SM4 encryption method and system under BGV homomorphism

Abstract

The invention relates to the technical field of national secret, and provides an SM4 encryption method and system under BGV homomorphism, and the method comprises the steps: obtaining a plaintext; the method comprises the following steps: splitting a plaintext into a plurality of words, packaging each word into a BGV ciphertext, performing multiple rounds of encryption on all the BGV ciphertexts, and performing inverse transformation to obtain a final encryption result; wherein in each round of encryption, affine transformation and word shift operation in the S box are combined into linear transformation. The multiplication depth and the operation time of homomorphic operation are reduced, the operation efficiency is effectively improved, and noise accumulation is reduced.

Description

Technical Field

[0001] The present invention belongs to the field of national encryption technology, and in particular relates to an SM4 encryption method and system under BGV homomorphism. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] Fully homomorphic encryption algorithms can realize data operations in ciphertext state and are one of the main technologies for solving data privacy protection. However, its serious problems such as ciphertext expansion, low operating efficiency, and noise accumulation have become difficulties that restrict its application in cloud computing and other fields. The length of the original ciphertext will expand to several times the original length after homomorphic encryption. At the same time, as the homomorphic operation proceeds, the ciphertext length and noise will increase exponentially. Therefore, fully homomorphic encryption poses a considerable challenge to the client's computing power and transmission bandwidth.

[0004] Hybrid homomorphic encryption can effectively solve the above problems. Based on SM4, using the BGV fully homomorphic encryption algorithm to implement the homomorphic encryption and decryption circuit of SM4 can effectively avoid the ciphertext expansion problem of the fully homomorphic encryption algorithm. However, the problems of low operating efficiency and noise accumulation still exist. Summary of the invention

[0005] In order to solve the technical problems existing in the above-mentioned background technology, the present invention provides an SM4 encryption method and system under BGV homomorphism, which uses BGV byte packing technology to pack several bytes into a BGV ciphertext to realize multi-byte parallel operation, and merges the last layer of affine transformation and linear layer of SM4's S box, reduces the multiplication depth and operation time of homomorphic operation, effectively improves the operation efficiency, and reduces noise accumulation.

[0006] In order to achieve the above object, the present invention adopts the following technical solution:

[0007] A first aspect of the present invention provides an SM4 encryption method under BGV homomorphism, which includes:

[0008] Get the plaintext;

[0009] The plaintext is split into several words, each word is packaged into a BGV ciphertext, and all BGV ciphertexts are encrypted for multiple rounds, and then reversed to obtain the final encryption result;

[0010] In each round of encryption, the affine transformation and word shift operations in the S-box are combined into a linear transformation.

[0011] Furthermore, each round of encryption includes:

[0012] Add the first n-1 BGV ciphertexts and the homomorphic ciphertext of the round key to obtain the word addition result; where n represents the number of BGV ciphertexts;

[0013] Based on the word addition result, after affine transformation through linearized affine polynomial, the inverse operation is performed to obtain the result of the nonlinear layer;

[0014] After the results of the nonlinear layer are shifted between slots, they are affine transformed by linearizing the affine polynomial and then added to obtain the linear operation result;

[0015] Add the linear operation result to the nth BGV ciphertext to get the encryption result of one round.

[0016] Furthermore, after the inversion operation is converted into a power operation, an automorphism operation is used for calculation.

[0017] Furthermore, the plaintext is split into four 32-bit words, each word consisting of four bytes.

[0018] A second aspect of the present invention provides an SM4 encryption system under BGV homomorphism, comprising:

[0019] A data acquisition module is configured to: acquire plain text;

[0020] The encryption module is configured to: split the plaintext into several words, pack each word into a BGV ciphertext, perform multiple rounds of encryption on all BGV ciphertexts, and then perform reverse transformation to obtain the final encryption result;

[0021] In each round of encryption, the affine transformation and word shift operations in the S-box are combined into a linear transformation.

