A method and computing device for privacy-preserving multi-party data processing

Abstract

A privacy-preserving multi-party data processing method and computing device, the method comprising: a first party merging h first real number vectors into a first merged vector; performing homomorphic encryption on the first merged vector to obtain a first ciphertext; sending the first ciphertext to a second party; the second party merging h second real number vectors into a second merged vector; converting the second merged vector into a second plaintext polynomial; calculating the product of the first ciphertext and the second plaintext polynomial to obtain a second ciphertext; performing homomorphic operations on the second ciphertext to obtain a third ciphertext, wherein the components of the plaintext vector corresponding to the third ciphertext include the inner product of each of the h groups of real number vectors.

Description

Technical Field

[0001] The embodiments in this specification pertain to the field of data processing, and particularly relate to a method and computing device for multi-party data processing that protects privacy. Background Technology

[0002] In privacy-preserving multi-party computation scenarios, two parties often need to jointly compute the inner product of their vectors without revealing their individual vector information. Specifically, suppose there are two parties, P0 and P1, each holding a vector set. In this system, each vector has a length of L, and n is typically a value ranging from hundreds to tens of thousands, with L being, for example, 16. P0 and P1 need to calculate the inner product of these vectors using a secure method. (The symbols <·,·> represent the dot product of vectors, and the dot product between vectors will also be used in the following text.) When the calculation result is obtained, for example, from P0, it must satisfy the following condition: P0 can only obtain the dot product result, and cannot obtain any result other than the dot product with respect to u. i Given the information, P1 cannot obtain the vector v about P0. i Any information.

[0003] One technical solution utilizes homomorphic encryption to address the aforementioned problems. For example, the Paillier homomorphic encryption algorithm can be used. First, P0 encrypts its own vectors. Since each vector contains L integers, each vector is encrypted into L ciphertexts. P0 has n vectors, therefore nL ciphertexts need to be transmitted to P1. After receiving the ciphertexts, P1 performs a multiplication operation by multiplying the ciphertexts by the plaintexts, and then performs ciphertext addition to obtain the inner product result, resulting in n ciphertexts. Finally, these n ciphertexts are returned to P0, who decrypts them to obtain the final inner product result. However, using Paillier (and similar) homomorphic encryption schemes results in large ciphertext sizes, leading to significant communication and computational overhead. Summary of the Invention

[0004] The purpose of this invention is to provide a privacy-preserving multi-party data processing method that enables two participating parties to obtain the inner product of multiple sets of vectors in batches with reduced computational and communication data volume.

[0005] This specification provides a privacy-preserving method for processing multi-party data, wherein the multi-party includes a first party and a second party, the first party having h sequentially arranged first real vectors, and the second party having h sequentially arranged second real vectors, wherein the first and second real vectors of the same order are a set of real vectors for calculating an inner product, and the method includes:

[0006] The first party performs the following steps:

[0007] The h first real number vectors are merged into a first merged vector, where h corresponds to N / L, the h components at the same position in each of the h first real number vectors are arranged consecutively in the first merged vector, N is the number of terms of the polynomial in the preset polynomial space, and the first real number vector and the second real number vector include L components;

[0008] Homomorphic encryption is performed on the first merged vector to obtain the first ciphertext, which includes polynomials in the polynomial space.

[0009] Send the first ciphertext to the second party;

[0010] The second party performs the following steps:

[0011] The h second real vectors are merged into a second merged vector, wherein the h components at the same position in each of the h second real vectors are arranged consecutively in the second merged vector;

[0012] The second merged vector is converted into a second plaintext polynomial, which includes N terms;

[0013] Calculate the product of the first ciphertext and the second plaintext polynomial to obtain the second ciphertext;

[0014] A homomorphic operation is performed on the second ciphertext to obtain the third ciphertext. The multiple components of the plaintext vector corresponding to the third ciphertext include the inner product of each of the h groups of real vectors.

[0015] A second aspect of this specification provides a privacy-preserving multi-party data processing method, wherein the multi-party includes a first party and a second party, the first party having h sequentially arranged first real vectors, and the second party having h sequentially arranged second real vectors, wherein the first and second real vectors of the same order are a set of real vectors for which an inner product is to be calculated, and the method is executed by the first party, including:

[0016] The h first real number vectors are merged into a first merged vector, where h corresponds to N / L, the h components at the same position in each of the h first real number vectors are arranged consecutively in the first merged vector, N is the number of terms of the polynomial in the preset polynomial space, and the first real number vector and the second real number vector include L components;

[0017] Homomorphic encryption is performed on the first merged vector to obtain the first ciphertext, which includes polynomials in the polynomial space.

[0018] The first ciphertext is sent to the second party.

[0019] A third aspect of this specification provides a privacy-preserving multi-party data processing method, wherein the multi-party includes a first party and a second party, the first party having h sequentially arranged first real vectors, and the second party having h sequentially arranged second real vectors, wherein the first and second real vectors of the same order are a set of real vectors for which the inner product is to be calculated, and the method is executed by the second party, including:

[0020] The first ciphertext is received from the first party. The first ciphertext is a homomorphic ciphertext of the first merge vector. The first merge vector is obtained by merging the h first real vectors, where h corresponds to N / L. The h components at the same position in each group of the h first real vectors are arranged consecutively in the first merge vector. N is the number of terms in the polynomial in the preset polynomial space. The first real vector and the second real vector include L components.

[0021] The h second real vectors are merged into a second merged vector, wherein the h components at the same position in each of the h second real vectors are arranged consecutively in the second merged vector;

[0022] The second merged vector is converted into a second plaintext polynomial, which includes N terms;

[0023] Calculate the product of the first ciphertext and the second plaintext polynomial to obtain the second ciphertext;

[0024] A homomorphic operation is performed on the second ciphertext to obtain the third ciphertext. The multiple components of the plaintext vector corresponding to the third ciphertext include the inner product of each of the h groups of real vectors.

[0025] A fourth aspect of this specification provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method described in any one of the first to third aspects.

[0026] This specification provides a computing device in a fifth aspect, including a memory and a processor, wherein the memory stores executable code, and the processor executes the executable code to implement the method described in any one of the first to third aspects.

[0027] A sixth aspect of this specification provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the method described in any one of the first to third aspects.

[0028] Through the privacy-protecting multi-party data processing schemes exemplified in this specification, each participant contributes multiple real-number vectors in a specific manner. By packaging them into a long vector, the inner product v of multiple pairs of real vectors can be obtained in batches through homomorphic operations. i ·u i Furthermore, it protects the vector information of each participant from being leaked to other participants, thereby reducing the amount of computation and communication data for each participant during multi-party data processing. Attached Figure Description

[0029] To more clearly illustrate the technical solutions of the embodiments in this specification, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0030] Figure 1 This is a schematic diagram of a multi-party computation scenario in one embodiment of this specification;

[0031] Figure 2 This is a flowchart of a data processing method in one embodiment of this specification;

[0032] Figure 3 This is a schematic diagram of the data processing operation of the first party P0 in the embodiments of this specification;

[0033] Figure 4 This is a schematic diagram of the data processing operation of the second party P1 in the embodiments of this specification;

[0034] Figure 5 This is a flowchart of a data processing method based on complex vectors in another embodiment of this specification;

[0035] Figure 6 This is a schematic diagram of the data processing operation of the first party P0 in the embodiments of this specification;

[0036] Figure 7 This is a schematic diagram of the data processing operation of the vector of the second-party P1 dual array in the embodiments of this specification;

[0037] Figure 8 This is a schematic diagram of the data processing operation of the second party P1 on the vector of odd number in the embodiments of this specification;

[0038] Figure 9 This is a schematic diagram illustrating the homomorphic operation performed on adjacent ciphertexts in an embodiment of this specification. Detailed Implementation

[0039] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0040] First, the fully homomorphic encryption algorithms involved in the embodiments of this specification will be introduced.

