Multi-party data processing method capable of protecting privacy and computing equipment

Abstract

The invention discloses a privacy-protecting multi-party data processing method and computing equipment. The method comprises the following steps that: a first party combines h first real number vectors into a first combined vector; performing homomorphic encryption on the first combined vector to obtain a first ciphertext; sending the first ciphertext to the second party; the second party merges h second real number vectors into a second merge vector; converting the second combined vector into a second plaintext polynomial; calculating a product of the first ciphertext and a second plaintext polynomial to obtain a second ciphertext; homomorphic operation is carried out on the second ciphertext to obtain a third ciphertext, and a plurality of components of a plaintext vector corresponding to the third ciphertext comprise the inner product of each group of real number vectors in h groups of real number vectors.

Description

Technical Field

[0001] The embodiments of this specification belong to the field of data processing, and more particularly, to a privacy-protecting multi-party data processing method and computing device. Background Art

[0002] In a privacy-preserving multi-party computing scenario, two parties often need to jointly calculate the inner product of their vectors without leaking their respective vector information. Specifically, suppose there are two parties, P0 and P1, who each hold a vector set The length of each vector is L, n can usually be a value of several hundred to tens of thousands, and L is, for example, 16. P0 and P1 need to calculate the inner product of these vectors by some safe method. (The symbol <·,·> represents the inner product of vectors. In the following text, “·” between vectors is also used to represent the inner product). When the calculation result is obtained by P0, it is necessary to satisfy the following conditions: P0 can only obtain the inner product result, and cannot obtain any other information about u except the inner product. i information, P1 cannot obtain the vector v about P0 i any information.

[0003] In one technical solution, homomorphic encryption is used to solve the above problem. For example, the Paillier homomorphic encryption algorithm can be used. First, P0 encrypts its own vector. Since each vector contains L integers, each vector is encrypted into L ciphertexts. P0 has a total of n vectors, so nL ciphertexts need to be transmitted to P1. After P1 receives the ciphertext, it calculates the multiplication by multiplying the ciphertext by the plaintext operation, and then obtains the inner product result of the encrypted state by adding the ciphertext, for a total of n ciphertexts. Finally, these n ciphertexts are returned to P0, which decrypts them and obtains the final inner product result. However, when using Paillier (and similar) homomorphic encryption schemes, the ciphertext size is large, which results in a large amount of communication and a large amount of calculation. Summary of the invention

[0004] The object of the present invention is to provide a privacy-preserving multi-party data processing method, so that two participants can obtain the inner products between multiple groups of vectors in batches with reduced calculation amount and communication data amount.

[0005] In a first aspect, the present specification provides a multi-party data processing method for protecting privacy, wherein the multi-party includes a first party and a second party, the first party has h first real number vectors arranged in sequence, and the second party has h second real number vectors arranged in sequence, wherein the first real number vectors and the second real number vectors in the same order are a group of real number vectors whose inner products are to be calculated, and the method includes:

[0006] The first party performs the following steps:

[0007] Merge the h first real number vectors into a first merged vector, wherein h corresponds to N / L, each group of h components at the same position in the h first real number vectors are arranged continuously in the first merged vector, N is the number of terms of a polynomial in a preset polynomial space, and the first real number vector and the second real number vector include L components;

[0008] Performing homomorphic encryption on the first merged vector to obtain a first ciphertext, where the first ciphertext includes a polynomial in the polynomial space;

[0009] sending the first ciphertext to the second party;

[0010] The second party performs the following steps:

[0011] Merge the h second real number vectors into a second merged vector, wherein each group of h components at the same position in the h second real number vectors are arranged continuously in the second merged vector;

[0012] Convert the second merged vector into a second plaintext polynomial, where the second plaintext polynomial includes N terms;

[0013] Calculate the product of the first ciphertext and the second plaintext polynomial to obtain a second ciphertext;

[0014] A homomorphic operation is performed on the second ciphertext to obtain a third ciphertext, wherein multiple components of a plaintext vector corresponding to the third ciphertext include inner products of each group of real number vectors in the h groups of real number vectors.

[0015] A second aspect of the present specification provides a multi-party data processing method for protecting privacy, wherein the multi-party includes a first party and a second party, the first party has h first real number vectors arranged in sequence, and the second party has h second real number vectors arranged in sequence, wherein the first real number vectors and the second real number vectors of the same order are a group of real number vectors whose inner products are to be calculated, and the method is performed by the first party, including:

[0016] Merge the h first real number vectors into a first merged vector, wherein h corresponds to N / L, each group of h components at the same position in the h first real number vectors are arranged continuously in the first merged vector, N is the number of terms of a polynomial in a preset polynomial space, and the first real number vector and the second real number vector include L components;

[0017] Performing homomorphic encryption on the first merged vector to obtain a first ciphertext, where the first ciphertext includes a polynomial in the polynomial space;

[0018] The first ciphertext is sent to the second party.

[0019] A third aspect of the present specification provides a privacy-preserving multi-party data processing method, wherein the multi-party includes a first party and a second party, the first party has h first real number vectors arranged in sequence, and the second party has h second real number vectors arranged in sequence, wherein the first real number vectors and the second real number vectors in the same order are a group of real number vectors whose inner products are to be calculated, and the method is performed by the second party, including:

[0020] receiving a first ciphertext from the first party, wherein the first ciphertext is a homomorphic ciphertext of a first merged vector, wherein the first merged vector is obtained by merging the h first real number vectors, wherein h corresponds to N / L, each group of h components at the same position in the h first real number vectors are arranged continuously in the first merged vector, N is the number of terms of a polynomial in a preset polynomial space, and the first real number vector and the second real number vector include L components;

[0021] Merge the h second real number vectors into a second merged vector, wherein each group of h components at the same position in the h second real number vectors are arranged continuously in the second merged vector;

[0022] Convert the second merged vector into a second plaintext polynomial, where the second plaintext polynomial includes N terms;

[0023] Calculate the product of the first ciphertext and the second plaintext polynomial to obtain a second ciphertext;

[0024] A homomorphic operation is performed on the second ciphertext to obtain a third ciphertext, wherein multiple components of a plaintext vector corresponding to the third ciphertext include inner products of each group of real number vectors in the h groups of real number vectors.

[0025] A fourth aspect of the present specification provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method described in any one of the first to third aspects.

[0026] A fifth aspect of the present specification provides a computing device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method described in any one of the first to third aspects is implemented.

[0027] A sixth aspect of the present specification provides a computer program product, comprising a computer program / instruction, which, when executed by a processor, implements the steps of the method described in any one of the first to third aspects.

[0028] Through the privacy-preserving multi-party data processing scheme of the embodiment of this specification, each participant sends its multiple real number vectors in a specific way. Packed into a long vector, so that the inner product v of multiple pairs of real vectors can be obtained in batches through homomorphic operations i ·u i , and protect the vector information of each participant from being leaked to other participants, thus reducing the amount of calculation and communication data of each participant in the multi-party data processing process. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions of the embodiments of this specification, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0030] Figure 1 A schematic diagram of a multi-party computing scenario in an embodiment of this specification;

[0031] Figure 2 is a flow chart of a data processing method in one embodiment of this specification;

[0032] Figure 3 A schematic diagram of a data processing operation of a first party P0 in an embodiment of this specification;

[0033] Figure 4 A schematic diagram of a data processing operation of a second party P1 in an embodiment of this specification;

[0034] Figure 5 is a flow chart of a data processing method based on a complex vector in another embodiment of this specification;

[0035] Figure 6 A schematic diagram of a data processing operation of a first party P0 in an embodiment of this specification;

[0036] Figure 7 Schematic diagram of data processing operation of vectors of the second side P1 dual array in the embodiment of this specification;

[0037] Figure 8 Schematic diagram of the data processing operation of the second party P1 on the vector of the odd-numbered group in the embodiment of this specification;

[0038] Fig. 9 It is a schematic diagram of performing homomorphic operations on adjacent ciphertexts in an embodiment of this specification. DETAILED DESCRIPTION

[0039] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0040] First, the fully homomorphic encryption algorithm involved in the embodiments of this specification is introduced.

