obtain a second intermediate value g, and the product is modulo the third key q to obtain another second intermediate value g.

[0161] This implementation corresponds to the encryption method corresponding to formula (4). In the encryption stage, when the first intermediate value x is represented by the congruence equation group shown in formula (4), the formula corresponding to formula (4) is

[0162] x%p= (ag)%p

[0163] x%q= (ag) % q

[0164] The solution expressions for the two second intermediate values ​​g can be obtained as

[0165] g=(xA -1 )%p

[0166] g=(xA -1 )%q (10)

[0167] The two second intermediate values ​​g each contain only incomplete plaintext data m, and the two second intermediate values ​​g need to be summed to obtain a sum value that contains the complete plaintext data m.

[0168] Therefore, when executing step 4, the preset position data of the sum value may be read, and the read data may be used as the plaintext data m.

[0169] To sum up, in the decryption stage, the elements in the ciphertext are reversely permuted according to the permutation rule, and the elements are concatenated in order, and then the key is used to perform the inverse operation of the first operation to restore the plaintext data. The decryption process is simple and highly secure.

[0170] In this specification, the word "first" in terms such as first operation, first intermediate value, first key, first random number, first number, etc., and the corresponding "second" (if any) in the text, etc., are merely for the convenience of distinction and description and do not have any limiting meaning.

[0171] The embodiments of this specification provide a symmetric cryptographic algorithm that requires only a small amount of addition and modular multiplication, which is less expensive than asymmetric key overhead and consumes far less modular exponentiation than the Paillier algorithm. It can be applied in specific data circulation scenarios to achieve efficient additive homomorphic encryption and decryption operations. In addition, since the embodiments of this specification provide a symmetric key algorithm with a small amount of calculation, in order to improve security, more keys and richer operation logic can be used when setting keys without considering whether these contents are public keyed. For example, the permutation operation in the embodiment is difficult to public key.

[0172] The permutation operation introduced in the embodiment breaks the original algebraic structure (addition, subtraction, multiplication, division, modulus, etc.), making some algebraic attacks no longer effective. In addition, the permutation operation, element splitting and combination operation do not affect the homomorphism of the data.

[0173] As mentioned above, the first operation performed on the plaintext data m using the key in step S220 is an encryption operation on the plaintext data. In order to further improve the security of the data, in step S230, the first intermediate value x is split into very small segments. A single small segment no longer has the original algebraic relationship, and it is difficult for an attacker to attack using one of the small segments. After the replacement operation in step S240, the attacker cannot put the separate small segments together, and the data security is higher.

[0174] The embodiments provide methods that can resist multiple attack methods. For example, the encryption method provided in the embodiments can resist ciphertext-only attacks (including frequency attacks, orthogonal lattice attacks), LWE-related attacks, guessed permutation attacks, and permutation invariant attacks, etc. The following are brief descriptions of each.

[0175] The algorithm provided in the embodiment can resist frequency attacks. The random number e is a relatively large number generated randomly, which makes x approximately uniformly distributed between (0, p). α -1 are the same, statistically, x is close to (0, 2 α -1). Therefore, each segment x′[i] of x is approximately η-1), that is, c[i] is approximately uniformly distributed on (0, 2 η -1). Therefore, the attacker cannot determine any information through the distribution of c[i].

[0176] The algorithm provided in the embodiment can resist orthogonal lattice attack. Orthogonal lattice attack is an effective attack method for problems such as approximate common factors. The idea of ​​this attack is to find vectors that are orthogonal to the ciphertext, because there is a certain relationship between the plaintext and the ciphertext, which leads to these vectors being orthogonal to the plaintext, and further obtain a smaller space where the plaintext may appear, and then guess the plaintext in combination with other conditions.