[0041] The homomorphic encryption algorithms described in the embodiments of this specification include fully homomorphic encryption algorithms, which are encryption techniques that allow any computation to be performed on encrypted data. Examples of such fully homomorphic encryption algorithms include BFV, CKKS, FV, and BV, and are not limited thereto. The CKKS algorithm is used as an example in the embodiments of this specification.

[0042] The security of the CKKS homomorphic encryption scheme is based on the RLWE hard assumption. Let (The set of all polynomials with degrees less than N and coefficients that are integers in the range [0, q], where N is a power of 2, typically taking values ​​of 4096, 8192, or 16384). The plaintext space is... Cipher space is χ σ It is R q A discrete Gaussian distribution with standard deviation σ, meaning that each coefficient of the polynomial follows a distribution with standard deviation χ. σ The discrete Gaussian distribution. The parameters of the entire homomorphic algorithm include pp = {N, q, σ, κ}, where κ represents the security parameter. The homomorphic encryption algorithm consists of the following parts:

[0043] KGen(pp): Input algorithm parameters; KGen (key generation) function outputs private key sk and public key pk. Where sk is R q The polynomial in pk consists of two The polynomial composition in the middle, that is

[0044] Ecd(m): Encoding function. Input is a string of length... complex vectors Ecd(m) outputs an R q polynomials in The encoding in Ecd(m) can be FFT encoding.

[0045] Encryption function. Input an R... q polynomials in Output the corresponding ciphertext

[0046] Dec(ct): Decryption function. Takes a ciphertext ct as input and outputs a plaintext polynomial. It is the inverse of the encryption function;

[0047] Decoding function. Input a plaintext polynomial. Output a vector of length N / 2.

[0048] CKKS homomorphic operations can include the following operations:

[0049] Add & Sub: These correspond to addition and subtraction operations on the ciphertext. Specifically, suppose vectors a and b are encrypted to obtain ciphertext ct. a ,ct b Then Add(ct) a ,ct b ), Sub(ct a ,ct b ) are the addition and subtraction of the ciphertext, respectively. After decryption, the resulting vectors are a+b and ab, respectively.

[0050] MulPt(ct, a): Ciphertext multiplied by ciphertext. Takes a ciphertext ct (assuming it encrypts vector m) and a vector a as input. This function outputs a new ciphertext that encrypts a vector m. here, This indicates positional multiplication, which means multiplying corresponding positions of two vectors to obtain a new vector.

[0051] Rot(ct, i): Rotate. Takes a ciphertext ct (let's say it encrypts vector a) and a rotation step size i as input. This function outputs a new ciphertext, which is the vector obtained by circularly shifting a left by i positions. Note that this vector is a complex vector of length N / 2. For example, if N = 8, then the length of vector a is 4, denoted as (a0, a1, a2, a3). Circularly shifting a left by 1 position results in the vector (a1, a2, a3, a0).

[0052] Conj(ct): Conjugate. Given a ciphertext ct (let's say it encrypts vector a), the output is a new ciphertext whose encrypted vector is the conjugate of vector a. Similarly, in the previous example, the output ciphertext encrypts the vector as... The horizontal line indicates taking the conjugate of a complex number (a complex number can be represented as a + ib, where i 2 =-1, its conjugate is a-ib)

[0053] In the relevant technical solution, participant P0 can encrypt the vector using a fully homomorphic encryption algorithm to obtain the corresponding ciphertext, and then send the ciphertext to participant P1. After receiving the ciphertext, participant P1 can use the operation of multiplying the ciphertext by the plaintext to calculate the product of the elements at corresponding positions, and then add the products of the elements at each position to obtain the inner product between the vectors. In this technical solution, since N is usually much larger than the length L of a single vector in actual calculations, for example, N = 8192, L = 16, where N = 8192 means that each ciphertext can encrypt a complex vector of length 4096. Therefore, using a homomorphic encryption algorithm to encrypt a relatively short vector, such as L = 16, results in a significant waste of plaintext space.

[0054] Therefore, this specification provides a data processing scheme in its embodiments, in which each participant processes its multiple real number vectors in a specific manner. By packaging them into a long vector, the inner product v of multiple pairs of real vectors can be obtained in batches through homomorphic operations. i ·u i Furthermore, it protects the vector information of each participant from being leaked to other participants.

[0055] Figure 1 This is a schematic diagram of a multi-party computation scenario in one embodiment of this specification. For example... Figure 1 As shown, for example, the first party P0 has n real vectors. Where, v0 = [v 00 ,v 01 ,v 02 ,…v 0L-1 ], v1 = [v 10 ,v 11 ,v 12 ,…v 1L-1 ...that is, each real vector contains L elements (or components). Similarly, the second party P1 has n real vectors.

[0056] The first party can determine the vectors v for each h vector based on the value of N. i The vectors are merged into a single merged vector V, where h is, for example, N / L. Multiple merged vectors can then be obtained. These multiple merged vectors are encrypted to produce multiple ciphertexts, which are then sent to the second party. The second party can similarly process each h vector u... i The ciphertexts are merged into a single merge vector U, and each ciphertext is multiplied by the polynomial corresponding to the merge vector U to obtain multiple new ciphertexts. By performing homomorphic operations on these new ciphertexts, such as rotation or addition, a ciphertext containing multiple vector inner products can be obtained; that is, each component of the plaintext corresponding to this ciphertext includes the inner product v of each pair of real vectors. i ·u i .

[0057] Figure 2 This is a flowchart of a data processing method in one embodiment of this specification.

[0058] like Figure 2 As shown, in step S210, the first party P0 will generate h real vectors v i Combine them into a vector V.

[0059] To more clearly describe the methods in the embodiments of this specification, Figure 2 The method described below first takes the merging of h real vectors as an example. Here, h is less than or equal to N / 2L, and N is the parameter of the polynomial space mentioned above, that is, the polynomial in this polynomial space contains at most N terms, and the real vector v... i The length of the polynomial is L. Since the polynomials in this polynomial space correspond to vectors of at most N / 2 length, there can be at most (N / 2) / L (i.e., h) real vectors v. i The concatenation results in a merged vector, the length of which is at most ((N / 2) / L)*L=N / 2, and therefore can be encrypted using a single ciphertext.

[0060] Specifically, to facilitate subsequent homomorphic operations, the embodiments in this specification merge the h real vectors in the following manner:

[0061] Let each vector v i element v ij They are arranged alternately in the merged vector V, such that V k =V i+j·(N / 2L) =v ij Among them, V k v represents the k-th element in the merged vector V. ij v represents the i-th vector among h vectors. i The j-th element in the vector. That is, in the merged vector V, first, the individual vectors v... i Arrange the 0th item in order, and then arrange the vectors v. i The first item is arranged in order, and so on, to obtain the final merged vector.

[0062] For example, assuming N = 32, L = 4, N / 2L = 32 / (2*4) = 4, then the maximum value of h is 4.

[0063] In the case where h = 4, assume v0 = [v 00 ,v 01 ,v 02 ,v 03 ], v1 = [v 10 ,v 11 ,v 12 ,v 13], v2 = [v 20 ,v 21 ,v 22 ,v 23 ], v3 = [v 30 ,v 31 ,v 32 ,v 33 The merged vector V can be obtained as follows:

[0064] V = [v 00 ,v 10 ,v 20 ,v 30 ,v 01 ,v 11 ,v 21 ,v 31 ,v 02 ,v 12 ,v 22 ,v 32 ,v 03 ,v 13 ,v 23 ,v 33 ]

[0065] For example, in the above V, V4 = v 01 =V 0+1·4 .

[0066] In the case where h < 4, assuming we want to merge the three vectors v0, v1, and v2, we need to pad the vector V with zeros, resulting in the following merged vector V:

[0067] V = [v 00 ,v 10 ,v 20 ,0,v 01 ,v 11 ,v 21 ,0,v 02 ,v 12 ,v 22 ,0,v 03 ,v 13 ,v 23 ,0]

[0068] By, as described above, processing h vectors v i The merging is performed so that after obtaining the ciphertext corresponding to V°U through homomorphic operations, the ciphertext can be transformed through rotation and addition homomorphic operations to obtain the inner product of each set of vectors. Here, U is the product of the h vectors u of the second power P1 obtained in the same way. i The merged vector obtained by merging will be described in detail below.