[0022] Furthermore, each round of encryption includes:

[0023] Add the first n-1 BGV ciphertexts and the homomorphic ciphertext of the round key to obtain the word addition result; where n represents the number of BGV ciphertexts;

[0024] Based on the word addition result, after affine transformation through linearized affine polynomial, the inverse operation is performed to obtain the result of the nonlinear layer;

[0025] After the results of the nonlinear layer are shifted between slots, they are affine transformed by linearizing the affine polynomial and then added to obtain the linear operation result;

[0026] Add the linear operation result to the nth BGV ciphertext to get the encryption result of one round.

[0027] Furthermore, after the inversion operation is converted into a power operation, an automorphism operation is used for calculation.

[0028] A third aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the SM4 encryption method under BGV homomorphism as described above.

[0029] The fourth aspect of the present invention provides a computer device, including a computer-readable storage medium, a processor, and a computer program stored on the computer-readable storage medium and executable on the processor, wherein when the processor executes the program, the steps of the SM4 encryption method under the BGV homomorphism as described above are implemented.

[0030] A fifth aspect of the present invention provides a computer program product, which is a computer program product containing a computer program. When a processor executes the computer program, the steps in the SM4 encryption method under BGV homomorphism as described above are implemented.

[0031] Compared with the prior art, the present invention has the following beneficial effects:

[0032] The present invention uses BGV byte packing technology to pack several bytes into a BGV ciphertext to realize multi-byte parallel operation, and merges the last layer of affine transformation and linear layer of SM4 S box, which reduces the multiplication depth and operation time of homomorphic operation, effectively improves the operation efficiency and reduces noise accumulation. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0034] Figure 1 This is a flowchart of an SM4 encryption method under BGV homomorphism according to the first embodiment of the present invention;

[0035] Figure 2 is a schematic diagram of word addition according to the first embodiment of the present invention;

[0036] Figure 3 is a schematic diagram of a linear layer according to a first embodiment of the present invention;

[0037] Figure 4 is a schematic diagram of adding B0 in Embodiment 1 of the present invention;

[0038] Figure 5 is a schematic diagram of the SM4 wheel function of the first embodiment of the present invention;

[0039] Figure 6 It is a structural diagram of a computer device according to a fourth embodiment of the present invention. DETAILED DESCRIPTION

[0040] To make the purpose, technical solution and advantages of the embodiments of the present invention more clear, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0041] It should be noted that the following detailed descriptions are all illustrative and intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0042] Terminology explanation:

[0043] BGV: Proposed in the article Fully Homomorphic Encryption without Bootstrapping published in 2012 by Professor Zvika Brakerski of Stanford, Researcher Craig Gentry of IBM, and Professor Vinod Vaikuntanathan of the University of Toronto, BGV is an integer fully homomorphic encryption method whose encryption domain can be a lattice or a polynomial ring, based on the LWE or RLWE hard problem.

[0044] SM4: Commercial encryption standard, its predecessor is the SMS4 algorithm; the SM4 algorithm is a block encryption algorithm with a block length and a key length of 128 bits; the SM4 algorithm uses a 32-round nonlinear iterative structure. SM4 adds a reverse transformation after the last round of nonlinear iteration. Therefore, in SM4, as long as the decryption key is the reverse order of the encryption key, its decryption algorithm can be consistent with the encryption algorithm.

[0045] Embodiment 1

[0046] This embodiment provides an SM4 encryption method under BGV homomorphism.

[0047] This embodiment provides an SM4 encryption method under BGV homomorphism, which is based on SM4 and uses the BGV fully homomorphic encryption algorithm to implement the homomorphic encryption and decryption circuit of SM4, effectively avoiding the ciphertext expansion problem existing in the fully homomorphic encryption algorithm. At the same time, the byte packing technology is used to pack several bytes into one ciphertext to realize multi-byte parallel operation, and the last layer of affine transformation and linear layer of the S-box of SM4 are merged, which reduces the multiplication depth and operation time of homomorphic operation, effectively improves the operation efficiency, and reduces noise accumulation.