[0177] The first step of the algorithm in this embodiment is very similar to the approximate common factor problem. Let's consider the impact of the orthogonal lattice attack on this algorithm. Assume that the attacker uses w ciphertexts to attack. The c[i] in the w ciphertexts are combined into a vector, denoted as C[i]. Let g = 2 β m+e. The vector composed of x and E in the w ciphertexts is recorded as X and E. According to the algorithm description, c[i] still contains all the digits of x, but the positions are permuted. Since the permutation method is the same for each operation, it can be recorded as

[0178] X = ∑ 0 η-1 B i C[i]

[0179] Then B i The set composed of {2 iγ |i∈[0,η]} are the same. Then the plaintext-ciphertext relationship can be expressed as:

[0180] ∑ 0 η-1 B i C [i] =a E % p (11)

[0181] According to the conventional idea of ​​orthogonal lattice attack, the attack method is as follows. The attacker obtains vector T that is orthogonal to all C[i], and can obtain w-η. Assuming that they are all short vectors (which is most advantageous to the attacker, there will be one less in actual measurement, but it does not affect the subsequent analysis), then vector T is also orthogonal to E. Assume that a set of short bases (referring to the small bit width of the elements) of the space that is orthogonal to all vectors T is (E0, E1, ..., E i , …). Since there are w-η vectors T, the space is η-dimensional. And C[i] and E are in this space. Assume that E is represented on the basis

[0182]

[0183] The main reason why other algorithms that are successfully attacked by orthogonal lattice attack is that in this step Li is relatively small, and a brute force search can be performed on Li. However, in the embodiment algorithm, L i is very large and cannot be searched. The following explains why. i is a short basis in space, and C i is a vector in this space, so E i The element width does not exceed C i The element width of C i If there is only γ bit, then E i The bit width of L is also less than γ bits (it may be slightly larger due to jitter). i Very long. It is measured that when γ ≤ 4, L i The length is close to E.

[0184] Because L i is a fixed variable for each plaintext and ciphertext pair. You may wonder whether Li can be guessed if more plaintext and ciphertext are used, that is, when w is relatively large. The following explains that when the bit width information of E cannot be used for search, no matter how large w is, L i Only n equations need to be satisfied.

[0185] Bringing the decomposition of E back to formula (11), we get:

[0186] (12)

[0187] Remember C i In the base i The above expression is

[0188] C [i]= ∑ j=0 η-1 d ij E j

[0189] Substituting the above expression into formula (12), we get

[0190] (13)

[0191] Due to E i is a set of bases, then formula (13) is equivalent to the same coefficients on different coordinate axes of the base.

[0192] (14)

[0193] Note that formula (14) has only η equations. As long as L i Satisfying these η equations, they can satisfy formula (12) for arbitrarily large w. Otherwise, this problem is similar to the original one (see formula 11).

[0194] The following analyzes how the embodiments defend against LWE-related attacks. LWE is an abbreviation for Learning With Errors. The applicant found that in an orthogonal lattice attack, some information obtained by the attacker is similar to the LWE problem, which is explained below.

[0195] In the orthogonal grid attack part, the attacker can obtain w-η T, which is orthogonal to E.

[0196]

[0197] Here, the part of TE above the β position is denoted as e′. M is the vector corresponding to m. Then TM+e′=0. Let the width of T be ξ, then

[0198]

[0199] Then e′ is about log(w)+ξ bits (about 11 bits under the example parameters), which can be considered as an error. At this point, the attacker can obtain a relation T of w plaintexts m≈0, and the error is e′. When w is relatively large, this relationship has little constraint on the plaintext.

[0200] Furthermore, according to each T, the attacker can obtain such an approximate relationship, and the attacker may try to integrate these relationships for comprehensive analysis. In fact, the attacker can obtain w-n approximate relationships, and through the mutual elimination of these relationships, the attacker can eventually obtain n plaintext approximate relationships. When n > 100, it is difficult for the attacker to obtain effective information.

[0201] We can rewrite the above relationship in a form that is more similar to LWE. Let T be the matrix composed of w-η vectors T (each vector occupies one row), and E' be the vector composed of w-η e', then TM +E'=0.

[0202] Let's review the classic LWE problem. Given A, b, p, and the error e satisfying Ax+e=b (mod p), find the ciphertext x. The matrix of n.

[0203] Most of the attack studies on the LWE problem assume that the number of equations is much larger than the number of variables, i.e., m n. In this formula, the number of equations (w-η) is significantly smaller than the number of variables (w). Therefore, related research has little impact on our problem.

[0204] The following analyzes how the method of the embodiment resists guess replacement attacks.

[0205] Suppose an attacker tries to guess π. There are η! possibilities for π. When η = 32, there are 2117 Of course, to achieve higher security, η should be larger, because the attacker can guess part of π and then use other methods to attack.