[0041] The homomorphic encryption algorithm in the embodiments of this specification includes a fully homomorphic encryption algorithm, which is an encryption technology that allows any calculation to be performed on encrypted data. The above-mentioned fully homomorphic encryption algorithms include, for example, BFV, CKKS, FV, BV, etc., which are not limited to this. The CKKS algorithm is used as an example for description in the embodiments of this specification.

[0042] The security of the CKKS homomorphic encryption scheme is based on the RLWE difficulty assumption. (The set of all polynomials whose degree is less than N and whose coefficients are integers in [0,q], where N is a power of 2 and is generally between 4096, 8192, and 16384). The plaintext space is The ciphertext space is χ σ YesR q The discrete Gaussian distribution with standard deviation σ, that is, each coefficient of the polynomial is subject to a standard deviation of χ σ The parameters of the entire homomorphic algorithm include pp = {N, q, σ, κ}, where κ represents the security parameter. The homomorphic encryption algorithm consists of the following parts:

[0043] KGen(pp): Input algorithm parameters, KGen (key generation) function outputs private key sk and public key pk. Where sk is R q The polynomial in pk consists of two The polynomial composition in is

[0044] Ecd(m): Encoding function. Input a length The complex vector Ecd(m) outputs an R q The polynomial in The coding in Ecd(m) may be FFT coding. ;

[0045] Encryption function. Enter an R q The polynomial in Output the corresponding ciphertext

[0046] Dec(ct): decryption function. Input a ciphertext ct and output a plaintext polynomial. It is the inverse of the encryption function;

[0047] Decoding function. Input a plaintext polynomial Output a vector of length N / 2.

[0048] CKKS homomorphic operations can include the following operations:

[0049] Add&Sub: corresponds to the addition and subtraction of ciphertext. Specifically, suppose vectors a and b are encrypted separately to obtain the ciphertext ct a ,ct b , then Add(ct a ,ct b ), Sub(ct a ,ct b ) are the addition and subtraction of the ciphertext respectively. After decryption, the vectors obtained are a+b and ab respectively.

[0050] MulPt(ct,a): Ciphertext multiplication. Input a ciphertext ct (assuming it encrypts vector m) and a vector a, this function outputs a new ciphertext, the encrypted vector of this new ciphertext is here, Represents bitwise multiplication, that is, the corresponding positions of two vectors are multiplied to obtain a new vector.

[0051] Rot(ct,i): Rotation. Input a ciphertext ct (assuming it encrypts vector a) and a rotation step i. This function outputs a new ciphertext. The encrypted vector of this new ciphertext is the vector obtained by cyclically shifting a to the left by i bits. Note that the vector here is a complex vector of length N / 2. For example, assuming N=8, then the length of vector a is 4, recorded as (a0, a1, a2, a3), then the vector obtained by cyclically shifting a to the left by 1 bit is (a1, a2, a3, a0).

[0052] Conj(ct): conjugate. Input a ciphertext ct (assuming it encrypts vector a), and output a new ciphertext. The encrypted vector of this new ciphertext is the conjugate of vector a. In the same example, the output ciphertext encrypted vector is The horizontal line represents the conjugation of a complex number (a+ib is a form where i 2 =-1, its conjugate is a-ib)

[0053] In the related technical solution, participant P0 can encrypt the vector by using a fully homomorphic encryption algorithm to obtain the ciphertext corresponding to the vector, and send the ciphertext to participant P1. After receiving the ciphertext, participant P1 can use the operation of multiplying the ciphertext by the plaintext to calculate the product of the elements at the corresponding positions, and add the products of the elements at each position to obtain the inner product between the vectors. In this technical solution, since in actual calculations, N is usually much larger than the length L of a single vector, for example, N = 8192, L = 16, where N = 8192 means that each ciphertext can encrypt a complex vector of length 4096. Therefore, using a homomorphic encryption algorithm to encrypt a shorter vector of length L = 16, for example, there is a great waste of plaintext space.

[0054] To this end, a data processing solution is provided in the embodiment of this specification, where each participant sends its multiple real number vectors Packed into a long vector, so that the inner product v of multiple pairs of real vectors can be obtained in batches through homomorphic operations i ·u i , and protect the vector information of each participant from being leaked to other participants.

[0055] Figure 1 FIG. 1 is a schematic diagram of a multi-party computing scenario in an embodiment of this specification. Figure 1 As shown, for example, the first party P0 has n real vectors Where v0 = [v 00 ,v 01 ,v 02 ,…v 0L-1 ],v1=[v 10 ,v 11 ,v 12 ,…v 1L-1 ]…, that is, each real vector consists of L elements (or components). Similarly, the second party P1 has n real vectors

[0056] The first party can transform each h vector v according to the value of N i Merge into a merged vector V, where h is, for example, N / L, so that multiple merged vectors can be obtained, the multiple merged vectors are encrypted to obtain multiple ciphertexts, and the multiple ciphertexts are sent to the second party. The second party can similarly convert each h vector u i Merge into a merged vector U, and multiply each ciphertext by the polynomial corresponding to the corresponding merged vector U to obtain multiple new ciphertexts. By performing homomorphic operations on the new ciphertext, such as rotation, addition, etc., a ciphertext containing multiple vector inner products can be obtained, that is, each component in the plaintext corresponding to the ciphertext includes the inner product v of each pair of real vectors i ·u i .

[0057] Figure 2 Flow chart of a data processing method in one embodiment of this specification.

[0058] like Figure 2 As shown, in step S210, the first party P0 converts h real number vectors v i Merge into vector V.

[0059] In order to more clearly describe the method in the embodiments of this specification, Figure 2 The method shown is first described by taking the merging of h real vectors as an example. Where h is less than or equal to N / 2L, N is the parameter of the polynomial space, that is, the polynomials in the polynomial space contain at most N terms, and the real vector v i The length of is L. Since the polynomials in this polynomial space correspond to vectors of length at most N / 2, we can put at most (N / 2) / L (i.e. h) real number vectors v i The concatenation is into a merged vector, the length of which is at most ((N / 2) / L)*L=N / 2, so it can be encrypted by one ciphertext.

[0060] Specifically, in order to facilitate subsequent homomorphic operations, the h real number vectors are merged in the following manner in the embodiment of this specification:

[0061] Each vector v i The element v ij are arranged alternately in the merge vector V so that V k =V i+j·(N / 2L) =v ij Among them, V k represents the kth element in the merged vector V, v ij Represents the i-th vector v among h vectors i That is, in the merged vector V, first each vector v i The 0th item is arranged in order, and then each vector v i The first item of is arranged in sequence, and so on, to obtain the final merged vector.

[0062] For example, assuming N=32, L=4, N / 2L=32 / (2*4)=4, then h is 4 at most.

[0063] In the case of h = 4, assuming v0 = [v 00 ,v 01 ,v 02 ,v 03 ],v1=[v 10 ,v 11 ,v 12 ,v 13],v2=[v 20 ,v 21 ,v 22 ,v 23 ],v3=[v 30 ,v 31 ,v 32 ,v 33 ], the merged vector V can be obtained as follows:

[0064] V=[v 00 ,v 10 ,v 20 ,v 30 ,v 01 ,v 11 ,v 21 ,v 31 ,v 02 ,v 12 ,v 22 ,v 32 ,v 03 ,v 13 ,v 23 ,v 33 ]

[0065] Here, for example, V4 in the above V = v 01 =V 0+1·4 .