[0048] The key to hybrid homomorphic encryption is to execute symmetric encryption and decryption circuits in a homomorphic manner. Therefore, the core technology of this embodiment is how to use the homomorphic operations in the BGV algorithm to efficiently implement the encryption and decryption circuits of SM4.

[0049] The SM4 algorithm is a Feistel structure algorithm. Decryption only requires running the encryption circuit on the ciphertext using the round key in reverse order. Therefore, the focus of this embodiment is mainly on the encryption and key expansion parts.

[0050] SM4 encryption: The encryption algorithm consists of 32 iterations and 1 reverse transformation. A plaintext group is 128 bits, which needs to be split into 4 32-bit words (X0, X1, X2, X3), each word consists of 4 bytes. Figure 5 As shown, each round of iterative operation first performs an XOR operation on X1, X2, and X3 with the round key rk, and then the result is subjected to a nonlinear transformation. The nonlinear transformation consists of four parallel S boxes with 8 inputs and 8 outputs. Each byte is used as the input of the S box. The output of the four S boxes is cascaded to obtain a 32-bit word, which is the output of the nonlinear layer. Then, the word is XORed with the result after 2, 10, 18, and 24 bits of circular left shift to obtain the output of the linear layer. The output result is XORed with X0 to obtain the result of this round of iteration. Each round of iteration generates a new 32-bit word, and the input of the next round of iteration is the last 3 words of the previous round input and the newly obtained previous word. Finally, the results of the last four rounds of iterations are output in reverse order to obtain the encrypted result.

[0051] SM4 key expansion: The key expansion algorithm is similar to the encryption algorithm process, with the following main differences:

[0052] 1) Before the first round of permutation, the four 32-bit words of the master key are XORed with the four system parameters Fk respectively;

[0053] 2) The circular shift during linear transformation is changed to 13 and 23 bit circular left shift respectively;

[0054] 3) Before each round of nonlinear transformation, the XOR results of X1, X2, and X3 are XORed with the system parameter Ck, one is used in each round, for a total of 32.

[0055] The BGV homomorphic encryption scheme relies on the RLWE difficulty problem. t ∈R p (x) / Φ m (x) is a D-degree polynomial modulo p, where R p (x) is the polynomial ring where the plaintext is located, p is the plaintext modulus, which is a prime number, Φ m (x) is a cyclotomic polynomial of degree m, with degree D, where D = φ(m) is the Euler function of m. Cyclotomic polynomials are irreducible over the ring of polynomials with integer coefficients, but reducible over the ring of polynomials modulo q, and can be written as the product of n irreducible polynomials, each of which is a polynomial of degree d, and nd = φ(m).

[0056] Ciphertext in is a polynomial ring R q (x) is an n+1 dimensional vector space, q is the ciphertext modulus, and n+1 is the ciphertext dimension. In the BGV encryption process, the above homomorphic parameters are first generated based on the security parameters, and then the private key is generated. The n-dimensional component after the private key is recorded as vector t, and a N×n-dimensional matrix is ​​randomly uniformly sampled Generate an N-dimensional noise vector e, calculate the vector b: = Bt + 2e, concatenate b with the matrix B to generate a public key

[0057] BGV encryption: The plaintext is a one-dimensional polynomial, which needs to be expanded into an n+1-dimensional vector when encrypted. Then randomly sample a coefficient vector Finally, the ciphertext c = M + r is calculated T A, in this case the ciphertext is an n+1 dimensional polynomial vector. In SM4, the corresponding plaintext modulus is 2, and its irreducible polynomial is a factor of the plaintext cyclotomic polynomial.