[0206] Assume the attacker guesses v B i , the guessed B i Substitute into formula (11) and replace the corresponding B i C[i] items are added together. At this point, the attack is carried out using the method in the LWE related attack. However, the original η is equivalent to η-v. The attacker can obtain the approximate relationship of η-v plaintexts. We can take η=128, v=16, and guess v B at this time i The cost is about 2 110 , which is the limit of what the attacker can guess, but the attacker can only obtain the approximate relationship of 112 plaintexts, which is difficult to use effectively.

[0207] The following analyzes how the embodiment resists attacks using permutation invariants.

[0208] The reason why the above attack failed is that permutation π greatly hinders the recovery of plaintext from ciphertext. When the algorithm contains permutation, the attacker's common idea is to find the permutation invariant. Here we discuss the threat of attacking with permutation invariants.

[0209] In the permutation process, there are two main invariants, one is the sum of all elements, and the other is the product of all elements. The product of all elements is difficult to exploit, and no effective exploitation method has been found. The following describes the attack using the sum of all elements.

[0210] To review, B i The set composed of {2 iγ |i∈[0,η]}, then

[0211]

[0212] The result of the above formula is recorded as A.

[0213] The attacker obtains a short vector T that is orthogonal to C[0]-C[0], C[1]-C[2], …, C[i]-C[i+1], …. Then T C[i] is the same for all i and is not 0.

[0214] Multiplying point T to both ends of formula (11), we have

[0215] ∑ 0 η-1 ( B i C[i] ∙ T) =( aE∙T)%p

[0216] ∑ 0 η-1 ( B i C[ 0 ] ∙ T) =( aE∙T)%p

[0217] AC[0] T = (aE T)%p

[0218] Let d = (A -1 a) %p, then C[0] T = (dE T) %p.

[0219] Let y = C[0] T,z=E T, then y = (dz) % p

[0220] At this point, the attacker attempts to infer p and d based on the obtained y. Let the width of T be ξ. Then the width of z is approximately β+ρ+ξ, and the width of y is approximately γ+ξ.

[0221] It should be noted that if ξ is chosen too large, the width of z will be larger than p. In this case, for any selected p and d, there is a possible z that can satisfy any y, and the attacker cannot distinguish these p and d. That is, β+ρ+ξ < α.

[0222] Assume that φ, ψ and Δ satisfy:

[0223] (15)

[0224] By solving the equations, we know that ψ-Δ=α-γ-ξ > α-γ-(α-β-ρ)=β+ρ-γ. From Lemma4, we know that the attacker cannot distinguish the cases where p kind. When β=128, ρ=0, γ=2, ψ-Δ> 126. It's a small amount.

[0225] From the above analysis, it can be seen that the encryption algorithm provided by the embodiment can resist various attacks, which can not only reduce computing consumption but also ensure high security.

[0226] Combined with the above attack analysis, here are some parameters to choose from. The number of unknown bits of p is α-32 bits. Considering a certain margin, it is recommended that α be at least 256. When η=64, the attacker guesses 20 B i The complexity is 2 112 , the attacker can obtain the approximate relationship of 44 plaintexts, which is close to the common statistical security parameter requirements. It is recommended that η be 128, leaving a certain safety margin. From the permutation invariant attack, it can be seen that the space of p that the attacker can determine is related to the size of β. It is recommended that β be at least 128 bits.

[0227] The foregoing describes certain embodiments of the present specification, and other embodiments are within the scope of the appended claims. In some cases, the actions or steps described in the claims may be performed in an order different from that in the embodiments, and the desired results may still be achieved. In addition, the processes depicted in the accompanying drawings do not necessarily have to be performed in the specific order or sequential order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0228] Figure 4 A schematic block diagram of a permutation encryption device suitable for homomorphic operations provided in an embodiment. Figure 2 The method embodiment shown corresponds to the embodiment. The device is deployed in a computing device. The device 400 includes: a plaintext acquisition module 410, configured to obtain plaintext data m to be encrypted, a key, and a substitution rule π; an encryption operation module 420, configured to perform a first operation on the plaintext data m based on the key to obtain a first intermediate value x, and the first intermediate value x has a data structure that satisfies additive homomorphism; an array formation module 430, configured to divide the first intermediate value x into η segments to obtain an array x′ containing η elements; an element substitution module 440, configured to substitute the elements in the array x′ according to the substitution rule π to obtain the ciphertext c of the plaintext data m.