[0066] In the case of h<4, assuming that the three vectors v0, v1, and v2 are merged, it is necessary to fill zeros in the vector V to obtain the following merged vector V:

[0067] V=[v 00 ,v 10 ,v 20 ,0,v 01 ,v 11 ,v 21 ,0,v 02 ,v 12 ,v 22 ,0,v 03 ,v 13 ,v 23 ,0]

[0068] By performing the h vectors v as described above i Merge, so that after the ciphertext corresponding to V°U is obtained through homomorphic operation, the ciphertext can be transformed through rotation and addition homomorphic operation, so as to obtain the inner product of each group of vectors. Where U is the second party P1 in the same way to its h vectors u i The merged vector obtained by merging will be described in detail below.

[0069] Figure 3Schematic diagram of the data processing operation of the first party P0 in the embodiment of this specification.

[0070] like Figure 3 As shown, it is assumed that the first party P0 uses the above merging method to Figure 3 The real vectors v0 = (1, 2, 2, 1), v1 = (0, 2, 0, 1), v2 = (1, 0, 0, 3), and v3 = (2, 0, 1, 2) in the matrix are combined to obtain Figure 3 The merged vector V in is:

[0071] V=[1,0,1,2,2,2,0,0,2,0,0,1,1,1,3,2]

[0072] Specifically, Figure 3 As shown in FIG. 1 , the elements of each vector are shown in different colors to facilitate distinguishing which vector v each element comes from in the vector V. i In vector V, first follow the vector v i Arrange the 0th element of v0 to v3 in ascending order of i, then arrange the 1st element of v0 to v3 in ascending order of i, and so on.

[0073] In step S220, the first party P0 performs homomorphic encryption on the vector V to obtain the ciphertext C V .

[0074] The first party P0 can use the CKKS homomorphic algorithm described above to encrypt the vector V. As described above, when the first party P0 encrypts the vector V, it first converts the vector V into a plaintext polynomial Ecd(V), and then encrypts the plaintext polynomial Ecd(V) using the public key pk to obtain the ciphertext C corresponding to the vector V. V , where the ciphertext C V It includes two ciphertext polynomials, for example (c0, c1). For example, for the polynomial space of N=32 as described above, each ciphertext polynomial includes 32 items.

[0075] In one implementation, the first party P0 eventually decrypts the ciphertext to obtain the plaintext inner product of each group of vectors. The first party P0 then has a homomorphically encrypted private key sk and a public key pk, and the first party P0 uses the public key pk to homomorphically encrypt the vector V.

[0076] In another embodiment, the second party P1 finally decrypts the ciphertext to obtain the plaintext inner product. The second party P1 then has the homomorphically encrypted private key sk and public key pk. The first party P0 can obtain the public key pk from the second party P1 and use the public key pk to homomorphically encrypt the vector V.

[0077] In step S230, the first party P0 sends the homomorphic ciphertext CV Sent to the second party P1.

[0078] In step S240, the second party P1 converts h vectors u i Merge into vector U.

[0079] The second party P1 can similarly convert each vector u i The weight u ij are arranged alternately in the merge vector U so that U k =U i+j (N / 2L) = u ij .

[0080] Figure 4 Schematic diagram of the data processing operation of the second party P1 in the embodiment of this specification. Figure 4 The vector pointed by the double arrow on the right side of the ciphertext in is the plaintext vector corresponding to the ciphertext. For example, the ciphertext C V The vector pointed by the double arrow on the right side [1,0,1,2,2,2,0,0,2,0,0,1,1,1,3,2] is the ciphertext C V The corresponding plaintext V.

[0081] like Figure 4 As shown, assuming that the second party P1 uses the above merging method to Figure 4 The real vectors u0=(0,2,0,1), u1=(1,0,0,0), u2=(2,1,2,0), u3=(1,1,0,1) in are combined to obtain Figure 4 The merge vector U in is:

[0082] U=[0,1,2,1,2,0,1,1,0,0,2,0,1,0,0,1]

[0083] In step S250, the second party P1 converts the vector U into a plaintext polynomial Ecd(U).

[0084] That is, the vector U is converted into a polynomial Ecd(U) including N=32 terms, wherein the coefficients of each term in the polynomial Ecd(U) can be calculated based on each element of the vector U through FFT encoding.

[0085] In step S260, the second party P1 calculates the ciphertext C V The product of the plaintext polynomial Ecd(U) yields the ciphertext C VU

[0086] As mentioned above, the ciphertext C V Includes two ciphertext polynomials, such as (c0, c1), and converts the ciphertext C VThe multiplication with the plaintext polynomial Ecd(U) includes: in the above polynomial space, the ciphertext polynomials c0 and c1 are multiplied by the polynomial Ecd(U) to obtain two ciphertext polynomials c2 and c3, thereby obtaining the ciphertext C VU =(c2,c3).

[0087] like Figure 4 As shown, since the ciphertext C V Multiplication with the plaintext polynomial Ecd(U) is a homomorphic operation, so the ciphertext C VU The corresponding plaintext vector should be V°U, that is, the vector The i-th element in is equal to the element obtained by multiplying the vector V by the element at the i-th position of the vector U. For example, the vector The 0th element in is equal to the element 0 obtained by multiplying the 0th element 1 of vector V and the 0th element 0 of vector U. The first element of is equal to the first element 0 of vector V multiplied by the first element 1 of vector U. The second element of is equal to the element 2 obtained by multiplying the second element 1 of vector V by the second element 2 of vector U, and so on.

[0088] In step S270, the second party P1 processes the ciphertext C VU Perform homomorphic operations to obtain the ciphertext C containing the inner products of multiple vectors V·U .

[0089] Since the inner product needs to add the products of multiple elements of the vector, the second party P1 can VU Perform rotation and addition operations to obtain the ciphertext C containing the inner product of the vector V·U These homomorphic operations are equivalent to: VU The corresponding plaintext elements are circularly shifted to the left and then added to the initial plaintext vector. i ,u i ) in each group (v i ,u i ), for the ciphertext C VU The corresponding plaintext elements are circularly shifted left to convert (v i ,u i ) are aligned to the same position, and the vector after circular left shift is added to the initial plaintext vector so that (v i ,u i ) is added together to get v i ﹒ i .

[0090] Specifically, assuming that each vector vi and u i The length L = 2 r , then for the ciphertext C VU The ciphertext C can be obtained through the following cycle V·U :

[0091] Initially let ct′←C VU , ct * ←C VU

[0092] Then, the following steps a) and b) can be repeated for i=0 to r-1 multiple times:

[0093] a)ct * ←Rot(ct′,N / 2 i+2 )

[0094] b)ct′←Add(ct * ,ct′)

[0095] After the cycle ends, the obtained ct′ is the ciphertext C V·U .

[0096] For example, refer to Figure 4 , r = 2, N = 32, then:

[0097] At i=0, first execute the above step a), This rotation homomorphic operation is performed on the ciphertext C VU After conversion, the ciphertext ct is obtained * The corresponding plaintext vector is the ciphertext C VU The corresponding vector The vector obtained by circular left shift 8 bits. Here, circular left shift 8 bits means that the vector like Figure 4 The horizontal arrangement shown is a sequence that is shifted to the left by 8 positions as a whole, wherein the 8 positions on the left are shifted to the 8 positions on the right after the left shift, thereby obtaining

[0098] ct * The corresponding plaintext vector = (0 0 0 0 1 0 0 2 0 0 2 2 4 0 0 0)

[0099] Then execute step b), ct′←Add(ct * ,ct′), and get the plaintext vector corresponding to ct′ = C VU +ct * =(0 02 2 5 0 0 2 0 0 2 2 5 0 0 2).