[0069] Figure 3This is a schematic diagram of the data processing operation of the first party P0 in the embodiments of this specification.

[0070] like Figure 3 As shown, assuming the first party P0 uses the above merging method to... Figure 3 The real vectors v0 = (1,2,2,1), v1 = (0,2,0,1), v2 = (1,0,0,3), and v3 = (2,0,1,2) in the dataset are merged to obtain the result. Figure 3 The merged vector V in:

[0071] V=[1,0,1,2,2,2,0,0,2,0,0,1,1,1,3,2]

[0072] Specifically, such as Figure 3 As shown, the elements of each vector are displayed in different colors to distinguish which vector v each element in vector V originates from. i In vector V, first according to vector v i Arrange the 0th element of each of v0 to v3 in ascending order of i, then arrange the 1st element of each of v0 to v3 in ascending order of i, and so on.

[0073] In step S220, the first party P0 performs homomorphic encryption on vector V to obtain ciphertext C. V .

[0074] The first party P0 can encrypt the vector V using, for example, the CKKS homomorphic algorithm described above. Specifically, as mentioned above, when encrypting the vector V, the first party P0 first converts the vector V into a plaintext polynomial Ecd(V), and then encrypts the plaintext polynomial Ecd(V) using the public key pk to obtain the ciphertext C corresponding to the vector V. V Among them, the ciphertext C V It includes two ciphertext polynomials, for example (c0, c1). For a polynomial space of N = 32, as described above, each ciphertext polynomial includes 32 terms.

[0075] In one implementation, the first party P0 decrypts the ciphertext to obtain the plaintext inner product of each vector group. Then, the first party P0 has a homomorphic encryption private key sk and a public key pk. The first party P0 uses the public key pk to homomorphically encrypt the vector V.

[0076] In another implementation, the second party P1 decrypts the ciphertext to obtain the plaintext inner product. Then, the second party P1 has the homomorphic encryption private key sk and public key pk. The first party P0 can obtain the public key pk from the second party P1 and use the public key pk to perform homomorphic encryption on the vector V.

[0077] In step S230, the first party P0 transmits the homomorphic ciphertext CV Send to the second party P1.

[0078] In step S240, the second party P1 will generate h vectors u i Combine them into a vector U.

[0079] The second party P1 can be similar to the first party P0 in that it can process each vector u. i The component u ij They are arranged alternately in the merged vector U, such that U k =U i+j ·(N / 2L)=u ij .

[0080] Figure 4 This is a schematic diagram illustrating the data processing operation of the second party P1 in the embodiments of this specification. Wherein, Figure 4 The vector to the right of the ciphertext marked with a double arrow is the plaintext vector corresponding to that ciphertext. For example, ciphertext C... V The vector on the right, indicated by the double arrows [1,0,1,2,2,2,0,0,2,0,0,1,1,1,3,2], is the ciphertext C. V The corresponding plaintext V.

[0081] like Figure 4 As shown, assume that the second party P1 uses the above merging method to... Figure 4 The real vectors u0=(0,2,0,1), u1=(1,0,0,0), u2=(2,1,2,0), u3=(1,1,0,1) in the dataset are merged to obtain the result. Figure 4 The merged vector U in:

[0082] U=[0,1,2,1,2,0,1,1,0,0,2,0,1,0,0,1]

[0083] In step S250, the second party P1 converts the vector U into the plaintext polynomial Ecd(U).

[0084] That is, the vector U is transformed into a polynomial Ecd(U) with N=32 terms, where the coefficients of each term in the polynomial Ecd(U) can be calculated based on the elements of the vector U by FFT encoding.

[0085] In step S260, the second party P1 calculates the ciphertext C. V The product of the plaintext polynomial Ecd(U) and the ciphertext C is obtained. VU

[0086] As mentioned above, ciphertext C V Including two ciphertext polynomials, such as (c0, c1), the ciphertext C VMultiplying the plaintext polynomial Ecd(U) by the ciphertext polynomials c0 and c1 in the polynomial space involves multiplying them by Ecd(U) to obtain two ciphertext polynomials c2 and c3, thus obtaining the ciphertext C. VU = (c2, c3).

[0087] like Figure 4 As shown, due to the ciphertext C V Multiplying by the plaintext polynomial Ecd(U) is a homomorphic operation; therefore, the ciphertext C VU The corresponding plaintext vector should be V°U, i.e., vector. The i-th element in vector V is equal to the element obtained by multiplying the vector V by the element at the i-th position of the vector U. For example, vector V... The 0th element in vector V is equal to the 0th element 1 of vector V multiplied by the 0th element 0 of vector U, which is the 0th element 0. The first element in the vector is equal to the first element 0 of vector V multiplied by the first element 1 of vector U, which is the element 0. The second element in the vector is equal to the second element 1 of vector V multiplied by the second element 2 of vector U, and so on.

[0088] In step S270, the second party P1 processes the ciphertext C. VU Performing homomorphic operations yields the ciphertext C, which contains multiple vector inner products. V·U .

[0089] Since the inner product requires adding the products of multiple elements of a vector, the second party P1 can be obtained by applying the ciphertext C. VU Perform rotation and addition isomorphic operations to obtain the ciphertext C containing the vector dot product. V·U These homomorphic operations are equivalent to: for ciphertext C VU The corresponding plaintext elements are circularly shifted left and then added to the initial plaintext vector. Specifically, for group h (v... i ,u i Each group (v) i ,u i ), for ciphertext C VU The corresponding plaintext elements are circularly shifted left to adjust (v) i ,u i Align the element-wise product of each position of the vector to the same position, and add the circularly shifted vector to the initial plaintext vector so that (v) i ,u i The product of the elements at each position of ) is added together to obtain v. i u i .

[0090] Specifically, assuming each vector vi and u i Length L = 2 r For ciphertext C VU The ciphertext C can be obtained through the following loop. V·U :

[0091] Initially let ct′←C VU ct * ←C VU

[0092] Then, for i = 0 to r-1, the following steps a) and b) can be executed repeatedly in a loop.

[0093] a)ct * ←Rot(ct′,N / 2 i+2 )

[0094] b)ct′←Add(ct * ,ct′)

[0095] After the loop ends, the obtained ct′ is the ciphertext C. V·U .

[0096] For example, refer to Figure 4 If r = 2 and N = 32, then:

[0097] When i = 0, first execute step a) above. This rotational homomorphic operation applies to the ciphertext C. VU The ciphertext ct is obtained by conversion. * The corresponding plaintext vector is the ciphertext C VU corresponding vector The vector obtained by circularly shifting the vector left by 8 bits. Here, circularly shifting the vector left by 8 bits means shifting the vector... like Figure 4 The horizontal arrangement shown is then shifted 8 positions to the left. The 8 positions on the left are shifted to the 8 positions on the right, resulting in...

[0098] ct * The corresponding plaintext vector = (0 0 0 0 1 0 0 2 0 0 2 2 4 0 0 0)

[0099] Then execute step b), ct′←Add(ct * ,ct′), to obtain the plaintext vector corresponding to ct′ = C VU +ct * =(0 02 2 5 0 0 2 0 0 2 2 5 0 0 2).