[0229] In one embodiment, the encryption operation module 420 includes: a hiding submodule 421 and an encryption submodule 422. The hiding submodule 421 is configured to use the first random number e to hide the plaintext data m to obtain a second intermediate value g; the encryption submodule 422 is configured to use the key to perform a second operation on the second intermediate value g to obtain a first intermediate value x.

[0230] In one implementation, the hiding submodule 421 is specifically configured to insert the plaintext data m into a preset position in the first random number e.

[0231] In one embodiment, the key includes a first key a and a second key p. The encryption submodule 422 is specifically configured to: calculate the product of the first key a and the second intermediate value g, take the modulus of the product using the second key p to obtain a third intermediate value, and determine the first intermediate value x based on the third intermediate value.

[0232] In one embodiment, the key includes a first key a, a second key p, and a third key q. The encryption submodule 422 is specifically configured to: generate a second random number w, and use the Chinese remainder theorem to solve the first intermediate value x based on the following conditions: calculate the product of the first key a and the second intermediate value g, so that the result of taking the product modulo the second key p is equal to the result of taking the first intermediate value x modulo the second key p, and so that the result of taking the second random number w modulo the third key q is equal to the result of taking the first intermediate value x modulo the third key q.

[0233] In one embodiment, the first random number e includes a first number e1 and a second number e2. The key includes a first key a, a second key p and a third key q. The hiding submodule 421 is specifically configured to: split the plaintext data m into the first plaintext data m 11 and the second plaintext data m 22 ; Use the first number e1 to the first plaintext data m 11 To hide, use the second number e2 to hide the second plaintext data m 22 The encryption submodule 422 is specifically configured as follows: using the Chinese remainder theorem, the first intermediate value x is obtained by solving the following conditions: calculating the product of the first key a and the two second intermediate values ​​g respectively, so that the result of taking the modulus of one product using the second key p is equal to the result of taking the modulus of the first intermediate value x using the second key p, and the result of taking the modulus of the other product using the third key q is equal to the result of taking the modulus of the first intermediate value x using the third key q.

[0234] In one implementation, the permutation rule π is a joint permutation rule. The element permutation module 440 is specifically configured to perform a joint permutation on the elements in the array corresponding to other related plaintext data and the elements in the array x′ according to the permutation rule π.

[0235] Figure 5 Schematic block diagram of a permutation decryption device suitable for homomorphic operation provided in an embodiment. Figure 3The method embodiment shown corresponds to the embodiment. The device 500 is deployed in a computing device, and includes: a ciphertext acquisition module 510, configured to obtain a ciphertext c to be decrypted and a corresponding key and a permutation rule π; the ciphertext c is an array containing n elements; a reverse permutation module 520, configured to perform reverse permutation on the elements in the ciphertext c according to the permutation rule π to obtain an array x'; an element concatenation module 530, configured to concatenate n elements in the order of the elements in the array x' to form a first intermediate value x, the first intermediate value x having a data structure that satisfies additive homomorphism; a decryption operation module 540, configured to perform an inverse operation related to the first operation on the first intermediate value x based on the key, and determine the plaintext data m of the ciphertext c from the obtained operation result.

[0236] In one implementation, the permutation rule π is a joint permutation rule. The reverse permutation module 520 is specifically configured to: perform reverse permutation on elements in other related ciphertexts and elements in the ciphertext c according to the permutation rule π to obtain an array x′.

[0237] In one embodiment, the decryption operation module 540 includes: a decryption submodule 541 and a determination submodule 542. The decryption submodule 541 is configured to use the key to perform an inverse operation of a second operation on the first intermediate value x to obtain a second intermediate value g. The determination submodule 542 is configured to determine the plaintext data m from the second intermediate value g.

[0238] In one implementation, the determining submodule 542 is specifically configured to read the preset position data of the second intermediate value g, and use the read data as the plaintext data m.

[0239] In one implementation, the key includes a first key a and a second key p. The decryption submodule 541 is specifically configured to: calculate the product of the inverse of the first key a and the first intermediate value x, and use the second key p to modulo the product to obtain the second intermediate value g.