[0100] Among them, in the vector In , taking v0 and u0 as examples, when v0 and u0 are represented as a horizontally arranged sequence (where the smaller number of rows of the vector is arranged at the left end of the sequence, and the 0th row of the vector is arranged at the 0th position at the leftmost end of the sequence), the product of the first element from the left of v0 and u0 is arranged in The product of the 4th bit of v0 and the 2nd bit of u0 from the left is arranged in The product of the 8th bit of v0 and the 3rd bit from the left of u0 is arranged in The 12th position, therefore, will The vector obtained after circular left shift 8 bits is Addition is equivalent to adding the product of the second element from the left of v0 and u0 and the product of the 0th element from the left of v0 and u0, and placing the result of the addition at the 0th and 8th bits in the plaintext vector corresponding to ct′, and adding the product of the third element from the left of v0 and u0 and the product of the first element from the left of v0 and u0, and placing the result of the addition at the 4th and 12th bits in the plaintext vector corresponding to ct′. For other pairs of v i and u i , the above rotation and addition homomorphic operations play the same role as v0 and u0. For example, for v1 and u1, The vector obtained after circular left shift is Addition is equivalent to adding the product of the second element from the left of v1 and u1 and the product of the 0th element from the left of v1 and u1, and placing the result of the addition at the 1st and 9th bits in the plaintext vector corresponding to ct′, and adding the product of the third element from the left of v1 and u1 and the product of the first element from the left of v1 and u1, and placing the result of the addition at the 5th and 13th bits in the plaintext vector corresponding to ct′, and so on.

[0101] When i=1, execute step a), This homomorphic operation transforms the ciphertext ct′ obtained in step a) to obtain the updated ciphertext ct * The corresponding plaintext vector is the vector obtained by cyclically shifting the vector corresponding to the ciphertext ct′ to the left by 4 bits, thus obtaining:

[0102] ct * The corresponding plaintext vector = (5 0 0 2 0 0 2 2 5 0 0 2 0 0 2 2)

[0103] Then execute step b), ct′←Add(ct * ,ct′), we get

[0104] The plaintext vector corresponding to ct′ = (5 0 2 4 5 0 2 4 5 0 2 4 5 0 2 4)

[0105] At this point the cycle ends, and the obtained ct′ is the ciphertext C V·U Taking v0 and u0 as an example, here we add the vector corresponding to ct′ obtained by cyclically shifting the vector corresponding to ct′ obtained in the previous cycle by 4 bits to the vector corresponding to ct′, which is equivalent to multiplying the 4-bit elements of v0 and u0 (that is, v 00 u 00 、v 01 u 01 、v 02 u 02 and v 03 u 03 ) add them together to get v 00 u 00 +v 01 u 01 +v 02 u 02 +v 03 u 03 , and place the added results at the 0th, 4th, 8th, and 12th positions in the plaintext vector corresponding to the updated ct′. i and u i , the above rotation and addition homomorphic operations play the same role as v0 and u0. For example, for v1 and u1, it is equivalent to adding the product of the 4-bit elements of v1 and u1, and placing the result of the addition at the 1st, 5th, 9th, 13th bits in the plaintext vector corresponding to the updated ct′, and so on.

[0106] Therefore, from the above derivation, we can get that the ciphertext C V·U The corresponding plaintext vector has the 0th, 4th, 8th, and 12th bits as the values ​​of v0·u0, and the ciphertext C V·U The first, fifth, ninth, and thirteenth bits of the corresponding plaintext vector are the values ​​of v1·u1, and the ciphertext C V·U The corresponding plaintext vector has the 2nd, 6th, 10th, and 14th bits as the values ​​of v2·u2. The ciphertext C V·U The 3rd, 7th, 11th, and 15th bits of the corresponding plaintext vector are the values ​​of v3·u3. Therefore, the ciphertext C V·U The elements in the corresponding plaintext vector are periodic.

[0107] The second party P1 obtains the ciphertext C V·U Afterwards, for example, if the first party has the private key for homomorphic encryption, the second party P1 can use the ciphertext C V·U Sent to the first party P0, the first party P0 through the ciphertext C V·U Decrypt and get the plaintext vector, then you can get each pair of vectors v from each element of the plaintext vector i and u i The inner product of .

[0108] exist Figure 2 In the method shown, the first party and the second party respectively pack their multiple real vectors into a long vector for homomorphic operation, so that the inner products of multiple pairs of vectors can be calculated at one time. Compared with the prior art, the plaintext space is fully utilized and the amount of ciphertext data that needs to be communicated is reduced. It can be understood that although the above method shows the calculation of the inner product for a group of h pairs of vectors, the present specification is not limited to this. For example, the first party and the second party can divide their respective n vectors into 2nL / N groups of vectors, and calculate the vector inner product for each group of h pairs of vectors by the above method.

[0109] In another embodiment, considering the property that the CKKS algorithm can encrypt complex vectors, that is, each ciphertext can encrypt a complex vector of length N / 2, the imaginary part of the plaintext vector can be further utilized. For example, assuming that vector a = (a0, a1) and vector b = (b0, b1), by expressing vector a as a0+a1*i and vector b as b0–b1*i, the calculation shown in formula (1) can be performed:

[0110] (a0 + a1 * i) * (b0 – b1 * i)=(a0*b0 + a1*b1) + i*(a1*b0 – a0 * b1)(1)

[0111] According to formula (1), the real part of the product of the above two complex numbers is the inner product of vector a and vector b.

[0112] In another way, the vector b can be expressed as b1+b0*i, and the calculation can be performed as shown in formula (2):

[0113] (a0 + a1 * i) * (b1 + b0 * i)=(a0*b1 - a1*b0) + i*(a0*b0 + a1 * b1)(1)

[0114] According to formula (2), the imaginary part of the product of the above two complex numbers is the inner product of vector a and vector b.

[0115] That is to say, the inner product of a vector of length 2 can be calculated by a single complex multiplication. Similarly, to calculate the inner product of a vector of length L, each vector can be converted into a complex vector of half length, where each element of the complex vector is composed of two adjacent elements in the real vector (such as v i,j , v i,j+1 and u i,j ,u i,j+1 ), and then calculate the elements in the same position of each pair of complex vectors according to the above method to obtain v i,j ui,j +v i,j+ 1u i,j+1 , then multiple v i,j u i,j +v i,j+1 u i,j+1 (j∈[1,L / 2]) are added to obtain the inner product v of the vector i ·u i , which reduces both computational and communication overheads by approximately half.

[0116] Figure 5 is a flow chart of a data processing method based on a complex vector in another embodiment of the present specification.

[0117] like Figure 5 As shown, in step S501, the first party P0 sends multiple groups of h vectors v i Merge into a complex vector V i .

[0118] The first party P0 can first transform each vector v based on the following rules: i Convert to complex vector v i ′:

[0119] v i ′=v i,2j +iv i,2j+1 , where j∈[0,L / 2]

[0120] Among them, v i,2j Represents vector v i The elements of the even rows of i,2j+1 Represents vector v i The elements of the odd rows of j∈[0,L / 2] represent the complex vector v i ′ is shortened to L / 2, that is, the real vector v i half the length of . This formula is used to convert the vector v i The even-numbered elements of are placed in the complex vector v i ′, and the real part of the vector v i The odd-numbered elements of are placed in the complex vector v i The imaginary part of ′.

[0121] That is, the vector v i The elements of the even rows (or bits) in the vector form a complex vector with the elements of the adjacent odd rows, so that the vector v i Convert the complex vector v to a length L / 2 i '. After this transformation, for the above polynomial space, h' can be less than or equal to complex vectors v i ′ is a merged vector V i, and the merged vector V can be i That is, by converting real vectors into complex vectors, a ciphertext can encrypt at most the number of complex vectors is the real number vector that can be encrypted at most by a ciphertext in the above text Therefore, both the computational overhead and the communication overhead can be approximately halved.