[0100] Among them, in vector In the example, taking v0 and u0, if v0 and u0 are represented as a horizontally arranged sequence (where the smaller row of the vector is placed at the left end of the sequence, and the 0th row of the vector is placed at the 0th position at the leftmost end of the sequence), the product of the first element from the left of v0 and u0 is arranged in... The fourth position, the product of the second element from the left of v0 and u0, is arranged in... The 8th position, the product of the 3rd element from the left of v0 and u0 is arranged in... The 12th position, therefore, The vector obtained after circularly shifting left by 8 bits and Adding them is equivalent to adding the product of the second element from the left of v0 and u0 to the product of the zeroth element from the left of v0 and u0, and placing the result in the 0th and 8th positions of the plaintext vector corresponding to ct′. Similarly, adding the product of the third element from the left of v0 and u0 to the product of the first element from the left of v0 and u0, and placing the result in the 4th and 12th positions of the plaintext vector corresponding to ct′. For other pairs of v... i and u i The aforementioned rotation and addition homomorphic operations serve the same purpose as v0 and u0. For example, for v1 and u1, the rotation and addition homomorphic operations will... The vector obtained after circular left shift and Adding them together is equivalent to adding the product of the second element from the left of v1 and u1 to the product of the zeroth element from the left of v1 and u1, and placing the result in the 1st and 9th positions of the plaintext vector corresponding to ct′. Similarly, adding the product of the third element from the left of v1 and u1 to the product of the first element from the left of v1 and u1, and placing the result in the 5th and 13th positions of the plaintext vector corresponding to ct′, and so on.

[0101] When i = 1, execute step a). This homomorphic operation transforms the ciphertext ct′ obtained in step a), resulting in the updated ciphertext ct. * The corresponding plaintext vector is obtained by cyclically shifting the vector corresponding to the ciphertext ct′ 4 bits to the left, thus yielding:

[0102] ct * The corresponding plaintext vector = (5 0 0 2 0 0 2 2 5 0 0 2 0 0 2 2)

[0103] Then execute step b), ct′←Add(ct * ,ct′), to get

[0104] The plaintext vector corresponding to ct′ is (5 0 2 4 5 0 2 4 5 0 2 4 5 0 2 4 5 0 2 4).

[0105] At this point, the loop ends, and the resulting ct′ is the ciphertext C. V·U Taking v0 and u0 as an example again, here we add the vector corresponding to ct′ obtained in the previous loop, which is shifted left by 4 bits, to the vector corresponding to ct′. This is equivalent to multiplying the 4 elements of v0 and u0 (i.e., v... 00 u 00 v 01 u 01 v 02 u 02 and v 03 u 03 Add them together to get v 00 u 00 +v 01 u 01 +v 02 u 02 +v 03 u 03 The sum is then placed in the 0th, 4th, 8th, and 12th positions of the plaintext vector corresponding to the updated ct′. For other pairs of v... i and u i The aforementioned rotation and addition homomorphic operations serve the same purpose as v0 and u0. For example, for v1 and u1, it is equivalent to adding the product of the 4 elements of v1 and u1, and placing the result of the addition in the 1st, 5th, 9th, and 13th positions of the plaintext vector corresponding to the updated ct′, and so on.

[0106] Therefore, from the above derivation, we can obtain that the ciphertext C V·U The corresponding plaintext vector has bits 0, 4, 8, and 12 as values ​​of v0·u0, and ciphertext C. V·U The 1st, 5th, 9th, and 13th bits of the corresponding plaintext vector are the values ​​of v1·u1, and the ciphertext C is... V·U The 2nd, 6th, 10th, and 14th bits of the corresponding plaintext vector are the values ​​of v²·u², and the ciphertext C is... V·U The 3rd, 7th, 11th, and 15th bits of the corresponding plaintext vector are the values ​​of v3·u3. Therefore, the ciphertext C V·U The elements in the corresponding plaintext vector exhibit periodicity.

[0107] The second party, P1, obtains the ciphertext C. V·U Then, for example, if the first party has the private key for homomorphic encryption, the second party P1 can transmit the ciphertext C. V·U Send to first party P0, first party P0 passes the ciphertext C V·U Decryption yields the plaintext vector, from which pairs of vectors v can be obtained. i and u i The inner product of.

[0108] exist Figure 2 In the method shown, the first and second parties each package their multiple real vectors into a long vector for homomorphic operations, thereby calculating the inner product of multiple pairs of vectors at once. Compared with existing technologies, this fully utilizes the plaintext space and reduces the amount of ciphertext data required for communication. It is understood that although the above method shows the calculation of the inner product for a set of h pairs of vectors, this specification is not limited to this. For example, the first and second parties can divide their respective n vectors into 2nL / N groups of vectors, and calculate the vector inner product for each group of h pairs of vectors using the above method.

[0109] In another implementation, considering the property that the CKKS algorithm can encrypt complex vectors, i.e., each ciphertext can encrypt a complex vector of length N / 2, the imaginary part of the plaintext vector can be further utilized. For example, assuming vector a = (a0, a1) and vector b = (b0, b1), by representing vector a as a0 + a1*i and vector b as b0 – b1*i, the calculation shown in formula (1) can be performed:

[0110] (a0 + a1 * i) * (b0 – b1 * i)=(a0*b0 + a1*b1) + i*(a1*b0 – a0 * b1)(1)

[0111] According to formula (1), the real part of the product of the two complex numbers is the inner product of vectors a and b.

[0112] In another way, vector b can be represented as b1 + b0*i, and the calculation can be performed as shown in formula (2):

[0113] (a0 + a1 * i) * (b1 + b0 * i)=(a0*b1 - a1*b0) + i*(a0*b0 + a1 * b1)(1)

[0114] According to formula (2), the imaginary part of the product of the two complex numbers is the inner product of vectors a and b.

[0115] In other words, the dot product of two vectors of length 2 can be calculated using a single complex multiplication. Similarly, to calculate the dot product of two vectors of length L, we can first convert each vector into a complex vector with half its length, where each element of the complex vector is formed by two adjacent elements of the real vector (e.g., v). i,j v i,j+1 and u i,j u i,j+1 The complex vector is constructed by first constructing the vector, and then calculating the elements at the same position in each pair of complex vectors using the method described above to obtain v. i,j ui,j +v i,j+ 1u i,j+1 After that, multiple v i,j u i,j +v i,j+1 u i,j+1 Adding the vectors (j∈[1,L / 2]) together yields the inner product v. i ·u i This reduces both computational and communication overhead by approximately half.

[0116] Figure 5 This is a flowchart of a complex vector-based data processing method according to another embodiment of this specification.

[0117] like Figure 5 As shown, in step S501, the first party P0 will generate multiple sets of h vectors v i Combined into a complex vector V i .

[0118] The first party, P0, can first divide each vector v according to the following rules. i Convert to complex vector v i ′:

[0119] v i ′=v i,2j +iv i,2j+1 where j∈[0,L / 2]

[0120] Among them, v i,2j Represents vector v i The elements of the even-numbered rows, v i,2j+1 Represents vector v i The elements of the odd-numbered rows, j∈[0,L / 2], represent complex vectors v. i The length of ′ is shortened to L / 2, that is, the length of the real vector v is reduced to L / 2. i Half the length of the vector v. This formula is used to represent vector v. i The even-numbered elements are placed in the complex vector v i The real part of ′ will be the vector v i The elements at odd positions are placed in the complex vector v i The imaginary part of ′.

[0121] In other words, vector v i The elements of the even-numbered rows (or positions) in the vector v are combined with the elements of the adjacent odd-numbered rows to form a complex vector, thus allowing the vector v to be represented as a complex vector. i Transform a complex vector v of length L / 2 i After this transformation, for the aforementioned polynomial space, h′ can be less than or equal to 0. Combining complex vectors v i ′ is a merged vector V iAnd the merged vector V can be accessed via a ciphertext. i Encryption is performed. That is, by converting a real-number vector into a complex-number vector, a ciphertext can encrypt at most a certain number of complex-number vectors. It is the maximum number of real vectors that can be encrypted by a given ciphertext mentioned above. This is twice the size of the current, thus allowing both computational and communication overhead to be approximately halved.

[0122] The first side P0 can then be used for each group of h′ complex vectors v i Merge.