[0240] In one implementation, the key includes a first key a, a second key p and a third key q. The decryption submodule 541 is specifically configured to: calculate the product of the first intermediate value x and the inverse of the first key a, and use the second key p to modulo the product to obtain the second intermediate value g.

[0241] In one embodiment, the key includes a first key a, a second key p, and a third key q. The decryption submodule 541 is specifically configured to: calculate the product of the first intermediate value x and the inverse of the first key a, use the second key p to modulo the product to obtain a second intermediate value g; use the third key q to modulo the product to obtain another second intermediate value g. The determination submodule 542 is specifically configured to: add the two second intermediate values ​​g to obtain a sum value, read the preset position data of the sum value, and use the read data as the plaintext data m.

[0242] The above-mentioned device embodiments correspond to the method embodiments. For specific descriptions, please refer to the description of the method embodiments, which will not be repeated here. The device embodiments are obtained based on the corresponding method embodiments and have the same technical effects as the corresponding method embodiments. For specific descriptions, please refer to the corresponding method embodiments.

[0243] The present specification also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed in a computer, the computer is caused to execute Figures 1 to 3 Any of the methods described above.

[0244] The embodiment of the present specification also provides a computing device, including a memory and a processor, wherein the memory stores an executable code, and when the processor executes the executable code, Figures 1 to 3 Any of the methods described above.

[0245] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the storage medium and computing device embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0246] Those skilled in the art should be aware that in one or more of the above examples, the functions described in the embodiments of the present invention may be implemented using hardware, software, firmware, or any combination thereof. When implemented using software, these functions may be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0247] The specific implementation methods described above further describe the purpose, technical solutions and beneficial effects of the embodiments of the present invention in detail. It should be understood that the above description is only a specific implementation method of the embodiments of the present invention and is not intended to limit the scope of protection of the present invention. Any modification, equivalent replacement, improvement, etc. made on the basis of the technical solution of the present invention shall be included in the scope of protection of the present invention.

Claims

1. A permutation encryption method suitable for homomorphic operations, comprising: Obtain the plaintext data m to be encrypted, the key, and the substitution rule π; Perform a first operation on the plaintext data m based on the key to obtain a first intermediate value x; The first intermediate value x has a data structure that satisfies addition homomorphism; Divide the first intermediate value x into n segments to obtain an array x′ containing n elements; The elements in the array x′ are permuted according to the permutation rule π to obtain the ciphertext c of the plaintext data m, and the ciphertext c can be used for homomorphic decryption.

2. The method according to claim 1, wherein the first operation comprises: Use the first random number e to hide the plaintext data m to obtain a second intermediate value g; A second operation is performed on the second intermediate value g using the key to obtain a first intermediate value x.

3. According to the method of claim 2, the step of using the first random number e to hide the plaintext data m comprises: The plaintext data m is inserted into a preset position in the first random number e.

4. The method according to claim 2, wherein the key comprises a first key a and a second key p; and the step of performing a second operation on the second intermediate value g using the key comprises: The product of the first key a and the second intermediate value g is calculated, and the product is modulo the second key p to obtain a third intermediate value, and the first intermediate value x is determined based on the third intermediate value.

5. The method according to claim 2, wherein the keys include a first key a, a second key p and a third key q; The step of performing a second operation on the second intermediate value g using the key comprises: Generate a second random number w, and use the Chinese remainder theorem to obtain the first intermediate value x based on the following conditions: calculate the product of the first key a and the second intermediate value g, so that a result of taking the product modulo the second key p is equal to a result of taking the first intermediate value x modulo the second key p, and so that a result of taking the second random number w modulo the third key q is equal to a result of taking the first intermediate value x modulo the third key q.

6. The method according to claim 2, wherein the first random number e comprises a first number e1 and a second number e2; the key comprises a first key a, a second key p and a third key q; The step of using the first random number e to hide the plaintext data m to obtain the second intermediate value g includes: Split the plaintext data m into first plaintext data m 11 and the second plaintext data m 22 ; Use the first number e1 to calculate the first plaintext data m 11 To hide, use the second number e2 to hide the second plaintext data m 22 Hide and obtain two second intermediate values ​​g; The step of performing a second operation on the second intermediate value g using the key comprises: Using the Chinese remainder theorem, the first intermediate value x is obtained based on the following conditions: the products of the first key a and two second intermediate values ​​g are calculated respectively, so that a result after taking the modulus of one product using the second key p is equal to a result after taking the modulus of the first intermediate value x using the second key p, and a result after taking the modulus of another product using the third key q is equal to a result after taking the modulus of the first intermediate value x using the third key q.