[0122] The first party P0 can then perform a i ' to merge.

[0123] Specifically, for h′ complex vectors v i ′, similar to the merging of real vectors above, each vector v i The elements of ′ are arranged alternately in the merged vector V i In, making Among them, V ik Represents the merged vector V i The kth element in v s ' t represents the sth vector v among h′ complex vectors i The tth element in ′.

[0124] Figure 6 Schematic diagram of the data processing operation of the first party P0 in the embodiment of this specification. In order to facilitate drawing, it is assumed here that N=16, then the maximum number of complex vectors that can be encrypted by a ciphertext is It can be understood that, in the case of N=32, the maximum number of complex vectors that can be encrypted by a ciphertext should be 8.

[0125] like Figure 6 As shown, for n real vectors v i , the first party P0 can group every 4 real vectors into a group for merging.

[0126] For example, for real vectors v0=(1,2,2,1), v1=(0,2,0,1), v2=(1,0,0,3), v3=(2,0,1,2), the first party P0 first converts each real vector into a complex vector as described above, thereby obtaining the following four complex vectors: v′0=(1+2i,2+1i), v1′=(0+2i,0+1i), v2′=(1+0i,0+3i), v3′=(2+0i,1+2i), and then the elements of each complex vector can be interleaved in the merged vector V0 to obtain the following: Figure 6 The merged vector V0 shown in:

[0127] V0=[1+2i,0+2i,1,2,2+i,0+1i,3i,1+2i]

[0128] Similarly, for real vectors v4=(1,0,2,1), v5=(0,0,0,1), v6=(1,0,1,0), v7=(2,0,1,0), the first party P0 first converts each real vector into a complex vector as described above, thereby obtaining the following four complex vectors:

[0129] v′4=(1,2+1i), v′5=(0,i), v′6=(1,1), v′7=(2,1), and then the elements of each complex vector can be interlaced in the merged vector V1 to obtain Figure 6 The merged vector V1 shown in:

[0130] V1=[1,0,1,2,2+i,i,1,1]

[0131] Assume that, as described above, the first party P0 has n real vectors The second party P1 has n real vectors Each real vector includes L elements (or components). By converting the real vector into a complex vector, the first party P0 can convert n real vectors into complex vectors. Divide groups of complex vectors, and process each group of complex vectors as described above, thereby obtaining multiple merged vectors V corresponding to the multiple groups of real vectors respectively. i ,here

[0132] In step S503, the first party P0 processes the plurality of complex vectors V obtained in step S501. i Perform homomorphic encryption to obtain multiple ciphertexts

[0133] The first party P0 can use the CKKS homomorphic algorithm described above, for example, to i Encryption is performed. As described above, the first party P0 encrypts the complex vector V i When encrypting, first convert the complex vector V i Converted to plaintext polynomial Ecd(V i ), and then use the public key pk to encrypt the plaintext polynomial Ecd(V i ) to obtain the ciphertext corresponding to vector V Among them, the ciphertext It includes two ciphertext polynomials, wherein, for example, for a polynomial space of N=16, each ciphertext polynomial includes 16 terms.

[0134] In one implementation, the first party P0 finally decrypts the ciphertext to obtain the plaintext inner product of each group of vectors. The first party P0 then has the homomorphic encryption private key sk and public key pk. The first party P0 uses the public key pk to decrypt the vector V i Perform homomorphic encryption.

[0135] In another embodiment, the second party P1 finally decrypts the ciphertext to obtain the plaintext inner product. The second party P1 has the homomorphically encrypted private key sk and public key pk. The first party P0 can obtain the public key pk from the second party P1 and use the public key pk to decrypt the vector V i Perform homomorphic encryption.

[0136] For example, Figure 6 As shown in Figure 6 The first party P0 performs homomorphic encryption on the two sets of vectors v0~v3 and v4~v7 shown in the figure, respectively, to obtain and

[0137] In step S505, the first party P0 sends multiple ciphertexts Sent to the second party P1.

[0138] In step S507, the second party P1 converts the even number of vectors u i Merge them into complex vector U 2j , the odd number of vectors u i Merge them into complex vector U 2j+1 .

[0139] Specifically, the second party P1 may first The number of n vectors u i Divide into multiple groups, and then the vectors u of the even group can be divided into i Convert to complex vector u i ′:

[0140] u i ′=u i,2j -iu i,2j+1 , where j∈[0,L / 2] (3)

[0141] Among them, u i,2j Represents vector u i The elements of the even rows of i,2j+1 Represents vector u i The elements of the odd rows of j∈[0,L / 2] represent the complex vector u i The length of ′ is shortened to L / 2. Formula (3) is used to convert the vector u i The even-numbered elements of are placed in the complex vector u i ′, and the real part of the vector ui The inverses of the odd-numbered elements of are placed in the complex vector u i The imaginary part of ′.

[0142] That is, the vector u i The elements of the even rows (or bits) in the vector and the elements of the adjacent odd rows form a complex vector, so that the vector u i Convert the complex vector u of length L / 2 i ′.

[0143] Then, the second party P1 can convert each vector u of the odd array into i Convert to complex vector u i ′:

[0144] u i ′=u i,2j+1 +iu i,2j , where j∈[0,L / 2] (4)

[0145] Among them, u i,2j Represents vector u i The elements of the even rows of i,2j+1 Represents vector u i The elements of the odd rows of , formula (4) is used to convert the vector u i The elements in the odd positions of are placed in the complex vector u i ′, and the real part of the vector u i The even-numbered elements of are placed in the complex vector u i The imaginary part of ′.

[0146] In this embodiment of the specification, the vector u of the dual array is i and the vector u of the odd number i Formula (3) and formula (4) are used for conversion respectively. According to the above formulas (1) and (2), through homomorphic operation on the ciphertext, the real part and imaginary part of the plaintext vector corresponding to the final ciphertext include the inner product of each pair of vectors, thereby further improving the utilization rate of the ciphertext and reducing the amount of communication data.

[0147] Understandably, Figure 6 As shown, the vector u i The method of converting to a complex vector is only exemplary and is not intended to limit the scope of the embodiments of this specification. For example, the second party P1 may also convert each vector u i All are converted using formula (3), or each vector u i Both use formula (4) for conversion. According to the above formulas (1) and (2), both methods can be used to calculate the vector inner product.

[0148] The second party P1 can then perform a i ' to merge.

[0149] Specifically, for h′ complex vectors u i ′, similar to the merging of real vectors above, each vector u i The elements of ′ are arranged alternately in the merged vector U i In, making Among them, U ik Represents the merge vector U i The kth element in st represents the sth vector u among h′ complex vectors i The tth element in ′.

[0150] Figure 7 Schematic diagram of data processing operation of vectors of the second side P1 dual array in the embodiment of this specification. For the convenience of drawing, here N = 16, then the maximum number of complex vectors that can be encrypted by a ciphertext is

[0151] like Figure 7 As shown, for example, for real vectors u0 = (0, 2, 0, 1), u1 = (1, 0, 0, 0), u2 = (2, 1, 2, 0), u3 = (1, 1, 0, 1), the second party P1 first converts each real vector into a complex vector as shown in formula (3), thereby obtaining the following four complex vectors: u′0 = (0-2i, 0-1i), u′1 = (1-0i, 0), u′2 = (2-1i, 2-0i), u′3 = (1-i, 0-i), and then the elements of each complex vector can be interlaced in the merged vector U0 to obtain the following: Figure 7 The merged vector U0 shown in:

[0152] U0=[-2i,1,2-i,1-i,-i,0,2,-i]

[0153] Figure 8 Schematic diagram of the data processing operation of the second party P1 on the vector of the odd group in the embodiment of this specification. Here, similarly, N=16, then the maximum number of complex vectors that can be encrypted by a ciphertext is

[0154] like Figure 8As shown, for example, for real vectors u4 = (1, 0, 0, 2), u5 = (2, 1, 0, 1), u6 = (1, 0, 0, 3), u7 = (0, 1, 1, 1), the second party P1 first converts each real vector into a complex vector as shown in formula (4), thereby obtaining the following four complex vectors: u′4 = (0 + i, 2), u′5 = (1 + 2i, 1), u′6 = (i, 3), u′7 = (1, 1 + i), and then the elements of each complex vector can be arranged alternately in the merged vector U1, obtaining the following Figure 8 The merged vector U1 shown in:

[0155] U1=[i,1+2i,i,1,2,1,3,1+i]

[0156] The second party P1 can convert n real vectors Divide groups of real vectors, and each group of real vectors is divided into an even group and an odd group as described above and processed separately, so as to obtain multiple merged vectors U corresponding to the multiple groups of real vectors respectively 2j and U 2j+1 , where, when k is an even number, j=k / 2, and when k is an odd number, j=(k+1) / 2.