[0123] Specifically, for h′ complex vectors v i When merging, similar to merging real vectors as described above, the individual vectors v can be... i The elements of ' are arranged alternately in the merged vector V i In the middle, making Among them, V ik Represents the merged vector V i The k-th element in, v s ′ t v represents the s-th vector among h′ complex vectors. i The t-th element in '.

[0124] Figure 6 This is a schematic diagram illustrating the data processing operation of the first party P0 in the embodiments of this specification. For ease of illustration, it is assumed that N = 16, then the maximum number of complex vectors that can be encrypted by a single ciphertext is... It is understandable that, in the case of N=32, the maximum number of complex vectors that a ciphertext can encrypt should be 8.

[0125] like Figure 6 As shown, for n real vectors v i The first party P0 can group every 4 real vectors together and merge them.

[0126] For example, for real vectors v0 = (1,2,2,1), v1 = (0,2,0,1), v2 = (1,0,0,3), and v3 = (2,0,1,2), the first party P0 first converts each real vector into a complex vector as described above, thus obtaining the following four complex vectors: v′0 = (1+2i,2+1i), v1′ = (0+2i,0+1i), v2′ = (1+0i,0+3i), and v3′ = (2+0i,1+2i). Then, the elements of each complex vector can be interleaved in the merged vector V0, resulting in the following... Figure 6 The merged vector V0 shown:

[0127] V0=[1+2i,0+2i,1,2,2+i,0+1i,3i,1+2i]

[0128] Similarly, for the real vectors v4 = (1,0,2,1), v5 = (0,0,0,1), v6 = (1,0,1,0), and v7 = (2,0,1,0), the first party P0 first converts each real vector into a complex vector as described above, thus obtaining the following four complex vectors:

[0129] v′4=(1,2+1i), v′5=(0,i), v′6=(1,1), v′7=(2,1), and then the elements of each complex vector can be interleaved in the merged vector V1 to obtain, as shown below. Figure 6 The merged vector V1 shown:

[0130] V1 = [1, 0, 1, 2, 2 + i, i, 1, 1]

[0131] As mentioned above, the first party P0 has n real vectors. The second party P1 has n real vectors. Each real vector consists of L elements (or components). By converting real vectors into complex vectors, the first method P0 can transform n real vectors into complex vectors. Divided into Take a set of complex vectors, and process each set of complex vectors as described above, to obtain multiple merged vectors V corresponding to the multiple sets of real vectors. i ,here

[0132] In step S503, the first party P0 applies the multiple complex vectors V obtained in step S501. i Homomorphic encryption is performed to obtain multiple ciphertexts.

[0133] The first party P0 can use, for example, the CKKS homomorphic algorithm described above, to process the complex vector V. i Encryption is performed. As mentioned above, the first party P0, in dealing with the complex vector V... i During encryption, the complex vector V is first... i Convert to plaintext polynomial Ecd(V) i Then use the public key pk to apply the plaintext polynomial Ecd(V) to the polynomial. i Encryption yields the ciphertext corresponding to vector V. Among them, the ciphertext It includes two ciphertext polynomials, where, for example, a polynomial space of N=16, each ciphertext polynomial includes 16 terms.

[0134] In one implementation, the first party P0 ultimately decrypts the ciphertext to obtain the plaintext inner product of each vector group. The first party P0 then possesses a homomorphic encryption private key sk and a public key pk. The first party P0 uses the public key pk to process vector V. i Perform homomorphic encryption.

[0135] In another implementation, the second party P1 ultimately decrypts the ciphertext to obtain the plaintext inner product. Then, the second party P1 possesses the homomorphic encryption private key sk and public key pk. The first party P0 can obtain the public key pk from the second party P1 and use it to encrypt vector V. i Perform homomorphic encryption.

[0136] For example, such as Figure 6 As shown, for Figure 6 The two sets of vectors v0~v3 and v4~v7 shown are homomorphically encrypted by the first party P0 on the merged vectors V0 and V1 respectively, resulting in... and

[0137] In step S505, the first party P0 transmits multiple ciphertexts. Send to the second party P1.

[0138] In step S507, the second party P1 will divide the even array of h′ vectors u i They are combined into a complex vector U. 2j Given an odd number of h′ vectors u i They are combined into a complex vector U. 2j+1 .

[0139] Specifically, the second party P1 can first follow The number of vectors u will be n i Divide into multiple groups, and then the vectors u of the even groups can be divided according to the rules shown in formula (2). i Convert to complex vector u i ′:

[0140] u i ′=u i,2j -iu i,2j+1 , where j∈[0,L / 2] (3)

[0141] Among them, u i,2j Represents vector u i The elements of the even-numbered rows, u i,2j+1 Represents vector u i The elements of the odd-numbered rows, j∈[0,L / 2], represent complex vectors u. i The length of ′ is shortened to L / 2. Formula (3) is used to shorten the length of vector u. i The even-numbered elements are placed in the complex vector u. i The real part of ′ will be the vector ui The opposite of the element at the odd position is placed in the complex vector u. i The imaginary part of ′.

[0142] In other words, vector u i The elements of the even-numbered rows (or positions) in the vector and the elements of the adjacent odd-numbered rows form a complex vector, thus allowing the vector u to be represented. i Transform a complex vector u of length L / 2 i ′.

[0143] Then, the second party P1 can divide the odd array of vectors u according to the rule shown in formula (4). i Convert to complex vector u i ′:

[0144] u i ′=u i,2j+1 +iu i,2j , where j∈[0,L / 2] (4)

[0145] Among them, u i,2j Represents vector u i The elements of the even-numbered rows, u i,2j+1 Represents vector u i The elements of the odd-numbered rows, formula (4) is used to transform the vector u i The elements at odd positions are placed in the complex vector u. i The real part of ′ will be the vector u i The even-numbered elements are placed in the complex vector u. i The imaginary part of ′.

[0146] In this embodiment of the specification, the vector u of the dual array is used. i The vector u of the odd array i The conversion is performed using formulas (3) and (4) respectively. According to formulas (1) and (2) above, the real and imaginary parts of the plaintext vector corresponding to the final ciphertext can be made to include the inner product of each pair of vectors through homomorphic operation on the ciphertext, thereby further improving the utilization rate of the ciphertext and reducing the amount of communication data.

[0147] Understandable. Figure 6 The vector u shown i The method of converting to a complex vector is merely exemplary and not intended to limit the scope of the embodiments described in this specification. For example, the second party P1 could also convert each vector u... i All transformations are performed using formula (3), or alternatively, each vector u can be transformed. i Both can be converted using formula (4). According to formula (1) and formula (2) above, both methods can be used to calculate the vector inner product.

[0148] The second method, P1, can then be applied to the h′ complex vectors u in each group. i Merge.

[0149] Specifically, for h′ complex vectors u i When merging, similar to merging real vectors as described above, the individual vectors u can be... i The elements of ′ are arranged alternately in the merged vector U i In the middle, making Among them, U ik Represents the merged vector U i The k-th element in, u′ st Let u represent the s-th vector among h′ complex vectors. i The t-th element in '.

[0150] Figure 7 This diagram illustrates the data processing operations of the vector in the dual array of the second party P1 in the embodiments of this specification. For ease of illustration, N = 16, meaning that a single ciphertext can encrypt a maximum of [number missing].

[0151] like Figure 7 As shown, for example, for real vectors u0=(0,2,0,1), u1=(1,0,0,0), u2=(2,1,2,0), u3=(1,1,0,1), the second party P1 first converts each real vector into a complex vector as shown in formula (3), thus obtaining the following four complex vectors: u′0=(0-2i,0-1i), u′1=(1-0i,0), u′2=(2-1i,2-0i), u′3=(1-i,0-i). Then, the elements of each complex vector can be interleaved in the merged vector U0 to obtain the following... Figure 7 The merged vector U0 shown below:

[0152] U0=[-2i,1,2-i,1-i,-i,0,2,-i]

[0153] Figure 8 This is a schematic diagram illustrating the data processing operation of the second party P1 on an odd-numbered vector in the embodiments of this specification. Similarly, here N = 16, so the maximum number of complex vectors that can be encrypted by a single ciphertext is...