[0058] BGV decryption: When decrypting, you only need to do the inner product of the ciphertext and the private key, and take the modulus of q and 2 respectively to recover the plaintext. Where t is the vector composed of the last n-dimensional components of the private key s, B i is the i-th row vector of matrix B, e i is the component of the noise vector e, r i is the component of coefficient vector r, and the noise accumulation is When the noise accumulates to a certain extent due to homomorphic operations, decryption failure may occur, and a bootstrap operation needs to be performed on the ciphertext.

[0059] Among them, homomorphic operations include:

[0060] ① Addition: The addition between homomorphic ciphertexts is defined as vector addition, that is, adding each component of the ciphertext vector one by one;

[0061] ②Multiplication: Ciphertext multiplication is defined as the tensor product of vectors. After multiplying two ciphertexts, the corresponding keys also need to be multiplied, which will lead to the problem of dimensional expansion of ciphertexts and private keys. As the multiplication depth increases, the expansion of ciphertexts and private keys is exponential;

[0062] ③ Shift: Shift refers to the shift of the ciphertext on each slot between slots. The BGV scheme uses the Chinese remainder theorem to map the plaintext to several slots. Each slot is defined on a subring of the ring where the plaintext is located. Using Galois automorphism, the plaintext corresponding to each ciphertext can be cyclically shifted between slots.

[0063] ④ Power: The BGV scheme uses another automorphism, the Frobenius automorphism, to calculate the hth power of a polynomial;

[0064] ⑤ Packing: In BGV, a plaintext vector of length n is allowed to be encoded as a polynomial, so a vector can be encrypted into a BGV ciphertext. According to the Chinese remainder theorem, the elements on the polynomial ring defined by a cyclotomic polynomial with a modulus of p can be written in the form of a vector composed of several polynomials. The cyclotomic polynomial is decomposed into several factors, and the modulus of the elements on the ring to these factors is calculated as each component of this vector. The position of each component is called a slot. Adding two polynomials is equivalent to adding each component of the two vectors. Using this, several polynomials can be packed into a single polynomial, and operating on this single polynomial is equivalent to operating on all polynomials at the same time. Therefore, the size of the ciphertext depends on the exact number of slots of the vector filled during the encryption process. This packing is similar to the single instruction multiple data (SIMD) instruction on the CPU, which can greatly increase the throughput of homomorphic encryption applications and reduce ciphertext expansion. The operations supported by this packing include addition, multiplication, power operation, and slot shift. However, once encrypted, a single slot of the encrypted vector cannot be directly accessed.

[0065] The BGV implementation of SM4 is divided into two main steps: the implementation of the nonlinear layer and the implementation of the linear layer.

[0066] (1) Nonlinear layer implementation: The nonlinear operation of the S-box of SM4 is a finite field The inverse operation on plus affine transformation, for the inverse operation, use the following formula:

[0067]

[0068] Convert the inversion operation to a power operation; then use the Frobenius automorphism operation to calculate x 254 .

[0069] Among them, the finite field It is an 8-dimensional extended field, each component is in a bit field F2, addition on the field is defined as the addition of each component separately, and multiplication on the field is defined as multiplication of modular irreducible polynomials. Finite field It is the finite field where the S-box of SM4 is located.

[0070] Table 1 shows the 3-depth inversion algorithm and the multiplication depth of each step, where c n ←c>>n means that the ciphertext c is calculated through Frobenius automorphism to obtain the result c of its nth power. n , let the multiplication depth before the inversion operation begin be t, and the Frobenius automorphism does not increase the multiplication depth.