[0157] In step S509, the second party P1 converts each vector U 2j and vector U 2j+1 Convert to plaintext polynomial Ecd(U 2j ) and Ecd(U 2j+1 ).

[0158] That is, each vector U 2j and vector U 2j+1 Converted to a polynomial Ecd(U 2j ) and Ecd(U 2j+1 ), where the polynomial Ecd(U 2j ) / Ecd(U 2j+1 ) can be encoded by FFT based on the vector U 2j and vector U 2j+1 The individual elements of are calculated.

[0159] Understandably, Figure 5 Step S507 and step S509 in the process may be executed before step S505 or after step S505, and there is no limitation on this.

[0160] In step S511, the second party P1 calculates the ciphertext With the plaintext polynomial Ecd(U 2j ) to get the ciphertext Calculate ciphertext With the plaintext polynomial Ecd(U 2j+1 ) to get the ciphertext

[0161] Among them, the ciphertext Multiple ciphertexts arranged in sequence The ciphertext of the even-numbered items in , such as the one calculated above Ciphertext Multiple ciphertexts arranged in sequence The ciphertext of the odd-numbered items in , such as the one calculated above

[0162] The second party P1 calculates the ciphertext With the plaintext polynomial Ecd(U 2j ) to get the ciphertext For example, Figure 7 As shown, the ciphertext is calculated The product of Ecd(U0) is Multiplication with Ecd(U0) is a homomorphic operation, so, The corresponding plaintext is That is, vector The i-th element in is equal to the element obtained by multiplying the vector V0 by the element at the i-th position of the vector U0. For example, the vector The 0th element in is equal to the element 4-2i obtained by multiplying the 0th element 1+2i of vector V0 and the 0th element -2i of vector U0. The first element in is equal to the element 2i obtained by multiplying the first element 2i of vector V0 by the first element 1 of vector U0. The second element in is equal to the element 2-i obtained by multiplying the second element 1 of vector V0 by the second element 2-i of vector U0, and so on. Therefore, the ciphertext The corresponding plain text should be Figure 7 It can be understood that here, the second party P1 obtains the ciphertext by performing homomorphic operations on the ciphertext It cannot know the plaintext vector V0, so it cannot know the ciphertext The corresponding plaintext vector.

[0163] The second party P1 also calculates the ciphertext With the plaintext polynomial Ecd(U 2j+1 ) to get the ciphertext For example, Figure 8 As shown, the ciphertext is calculated The product of Ecd(U1) and Multiplication with Ecd(U1) is a homomorphic operation, so, The corresponding plaintext vector is Among them, the vector The i-th element in is equal to the element obtained by multiplying the vector V1 with the element at the i-th position of the vector U1. Therefore, the ciphertext calculated by the second party P1 is The corresponding plain text should be Figure 8 [i,0,i,2,4+2i,i,3,1+i] as shown in .

[0164] In step S513, the second party P1 sends the adjacent ciphertext and ciphertext Add the sum and the conjugate of its difference to get the ciphertext

[0165] Specifically, the second party P1 takes every two adjacent ciphertexts and ciphertext The conversion can be performed as shown in formula (5):

[0166]

[0167] Fig. 9 In the embodiment of this specification, the adjacent ciphertext and ciphertext Schematic diagram of performing homomorphic operations. Fig. 9 As shown, in ciphertext and ciphertext As adjacent ciphertext and ciphertext For example,

[0168] The corresponding plaintext vector is the vector With vector The vector obtained by adding is Fig. 9 As shown in:

[0169] [4-i,2i,2,4-2i,5,i,3+6i,3]

[0170] The corresponding plaintext vector is the vector With vector After subtraction, the conjugate vector is Fig. 9 As shown in:

[0171] [4+3i,-2i,2+2i,2i,-3+4i,i,-3-6i,1+2i]

[0172] thereby, The corresponding plaintext is the vector obtained by adding the above two vectors:

[0173] [8+2i,0,4+2i,4,2+4i,2i,0,4+2i]

[0174] In step S515, the second party P1 checks the ciphertext Perform homomorphic operations of rotation and addition to obtain the ciphertext C′ containing the inner products of multiple vectors v·u .

[0175] Among them, formula (6) can be derived from the above formula (5):

[0176]

[0177] From formula (6), we can conclude that The real part of the corresponding plaintext vector is The corresponding plaintext vector is twice the real part, The imaginary part of the corresponding plaintext vector is The imaginary part of the corresponding plaintext vector is twice. Referring to formula (1), we can get: The real part of the corresponding plaintext vector is

[0178] v i,2t u i,2t +v i,2t+1 u i,2t+1 (t∈[1,L / 2]), referring to formula (2), we can get The imaginary part of the corresponding plaintext vector is v i,2t u i,2t +v i,2t+1 u i,2t+1 (t∈[1,L / 2]), so we can Perform a homomorphic operation on The corresponding plaintext vectors are rotated and added so that the resulting ciphertext C′ v·u The real part of the corresponding plaintext vector includes the inner product of each vector of the even array, and the imaginary part includes the inner product of each vector of the odd array.

[0179] Specifically, assuming that each vector v i and u i The length of L / 2 = 2 r , then for the ciphertext The ciphertext C′ can be obtained through the following cycle v·u :

[0180] Initial Order

[0181] Then, the following steps a) and b) can be repeated for i=0 to r-1 multiple times:

[0182] a)ct* ←Rot(ct′,N / 2 i+2 )

[0183] b)ct′←Add(ct * ,ct′)

[0184] After the cycle ends, the obtained ct′ is the ciphertext C′ v·u .

[0185] For example, refer to Fig. 9 , r=1,N=16, then:

[0186] i=0, first execute the above step a), This rotation homomorphic operation is performed on the ciphertext (Right now ) is converted to obtain the ciphertext ct * The corresponding plaintext vector is the ciphertext The corresponding vector is circularly shifted left by 4 bits. Here, the circular left shift of 4 bits means that the vector is shifted left by 4 bits as a whole after being arranged horizontally into a sequence. Among them, the 4 bits on the left are shifted to the 4 positions on the right after being left shifted, so as to obtain

[0187] The plaintext vector corresponding to ct* = [2+4i,2i,0,4+2i,8+2i,0,4+2i,4]

[0188] refer to Fig. 9 As shown and described above The real part of the 0th term of the corresponding plaintext vector is 2(v 00 u 00 +v 01 u 01 ), the imaginary part is 2(v 40 u 40 +v 41 u 41 ), the real part of the fourth term is 2(v 02 u 02 +v 03 u 03 ), the imaginary part is 2(v 42 u 42 +v 43 u 43 ), through the above cycle operation, the ciphertext The corresponding vector is circularly shifted left by 4 bits, that is, the obtained ct * The real part of the 0th term in the corresponding plaintext vector is 2(v 02 u 02 +v 03 u 03 ), the imaginary part is 2(v 42 u 42 +v43 u 43 ), thus The corresponding plaintext vector item 0 is aligned, that is, the element product of vectors v0 and u0 is aligned to the real part of item 0, and the element product of vectors v4 and u4 is aligned to the imaginary part of item 0. Similarly, through the above rotation operation, the element product of vectors v1 and u1 is also aligned to the real part of item 1, the element product of vectors v5 and u5 is aligned to the imaginary part of item 1, the element product of vectors v2 and u2 is aligned to the real part of item 2, the element product of vectors v6 and u6 is aligned to the imaginary part of item 2, the element product of vectors v3 and u3 is aligned to the real part of item 3, and the element product of vectors v7 and u7 is aligned to the imaginary part of item 3.