[0154] like Figure 8As shown, for example, for real vectors u4=(1,0,0,2), u5=(2,1,0,1), u6=(1,0,0,3), u7=(0,1,1,1), the second party P1 first converts each real vector into a complex vector as shown in formula (4), thus obtaining the following four complex vectors: u′4=(0+i,2), u′5=(1+2i,1), u′6=(i,3), u′7=(1,1+i). Then, the elements of each complex vector can be interleaved in the merged vector U1 to obtain the following... Figure 8 The merged vector U1 shown below:

[0155] U1 = [i, 1 + 2i, i, 1, 2, 1, 3, 1 + i]

[0156] The second party P1 can generate n real number vectors. Divided into Each set of real number vectors is processed in two ways: even and odd numbers, as described above, to obtain multiple merged vectors U corresponding to the sets of real number vectors. 2j and U 2j+1 Where, when k is even, j = k / 2, and when k is odd, j = (k+1) / 2.

[0157] In step S509, the second party P1 will assign each vector U 2j sum vector U 2j+1 Convert to plaintext polynomial Ecd(U) 2j ) and Ecd(U 2j+1 ).

[0158] That is, each vector U 2j sum vector U 2j+1 Convert to a polynomial Ecd(U) containing N=16 terms 2j ) and Ecd(U 2j+1 ), where the polynomial Ecd(U 2j ) / Ecd(U 2j+1 The coefficients of each term in the vector U can be encoded using FFT. 2j sum vector U 2j+1 The individual elements are calculated.

[0159] Understandable. Figure 5 Steps S507 and S509 can be executed before or after step S505, and there is no limitation on this.

[0160] In step S511, the second party P1 calculates the ciphertext. With plaintext polynomial Ecd(U 2j The product of ) yields the ciphertext. Calculate ciphertext With plaintext polynomial Ecd(U 2j+1 The product of ) yields the ciphertext.

[0161] Among them, ciphertext Multiple ciphertexts arranged in sequence The ciphertext of the even-numbered items in the code, such as the one calculated above. Cipher Multiple ciphertexts arranged in sequence The ciphertext of the odd-numbered items in the code, such as the one calculated above.

[0162] The second party, P1, calculates the ciphertext. With plaintext polynomial Ecd(U 2j The product of ) yields the ciphertext. For example, such as Figure 7 As shown, calculate the ciphertext The product with Ecd(U0) is due to the ciphertext Multiplying by Ecd(U0) is a homomorphic operation, therefore, The corresponding plaintext is That is, vector The i-th element in the vector is equal to the element obtained by multiplying the vector V0 by the element at the i-th position of the vector U0. For example, vector The 0th element in vector V0 is equal to the element 4 - 2i obtained by multiplying the 0th element 1 + 2i of vector V0 with the 0th element - 2i of vector U0. The first element in the vector is equal to the element 2i obtained by multiplying the first element 2i of vector V0 by the first element 1 of vector U0. The second element in the vector is equal to the product of the second element 1 of vector V0 and the second element 2-i of vector U0, and so on. Therefore, the ciphertext... The corresponding plaintext should be Figure 7 The sequence [4-2i, 2i, 2-i, 2-2i, 1-2i, 0, 6i, 2-i] indicates that the second party, P1, obtains the ciphertext by performing a homomorphic operation on the ciphertext. It cannot know the plaintext vector V0, and therefore cannot know the ciphertext. The corresponding plaintext vector.

[0163] The second party, P1, also calculates the ciphertext. With plaintext polynomial Ecd(U 2j+1 The product of ) yields the ciphertext. For example, such as Figure 8 As shown, calculate the ciphertext The product with Ecd(U1), similarly, due to the ciphertext Multiplying by Ecd(U1) is a homomorphic operation, therefore, The corresponding plaintext vector is Where, vector The i-th element in the vector is equal to the element obtained by multiplying the vector V1 and the element at the i-th position of the vector U1. Therefore, the ciphertext calculated by the second party P1 is... The corresponding plaintext should be Figure 8 The example shown is [i,0,i,2,4+2i,i,3,1+i].

[0164] In step S513, the second party P1 will arrange the ciphertext in adjacent rows. and ciphertext The ciphertext is obtained by adding the conjugate of the sum and difference of the two terms.

[0165] Specifically, the second party P1, for every two adjacent ciphertexts... and ciphertext The conversion can be performed as shown in formula (5):

[0166]

[0167] Figure 9 For the embodiments of this specification, adjacent ciphertext and ciphertext A diagram illustrating homomorphic operations. (Example) Figure 9 As shown, in ciphertext and ciphertext As adjacent ciphertext and ciphertext Example,

[0168] The corresponding plaintext vector is the vector with vector The vector obtained by adding them together is... Figure 9 As shown in the image:

[0169] [4-i,2i,2,4-2i,5,i,3+6i,3]

[0170] The corresponding plaintext vector is the vector with vector The vector obtained by subtracting and taking the conjugate is... Figure 9 As shown in the image:

[0171] [4+3i,-2i,2+2i,2i,-3+4i,i,-3-6i,1+2i]

[0172] thereby, The corresponding plaintext is the vector obtained by adding the two vectors mentioned above:

[0173] [8+2i,0,4+2i,4,2+4i,2i,0,4+2i]

[0174] In step S515, the second party P1 processes the ciphertext. Performing homomorphic operations of rotation and addition yields the ciphertext C′ containing multiple vector inner products. v·u .

[0175] Formula (6) can be derived from formula (5) above:

[0176]

[0177] From formula (6), we can deduce that The real part of the corresponding plaintext vector is Twice the real part of the corresponding plaintext vector The imaginary part of the corresponding plaintext vector is It is twice the imaginary part of the corresponding plaintext vector. Referring to formula (1), we can derive that... The real part of the corresponding plaintext vector is

[0178] v i,2t u i,2t +v i,2t+1 u i,2t+1 (t∈[1,L / 2]), referring to formula (2), we can obtain The imaginary part of the corresponding plaintext vector is v. i,2t u i,2t +v i,2t+1 u i,2t+1 (t∈[1,L / 2]), therefore, it is possible to... Performing a homomorphic operation, which is equivalent to... The corresponding plaintext vectors are rotated and added together to obtain the ciphertext C′. v·u The real part of the corresponding plaintext vector includes the inner product of the vectors in the even array, and the imaginary part includes the inner product of the vectors in the odd array.

[0179] Specifically, assuming each vector v i and u i Length L / 2 = 2 r For ciphertext The ciphertext C′ can be obtained through the following loop. v·u :

[0180] Initial command

[0181] Then, for i = 0 to r-1, the following steps a) and b) can be executed repeatedly in a loop.

[0182] a)ct* ←Rot(ct′,N / 2 i+2 )

[0183] b)ct′←Add(ct * ,ct′)

[0184] After the loop ends, the obtained ct′ is the ciphertext C′. v·u .

[0185] For example, refer to Figure 9 If r = 1 and N = 16, then:

[0186] If i = 0, first execute step a) above. This rotation homomorphic operation affects the ciphertext. (Right now The ciphertext ct is obtained by conversion. * The corresponding plaintext vector is the ciphertext vector. The corresponding vector is obtained by cyclically shifting the vector 4 positions to the left. This cyclic shift of 4 positions means that after arranging the vector horizontally into a sequence, the entire vector is shifted 4 positions to the left. Specifically, the 4 positions on the left are shifted to the 4 positions on the right, thus obtaining the vector.

[0187] The plaintext vector corresponding to ct* is [2+4i,2i,0,4+2i,8+2i,0,4+2i,4].