7. The method according to claim 1, wherein the permutation rule π is a joint permutation rule; and the step of permuting the elements in the array x′ according to the permutation rule π comprises: According to the replacement rule π, the elements in the array corresponding to other related plaintext data and the elements in the array x′ are jointly replaced.

8. A permutation decryption method suitable for homomorphic operations, comprising: Obtain the ciphertext c to be decrypted and the corresponding key and substitution rule π; The ciphertext c is an array containing n elements, and the ciphertext c can be used for homomorphic decryption; According to the permutation rule π, reverse permutation is performed on the elements in the ciphertext c to obtain an array x′; splicing n elements according to the order of elements in the array x′ to form a first intermediate value x, wherein the first intermediate value x has a data structure that satisfies additive homomorphism; An inverse operation related to the first operation is performed on the first intermediate value x based on the key, and the plaintext data m of the ciphertext c is determined from the obtained operation result.

9. According to the method of claim 8, the permutation rule π is a joint permutation rule; the step of performing reverse permutation on the elements in the ciphertext c according to the permutation rule π comprises: According to the substitution rule π, reverse substitution is performed on the elements in other related ciphertexts and the elements in the ciphertext c to obtain an array x′.

10. The method according to claim 8, wherein the step of performing an inverse operation related to the first operation on the first intermediate value x based on the key and determining the plaintext data m of the ciphertext c from the obtained operation result comprises: Using the key to perform an inverse operation of a second operation on the first intermediate value x, to obtain a second intermediate value g; The plaintext data m is determined from the second intermediate value g.

11. The method according to claim 10, wherein the step of determining the plaintext data m from the second intermediate value g comprises: The preset position data of the second intermediate value g is read, and the read data is used as the plaintext data m.

12. The method according to claim 10, wherein the key comprises a first key a and a second key p; and the step of using the key to perform an inverse operation of a second operation on the first intermediate value x comprises: The product of the inverse of the first key a and the first intermediate value x is calculated, and the product is modulo the second key p to obtain a second intermediate value g.

13. The method according to claim 10, wherein the key comprises a first key a, a second key p and a third key q; and the step of using the key to perform an inverse operation of a second operation on the first intermediate value x comprises: Calculate the product of the first intermediate value x and the inverse of the first key a, and take the modulus of the product using the second key p to obtain a second intermediate value g; Using the third key q to perform modulo operation on the product, another second intermediate value g is obtained; The step of determining the plaintext data m from the second intermediate value g comprises: Add the two second intermediate values ​​g to obtain a sum; The preset position data of the sum value is read, and the read data is used as the plaintext data m.

14. A permutation encryption device suitable for homomorphic operation, comprising: A plaintext acquisition module, configured to obtain plaintext data m to be encrypted, a key, and a substitution rule π; an encryption operation module, configured to perform a first operation on the plaintext data m based on the key to obtain a first intermediate value x, wherein the first intermediate value x has a data structure that satisfies additive homomorphism; an array forming module, configured to divide the first intermediate value x into n segments to obtain an array x′ containing n elements; The element replacement module is configured to replace the elements in the array xʹ according to the replacement rule π to obtain the ciphertext c of the plaintext data m, and the ciphertext c can be used for homomorphic decryption.

15. A permutation decryption device suitable for homomorphic operation, comprising: A ciphertext acquisition module, configured to obtain a ciphertext c to be decrypted and a corresponding key and a substitution rule π; the ciphertext c is an array containing n elements, and the ciphertext c can be used for homomorphic decryption; A reverse permutation module, configured to perform reverse permutation on the elements in the ciphertext c according to the permutation rule π to obtain an array x′; an element concatenation module, configured to concatenate n elements according to the order of elements in the array x′ to form a first intermediate value x, wherein the first intermediate value x has a data structure satisfying additive homomorphism; The decryption operation module is configured to perform an inverse operation related to the first operation on the first intermediate value x based on the key, and determine the plaintext data m of the ciphertext c from the obtained operation result.

16. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 13.

17. A computing device, comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method according to any one of claims 1 to 13 is implemented.

Images