[0189] Then execute step b), ct′←Add(ct * ,ct′), the plaintext vector corresponding to ct′ is:

[0190] [8+2i,0,4+2i,4,2+4i,2i,0,4+2i]+[2+4i,2i,0,4+2i,8+2i,0,4+2i,4]

[0191] =[10+6i,2i,4+2i,8+2i,10+6i,2i,4+2i,8+2i]

[0192] The plaintext vector is divided by 2 to get [5+3i,i,2+i,4+i,5+3i,i,2+i,4+i]. After the above steps for each pair v i and u i After aligning the position of the product of the elements, ct * Added to the initial ct′, that is, corresponding to the v of each pair of vectors i and u i All the element products of are added together, so the real and imaginary parts of each element in the updated ct′ correspond to the inner products of each pair of vectors. Specifically, reference Fig. 9 As shown in , the real part 5 of the 0th element 5+3i of the vector is the value of v0·u0, and the imaginary part 3i is the value of v4·u4. The real part 0 of the 1st element i is the value of v1·u1, and the imaginary part i is the value of v5·u5. The real part 2 of the 2nd element 2+i is the value of v2·u2, and the imaginary part i is the value of v6·u6. The real part 4 of the 3rd element 4+i is the value of v3·u3, and the imaginary part i is the value of v7·u7. The 4th to 7th elements of the vector are the same as the 0th to 3rd elements, that is, the vector is a periodic vector.

[0193] In step S517, the second party P1 uses the ciphertext C′ v·u The periodicity of the coefficients of the corresponding plaintext polynomial converts multiple ciphertexts C′v·u Merge into a ciphertext C″ v·u .

[0194] As mentioned above, the ciphertext C′ v·u The corresponding plaintext vector F has periodicity, specifically, with a period of N / L. Therefore, according to the FFT encoding algorithm, the coefficients of the plaintext polynomial corresponding to the plaintext vector F are: there is a non-zero coefficient every N / L terms, and the coefficients of other terms are zero. For example, in the case of N=16, L=4, Ecd(F)=a0+a4x 4 +a8x 8 +a 12 x 12 , that is, only the constant term, x 4 Item, x 8 Item, x 12 The coefficients of the terms are non-zero, and the coefficients of the other terms are zero.

[0195] In this case, when h ciphertexts C′ are calculated v·u In the case of h≤N / L, since each ciphertext C′ v·u The coefficients of the corresponding plaintext polynomials have the same periodicity, so the h ciphertexts C′ can be v·u Perform homomorphic operations and pack h ciphertexts into one ciphertext to make full use of the coefficients of the plaintext polynomial.

[0196] Specifically, the multiple ciphertexts C′ v·u Respectively represented as ct0, ct1, ... ct h-1 , then the packed ciphertext C′ can be calculated v ' ·u :

[0197]

[0198] That is to say, by using different ct j Multiply by x j , which is equivalent to converting the ct j The coefficients of the corresponding plaintext polynomial are shifted by j terms, so that C′ v ' ·u In the corresponding plaintext polynomial Ecd(H), each ct j The coefficients of the corresponding plaintext polynomials are interleaved, so that C′ v ' ·u The corresponding plaintext polynomial Ecd(H) obtains each ct j The coefficients of the corresponding plaintext polynomial.

[0199] For example, assuming that h = N / L = 4 as described above, then C′ v ' ·u=ct0+ct1·x+ct2·x 2 +ct3·x 3

[0200] According to this calculation method, the coefficient of the plaintext polynomial corresponding to ct0 is equivalent to the ciphertext C′ v ' ·u The corresponding plaintext polynomial Ecd(H) x 0 、x 4 、x 8 and x 12 The coefficients of the plaintext polynomial corresponding to ct1 are in the ciphertext C′ v ' ·u The corresponding plaintext polynomial Ecd(H) x, x 5 、x 9 , and x 13 The coefficients of the plaintext polynomial corresponding to ct2 are in the ciphertext C′ v ' ·u The corresponding plaintext polynomial Ecd(H) x 2 、x 6 、x 10 and x 14 , the coefficients of the plaintext polynomial corresponding to ct3 are in the ciphertext C′ v ' ·u The corresponding plaintext polynomial Ecd(H) x 3 、x 7 、x 11 and x 15 .

[0201] In step S519, the second party P1 sends the ciphertext C″ to the first party P0 v·u .

[0202] The second party P1 converts h ciphertexts C′ into v·u Packaged into C″ v·u Sending h ciphertexts C′ to the first party P0 together is better than sending v·u Sent to the first party P0, greatly reducing the amount of communication data.

[0203] In step S521, the first party P0 performs a cryptographic operation on the ciphertext C″ v·u Decryption, get the plaintext polynomial, and divide the plaintext polynomial into multiple ciphertexts C′ based on the preset rules v·u A plurality of plaintext polynomials corresponding to each other are respectively obtained, a plurality of vectors are obtained based on the plurality of plaintext polynomials, and an inner product of each group of vectors is obtained from the plurality of vectors.

[0204] In this scenario, assuming that the first party P0 has the homomorphic encryption private key sk, the first party P0 can use the private key sk to encrypt the ciphertext C″ v·u Decrypt and get the ciphertext C″ v·uThe corresponding plaintext polynomial. As mentioned above, the ciphertext C″ v·u The corresponding plaintext polynomial Ecd(H) includes each ciphertext C′ v·u The coefficients of the corresponding plaintext polynomial, the first party P0 can pack the ciphertext C′ according to the above v·u According to the rules, each ciphertext C′ is extracted from the plaintext polynomial Ecd(H) v·u The corresponding plaintext polynomial Ecd(F) is decoded to obtain each plaintext vector F, so that Fig. 9 As shown, the inner product v of each pair of vectors is obtained from each element of the plaintext vector F. i ·u i .

[0205] In the 1990s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the method flow). However, with the development of technology, many improvements to the method flow today can be regarded as direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0206] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0207] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, the present application does not exclude that with the development of computer technology in the future, the computer that implements the functions of the above embodiments may be, for example, a personal computer, a laptop computer, a vehicle-mounted human-computer interaction device, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0208] Although one or more embodiments of the present specification provide method operation steps as described in the embodiments or flow charts, more or less operation steps may be included based on conventional or non-creative means. The order of steps listed in the embodiments is only one way of executing the order of many steps, and does not represent the only execution order. When the device or terminal product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiments or the drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The term "include", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or equipment including a series of elements includes not only those elements, but also includes other elements that are not explicitly listed, or also includes elements inherent to such a process, method, product or equipment. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or equipment including the elements. For example, if the words first, second, etc. are used to represent the name, they do not represent any specific order.

[0209] For the convenience of description, the above devices are described in various modules according to their functions. Of course, when implementing one or more of the present specification, the functions of each module can be implemented in the same or more software and / or hardware, or the module implementing the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0210] The present invention is described with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0211] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0212] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0213] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0214] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0215] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage, graphene storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0216] It should be understood by those skilled in the art that one or more embodiments of the present specification may be provided as a method, system or computer program product. Therefore, one or more embodiments of the present specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, one or more embodiments of the present specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0217] One or more embodiments of the present specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. One or more embodiments of the present specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0218] Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. In the description of this specification, the description of the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of this specification. In this specification, the schematic representation of the above terms does not necessarily target the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples without contradiction.