[0188] refer to Figure 9 As shown and described above The real part of the 0th term of the corresponding plaintext vector is 2(v 00 u 00 +v 01 u 01 The imaginary part is 2(v). 40 u 40 +v 41 u 41 The real part of the fourth term is 2(v). 02 u 02 +v 03 u 03 The imaginary part is 2(v) 42 u 42 +v 43 u 43 Through the above iterative operations, the ciphertext is processed. The corresponding vector is circularly shifted left by 4 bits, which yields ct. * The real part of the 0th term in the corresponding plaintext vector is 2(v 02 u 02 +v 03 u 03 The imaginary part is 2(v) 42 u 42 +v43 u 43 ), thus with The zeroth element of the corresponding plaintext vector is aligned, that is, the element-wise product of vectors v0 and u0 is aligned to the real part of the zeroth element, and the element-wise product of vectors v4 and u4 is aligned to the imaginary part of the zeroth element. Similarly, through the above rotation operation, the element-wise product of vectors v1 and u1 is also aligned to the real part of the first element, the element-wise product of vectors v5 and u5 is aligned to the imaginary part of the first element, the element-wise product of vectors v2 and u2 is aligned to the real part of the second element, the element-wise product of vectors v6 and u6 is aligned to the imaginary part of the second element, the element-wise product of vectors v3 and u3 is aligned to the real part of the third element, and the element-wise product of vectors v7 and u7 is aligned to the imaginary part of the third element.

[0189] Then execute step b), ct′←Add(ct * ,ct′), the plaintext vector corresponding to ct′ is obtained as:

[0190] [8+2i,0,4+2i,4,2+4i,2i,0,4+2i]+[2+4i,2i,0,4+2i,8+2i,0,4+2i,4]

[0191] =[10+6i,2i,4+2i,8+2i,10+6i,2i,4+2i,8+2i]

[0192] Dividing the plaintext vector by 2 yields [5+3i,i,2+i,4+i,5+3i,i,2+i,4+i]. After the above steps for each pair of v... i and u i After aligning the positions of the element-wise product, then ct * Adding it to the initial ct′, which corresponds to adding v to each pair of vectors. i and u i The product of all elements is added together, therefore, the real and imaginary parts of each element in the updated ct′ correspond to the inner product of each pair of vectors. Specifically, refer to... Figure 9 As shown, the real part 5 of the 0th element 5+3i of the vector is the value of v0·u0, and the imaginary part 3i is the value of v4·u4. The real part 0 of the 1st element i is the value of v1·u1, and the imaginary part i is the value of v5·u5. The real part 2 of the 2+i of the 2nd element is the value of v2·u2, and the imaginary part i is the value of v6·u6. The real part 4 of the 3rd element 4+i is the value of v3·u3, and the imaginary part i is the value of v7·u7. The 4th to 7th elements of this vector are the same as the 0th to 3rd elements, that is, this vector is a periodic vector.

[0193] In step S517, the second party P1, based on the ciphertext C′ v·u The periodicity of the coefficients of the corresponding plaintext polynomial will result in multiple ciphertexts C′.v·u Merged into a single ciphertext C″ v·u .

[0194] As mentioned above, the ciphertext C′ v·u The corresponding plaintext vector F is periodic, specifically with a period of N / L. Therefore, according to the FFT coding algorithm, the coefficients of the plaintext polynomial corresponding to this plaintext vector F are: one non-zero coefficient for every N / L terms, and zero coefficients for the other terms. For example, when N=16 and L=4, Ecd(F) = a0 + a4x 4 +a8x 8 +a 12 x 12 That is, only the constant term, x 4 Item, x 8 Item, x 12 The coefficient of one term is non-zero, while the coefficients of the other terms are zero.

[0195] In this case, when h ciphertexts C′ are calculated... v·u In the case where h≤N / L, since each ciphertext C′ v·u The coefficients of the corresponding plaintext polynomials have the same periodicity, therefore, the ciphertexts C′ can be analyzed using these h ciphertexts. v·u Homomorphic operations are performed to package h ciphertexts into a single ciphertext, thus making full use of the coefficients of the plaintext polynomial.

[0196] Specifically, the multiple ciphertexts C′ v·u Let them be ct0, ct1, ... ct h-1 Then the ciphertext C′ packed in can be calculated. v ′ ·u :

[0197]

[0198] In other words, by using different CT scans j Multiply by x j This is equivalent to the ct j The coefficients of the corresponding plaintext polynomial shifted by j terms, thus C′ v ′ ·u The corresponding plaintext polynomial Ecd(H) will contain each ct j The coefficients of the corresponding plaintext polynomials are staggered, thus allowing us to obtain the polynomials from C′. v ′ ·u The corresponding plaintext polynomial Ecd(H) is used to obtain each ct. j The coefficients of the corresponding plaintext polynomial.

[0199] For example, assuming as mentioned above, h = N / L = 4, then C′ v ′ ·u=ct0 + ct1·x + ct2·x 2 +ct3·x 3

[0200] According to this calculation method, the coefficients of the plaintext polynomial corresponding to ct0 are equivalent to those in the ciphertext C′. v ′ ·u The corresponding plaintext polynomial Ecd(H) x 0 x 4 x 8 and x 12 The coefficients of the plaintext polynomial corresponding to term ct1 are in the ciphertext C′ v ′ ·u The corresponding plaintext polynomial Ecd(H) has x and x. 5 x 9 and x 13 The coefficients of the plaintext polynomial corresponding to the term ct2 are in the ciphertext C′ v ′ ·u The corresponding plaintext polynomial Ecd(H) x 2 x 6 x 10 and x 14 The coefficients of the plaintext polynomial corresponding to ct3 are in the ciphertext C′ v ′ ·u The corresponding plaintext polynomial Ecd(H) x 3 x 7 x 11 and x 15 .

[0201] In step S519, the second party P1 sends the ciphertext C″ to the first party P0. v·u .

[0202] The second party, P1, uses h ciphertexts C′... v·u Packaged as C″ v·u Sending them together to the first party P0 is better than sending h ciphertexts C′ together. v·u Sending it to the first party P0 greatly reduces the amount of communication data.

[0203] In step S521, the first party P0 processes the ciphertext C″. v·u Decryption yields the plaintext polynomial, which is then divided into multiple ciphertexts C′ based on preset rules. v·u Each has a corresponding plaintext polynomial, and based on these plaintext polynomials, multiple vectors are obtained. The inner product of each set of vectors is then obtained from these multiple vectors.

[0204] In this scenario, assuming the first party P0 possesses the homomorphic encryption private key sk, the first party P0 can use the private key sk to encrypt the ciphertext C″. v·u Decryption yields ciphertext C″ v·uThe corresponding plaintext polynomial. As mentioned above, the ciphertext C″ v·u The corresponding plaintext polynomial Ecd(H) includes each ciphertext C′ v·u The coefficients of the corresponding plaintext polynomial, the first-party polynomial P0, can be obtained from the above-mentioned packed ciphertext C′. v·u The rule is to extract each ciphertext C′ from the plaintext polynomial Ecd(H). v·u The corresponding plaintext polynomial Ecd(F) is decoded to obtain the plaintext vectors F, thus allowing us to... Figure 9 As shown, the inner product v of each pair of vectors is obtained from each element of the plaintext vector F. i ·u i .

[0205] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0206] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0207] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or physical entities, or by products with certain functions. A typical implementation device is a server system. Of course, this application does not exclude the possibility that, with the future development of computer technology, the computer implementing the functions of the above embodiments can be, for example, a personal computer, a laptop computer, an in-vehicle human-machine interaction device, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or any combination of these devices.

[0208] While one or more embodiments of this specification provide the operational steps of the methods described in the embodiments or flowcharts, more or fewer operational steps may be included based on conventional or non-inventive means. The order of steps listed in the embodiments is merely one possible order of execution among many steps and does not represent the only possible order. In actual device or end product execution, the methods shown in the embodiments or drawings may be executed sequentially or in parallel (e.g., in a parallel processor or multi-threaded processing environment, or even a distributed data processing environment). The terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, product, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, product, or apparatus. Without further limitations, the presence of other identical or equivalent elements in the process, method, product, or apparatus that includes the elements is not excluded. For example, the use of terms such as "first," "second," etc., is to denote names and does not indicate any particular order.

[0209] For ease of description, the above devices are described in terms of function, divided into various modules. Of course, when implementing one or more of these specifications, the functions of each module can be implemented in one or more software and / or hardware components, or a module that performs the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between devices or units, and may be electrical, mechanical, or other forms.

[0210] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0211] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0212] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0213] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0214] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0215] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage, graphene storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0216] Those skilled in the art will understand that one or more embodiments of this specification can be provided as a method, system, or computer program product. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0217] One or more embodiments of this specification can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a particular task or implement a particular abstract data type. One or more embodiments of this specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0218] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, system embodiments are basically similar to method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments. In the description of this specification, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this specification. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described can be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0219] The above description is merely an embodiment of one or more embodiments of this specification and is not intended to limit the scope of these embodiments. Various modifications and variations can be made to these embodiments by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims.

Claims

1. A privacy-preserving multi-party data processing method, wherein the multi-party includes a first party and a second party, the first party possessing h sequentially arranged first real number vectors, and the second party possessing h sequentially arranged second real number vectors, wherein... The first and second real vectors in the same order form a set of real vectors whose inner product is to be calculated. The h first real vectors and the h second real vectors constitute h sets of real vectors. The method includes: The first party performs the following steps: The h first real number vectors are merged into a first merged vector, where h corresponds to N / L, the h components at the same position in each of the h first real number vectors are arranged consecutively in the first merged vector, N is the number of terms of the polynomial in the preset polynomial space, and the first real number vector and the second real number vector include L components; Homomorphic encryption is performed on the first merged vector to obtain the first ciphertext, which includes polynomials in the polynomial space. Send the first ciphertext to the second party; The second party performs the following steps: The h second real vectors are merged into a second merged vector, wherein the h components at the same position in each of the h second real vectors are arranged consecutively in the second merged vector; The second merged vector is converted into a second plaintext polynomial, which includes N terms; Calculate the product of the first ciphertext and the second plaintext polynomial to obtain the second ciphertext; A homomorphic operation is performed on the second ciphertext to obtain the third ciphertext. The multiple components of the plaintext vector corresponding to the third ciphertext include the inner product of each of the h groups of real vectors.

2. The method according to claim 1, wherein merging the h first real vectors into a first merged vector comprises: The h first real vectors are converted into h first complex vectors. For each first real vector, every two first components starting from the 0th component constitute a second component of the first complex vector. For every two first components, the first component at an even position in the first real vector is taken as the real part of the second component, and the first component at an odd position in the first real vector is taken as the imaginary part of the second component. The h first complex vectors are merged into the first merged vector, wherein adjacent components of each first complex vector are separated from each other by N / L components in the first merged vector.

3. The method according to claim 2, wherein merging the h second real vectors into a second merged vector comprises: The h second real vectors are converted into h second complex vectors. For each second real vector, every two third components starting from the 0th component constitute a fourth component of the second complex vector. For every two third components, the third component at an even position in the second real vector is taken as the real part of the fourth component, and the opposite of the third component at an odd position in the second real vector is taken as the imaginary part of the fourth component.

4. The method according to claim 3, wherein the first party has n sets of h first real number vectors arranged in sequence, and the second party has n sets of h second real number vectors arranged in sequence, wherein merging the h second real number vectors into a second merged vector includes: For each even-numbered second real vector starting from group 0, the h second real vectors are converted into h second complex vectors; For each odd-numbered second real vector starting from group 1, the h second real vectors are converted into h third complex vectors. For each second real vector, every two fifth components starting from the 0th component constitute a sixth component of the third complex vector. For every two fifth components, the fifth component at an even position in the second real vector is taken as the imaginary part of the sixth component, and the fifth component at an odd position in the second real vector is taken as the real part of the sixth component.

5. The method according to claim 4, wherein performing a homomorphic operation on the second ciphertext to obtain the third ciphertext comprises: For the second ciphertext corresponding to the even-numbered h second complex vectors and the second ciphertext corresponding to the odd-numbered h third complex vectors, the two second ciphertexts are added together to obtain the fourth ciphertext. The two ciphertexts are subtracted and conjugate to obtain the fifth ciphertext. The fourth ciphertext is added to the fifth ciphertext to obtain the sixth ciphertext. Based on L, the sixth ciphertext is rotated and added homomorphically to obtain the seventh ciphertext. The real and imaginary parts of the multiple components of the plaintext vector corresponding to the seventh ciphertext include the inner product of each set of real vectors.

6. The method according to claim 5, wherein the homomorphic operation of rotating and adding based on the sixth ciphertext and L to obtain the seventh ciphertext comprises: The sixth ciphertext is rotated such that each component in the plaintext vector corresponding to the sixth ciphertext is cyclically shifted by an integer multiple of N / L to obtain the eighth ciphertext. The eighth ciphertext is added to the sixth ciphertext to obtain the ninth ciphertext, and the seventh ciphertext is obtained based on the ninth ciphertext.

7. The method according to claim 6, wherein the powers of x corresponding to the coefficients of adjacent non-zero terms in the plaintext polynomial corresponding to the seventh ciphertext differ by N / L, the method further comprising: The second party merges at most N / L seventh ciphertexts into a tenth ciphertext based on a preset merging rule, such that the coefficients in the plaintext polynomials corresponding to each seventh ciphertext are located in different positions in the plaintext polynomials corresponding to the tenth ciphertext. Send the tenth ciphertext to the first party; The first party decrypts the tenth ciphertext to obtain the third plaintext polynomial. Based on the merging rule, the third plaintext polynomial is split into at most N / L fourth plaintext polynomials corresponding to at most N / L seventh ciphertexts respectively. The at most N / L fourth plaintext polynomials are converted into at most N / L complex vectors. The inner product of each set of real vectors is obtained from the at most N / L complex vectors.

8. A privacy-preserving multi-party data processing method, wherein the multi-party includes a first party and a second party, the first party possessing h sequentially arranged first real number vectors, and the second party possessing h sequentially arranged second real number vectors, wherein... The first and second real vectors, which are in the same order, are a set of real vectors whose inner product is to be calculated. The method is performed by the first party and includes: The h first real number vectors are merged into a first merged vector, where h corresponds to N / L, the h components at the same position in each of the h first real number vectors are arranged consecutively in the first merged vector, N is the number of terms of the polynomial in the preset polynomial space, and the first real number vector and the second real number vector include L components; Homomorphic encryption is performed on the first merged vector to obtain the first ciphertext, which includes polynomials in the polynomial space. The first ciphertext is sent to the second party.

9. A privacy-preserving multi-party data processing method, wherein the multi-party includes a first party and a second party, the first party possessing h sequentially arranged first real number vectors, and the second party possessing h sequentially arranged second real number vectors, wherein... The first and second real vectors in the same order form a set of real vectors for which the inner product is to be calculated. The h first real vectors and the h second real vectors constitute h sets of real vectors. The method is executed by the second party and includes: The first ciphertext is received from the first party. The first ciphertext is a homomorphic ciphertext of the first merge vector. The first merge vector is obtained by merging the h first real vectors, where h corresponds to N / L. The h components at the same position in each group of the h first real vectors are arranged consecutively in the first merge vector. N is the number of terms in the polynomial in the preset polynomial space. The first real vector and the second real vector include L components. The h second real vectors are merged into a second merged vector, wherein the h components at the same position in each of the h second real vectors are arranged consecutively in the second merged vector; The second merged vector is converted into a second plaintext polynomial, which includes N terms; Calculate the product of the first ciphertext and the second plaintext polynomial to obtain the second ciphertext; A homomorphic operation is performed on the second ciphertext to obtain the third ciphertext. The multiple components of the plaintext vector corresponding to the third ciphertext include the inner product of each of the h groups of real vectors.

10. A computing device comprising a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method of any one of claims 1-9.

Images