[0219] The above description is only an example of one or more embodiments of the present specification and is not intended to limit one or more embodiments of the present specification. For those skilled in the art, one or more embodiments of the present specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification shall be included in the scope of the claims.

Claims

1. A privacy-preserving multi-party data processing method, wherein the multi-party comprises a first party and a second party, wherein the first party has h first real number vectors arranged in sequence, and the second party has h second real number vectors arranged in sequence, in, The first real number vector and the second real number vector of the same order are a group of real number vectors whose inner product is to be calculated, and the method includes: The first party performs the following steps: Merge the h first real number vectors into a first merged vector, wherein h corresponds to N / L, each group of h components at the same position in the h first real number vectors are arranged continuously in the first merged vector, N is the number of terms of a polynomial in a preset polynomial space, and the first real number vector and the second real number vector include L components; Performing homomorphic encryption on the first merged vector to obtain a first ciphertext, where the first ciphertext includes a polynomial in the polynomial space; sending the first ciphertext to the second party; The second party performs the following steps: Merge the h second real number vectors into a second merged vector, wherein each group of h components at the same position in the h second real number vectors are arranged continuously in the second merged vector; Convert the second merged vector into a second plaintext polynomial, where the second plaintext polynomial includes N terms; Calculate the product of the first ciphertext and the second plaintext polynomial to obtain a second ciphertext; A homomorphic operation is performed on the second ciphertext to obtain a third ciphertext, wherein multiple components of a plaintext vector corresponding to the third ciphertext include inner products of each group of real number vectors in the h groups of real number vectors.

2. The method according to claim 1, wherein the h first real number vectors are merged into a first merged vector. include: Convert the h first real vectors into h first complex vectors, wherein, for each first real vector, every two first components starting from the 0th component constitute a second component of the first complex vector, and for every two first components, the first component at an even position in the first real vector is used as the real part of the second component, and the first component at an odd position in the first real vector is used as the imaginary part of the second component; The h first complex vectors are merged into the first merged vector, wherein adjacent components in each first complex vector are spaced apart from each other by N / L components in the first merged vector.

3. The method according to claim 2, wherein the h second real number vectors are combined into a second combined vector. include: The h second real number vectors are converted into h second complex number vectors, wherein, for each second real number vector, every two third components starting from the 0th component constitute a fourth component of the second complex number vector, and for the every two third components, the third components at even positions in the second real number vector are used as the real part of the fourth component, and the opposite number corresponding to the third components at odd positions in the second real number vector is used as the imaginary part of the fourth component.

4. The method according to claim 3, wherein the first party has n groups of h first real number vectors arranged in sequence, the second party has n groups of h second real number vectors arranged in sequence, and the h second real number vectors are merged into a second merged vector. include: For each even-group second real vector starting from the 0th group, convert the h second real vectors into h second complex vectors; For each odd-numbered group of second real vectors starting from the 1st group, the h second real vectors are converted into h third complex vectors, wherein, for each second real vector, every two fifth components starting from the 0th component constitute a sixth component of the third complex vector, and for the every two fifth components, the fifth component at an even position in the second real vector is used as the imaginary part of the sixth component, and the fifth component at an odd position in the second real vector is used as the real part of the sixth component.

5. The method according to claim 4, wherein the second ciphertext is subjected to homomorphic operation to obtain a third ciphertext, include: For the second ciphertexts corresponding to the adjacent even group h of the second complex vectors and the second ciphertexts corresponding to the odd group h of the third complex vectors, the two second ciphertexts are added to obtain a fourth ciphertext, the two ciphertexts are subtracted and conjugated to obtain a fifth ciphertext, the fourth ciphertext and the fifth ciphertext are added to obtain a sixth ciphertext, and the sixth ciphertext is subjected to rotation and addition homomorphic operations based on L to obtain a seventh ciphertext, and the real parts and imaginary parts of multiple components of the plaintext vector corresponding to the seventh ciphertext include the inner products of each group of real vectors.

6. The method according to claim 5, wherein the seventh ciphertext is obtained by performing a homomorphic operation of rotation and addition based on the sixth ciphertext and L, include: Performing a rotation operation on the sixth ciphertext so that each component in the plaintext vector corresponding to the sixth ciphertext is cyclically moved as a whole by an integer multiple of N / L, thereby obtaining an eighth ciphertext; The eighth ciphertext is added to the sixth ciphertext to obtain a ninth ciphertext, and the seventh ciphertext is obtained based on the ninth ciphertext.

7. The method according to claim 6, wherein the powers of x corresponding to the coefficients of adjacent non-zero terms in the plaintext polynomial corresponding to the seventh ciphertext differ by N / L, and the method further include: The second party merges at most N / L seventh ciphertexts into a tenth ciphertext based on a preset merging rule, so that coefficients in the plaintext polynomials corresponding to the seventh ciphertexts are located at different positions in the plaintext polynomial corresponding to the tenth ciphertext; sending the tenth ciphertext to the first party; The first party decrypts the tenth ciphertext to obtain a third plaintext polynomial, splits the third plaintext polynomial into at most N / L fourth plaintext polynomials corresponding to the at most N / L seventh ciphertexts based on the merging rule, converts the at most N / L fourth plaintext polynomials into at most N / L complex vectors, and obtains the inner product of each group of real vectors from the at most N / L complex vectors.

8. A privacy-preserving multi-party data processing method, wherein the multi-party comprises a first party and a second party, wherein the first party has h first real number vectors arranged in sequence, and the second party has h second real number vectors arranged in sequence, in, The first real number vector and the second real number vector of the same order are a group of real number vectors whose inner product is to be calculated, and the method is performed by the first party, including: Merge the h first real number vectors into a first merged vector, wherein h corresponds to N / L, each group of h components at the same position in the h first real number vectors are arranged continuously in the first merged vector, N is the number of terms of a polynomial in a preset polynomial space, and the first real number vector and the second real number vector include L components; Performing homomorphic encryption on the first merged vector to obtain a first ciphertext, where the first ciphertext includes a polynomial in the polynomial space; The first ciphertext is sent to the second party.

9. A privacy-preserving multi-party data processing method, wherein the multi-party comprises a first party and a second party, wherein the first party has h first real number vectors arranged in sequence, and the second party has h second real number vectors arranged in sequence, in, The first real number vector and the second real number vector of the same order are a group of real number vectors whose inner product is to be calculated, and the method is performed by the second party, including: receiving a first ciphertext from the first party, wherein the first ciphertext is a homomorphic ciphertext of a first merged vector, wherein the first merged vector is obtained by merging the h first real number vectors, wherein h corresponds to N / L, each group of h components at the same position in the h first real number vectors are arranged continuously in the first merged vector, N is the number of terms of a polynomial in a preset polynomial space, and the first real number vector and the second real number vector include L components; Merge the h second real number vectors into a second merged vector, wherein each group of h components at the same position in the h second real number vectors are arranged continuously in the second merged vector; Convert the second merged vector into a second plaintext polynomial, where the second plaintext polynomial includes N terms; Calculate the product of the first ciphertext and the second plaintext polynomial to obtain a second ciphertext; A homomorphic operation is performed on the second ciphertext to obtain a third ciphertext, wherein multiple components of a plaintext vector corresponding to the third ciphertext include inner products of each group of real number vectors in the h groups of real number vectors.

10. A computing device comprising a memory and a processor, wherein the memory stores executable codes, and when the processor executes the executable codes, the method according to any one of claims 1 to 9 is implemented.

Images