[0071] Table 1. S-box inversion operation

[0072] operate Multiplication Depth Instructions <![CDATA[1.c2←c>>2]]> t <![CDATA[Frobenius automorphism X→X 2 > <![CDATA[1.c2←c×c2]]> t+1 Homomorphic multiplication <![CDATA[1.c 12 ←c3>>4]]> t+1 <![CDATA[Frobenius automorphism X→X 4 > <![CDATA[1.c 14 ←c 12 ×c2]]> t+2 Homomorphic multiplication <![CDATA[1.c 15 ←c 12 ×c3]]> t+2 Homomorphic multiplication <![CDATA[1.c 240 ←c 15 >>16]]> t+2 <![CDATA[Frobenius automorphism X→X 16 > <![CDATA[1.c 254 ←c 240 ×c 14 ]]> t+3 Homomorphic multiplication

[0073] (2) Linear layer implementation: The affine transformation and word shift operations in the S-box of the SM4 algorithm are both linear operations. For linear operations, linearized affine polynomials are used for implementation.

[0074] Convert the affine transformation of the SM4 S-box into The linearized affine polynomial on is as follows:

[0075]

[0076] Linearize the affine polynomial A Sbox (x) is a finite field The polynomial on The affine transformation applied by matrix multiplication and the calculation result of inputting x as a variable into the polynomial are two equivalent linear mappings. The coefficients of each term in the polynomial, such as 0xd3, are obtained by performing 9 interpolation calculations on the affine transformation. Different affine transformations correspond to different linearized affine polynomials. The power operation in the polynomial is implemented using Frobenius automorphisms, which basically does not increase noise. 8 corresponding power results are calculated, and these power results are multiplied by homomorphic constants. The multiplication depth is recorded as 0.5. In total, 8 homomorphic multiplications, 8 Frobenius automorphisms, and 8 homomorphic additions are required. The overall multiplication depth of the affine transformation is 0.5.

[0077] The word shift can be represented by matrix multiplication. The shift matrix M of SM4 can be divided into 16 8*8 sub-matrices, namely:

[0078]

[0079] The linear transformation input 32-bit number B is split into (B0, B1, B2, B3) according to the byte. The linear transformation can be expressed as:

[0080]

[0081] In this way, the linear transformations corresponding to the three sub-matrices A0, A1, and A2 can be converted into three linearized affine polynomials, and each byte of the word B can be linearly transformed. First, the word is circularly shifted by 1, 2, and 3 slots respectively, and then the three shifted words and the initial word are linearly transformed using the polynomials, and finally the results of the linear transformations are added to obtain the final result. To linearly transform a word, 3 Frobenius automorphisms, 8 homomorphic multiplications, and 7 homomorphic additions are required, and the multiplication depth is 0.5.

[0082] Linear layer optimization: Note that the affine transformation of the S-box and the linear transformation of the subsequent word shift are both linear operations, so they can be merged into one linear transformation to reduce the multiplication depth. The process of merging linear layers can be expressed as follows:

[0083] A i ·(M2·B ij + C2) = A i ·M2·B ij +A i C2=A′ i ·B i +C′2

[0084] Where M2 and C2 are bytes B ij The matrix and constants corresponding to the second affine transformation required when passing through the S-box, A i is the submatrix in the shift matrix M, A′ i and C′2 are the matrices and constants corresponding to the new affine transformation obtained after synthesizing the two transformations, and A′ i =A i M2 and C′2=A i C2 holds. We only need to replace the linearized polynomial in the linear transformation with the composite polynomial. The three different sub-matrices correspond to three polynomials, denoted as A. D0′ ,A D1′ ,A D2′ :

[0085]

[0086] Among them, f, e, b, c, a, and d are all hexadecimal numbers. The coefficient of each term in the polynomial consists of two hexadecimal digits, and the polynomial coefficients are obtained by interpolation calculation of linear transformation.

[0087] By merging linear layers, one affine transformation is reduced per round and the multiplication depth is reduced by 0.5.

[0088] This embodiment provides an SM4 encryption method under BGV homomorphism, such as Figure 1 As shown, the following steps are included:

[0089] A state matrix of SM4-128 contains 4 32-bit words, a total of 16 bytes. Using a 4-byte packing scheme, 4 bytes are packed into a BGV ciphertext (that is, 1 32-bit word (X0 or X1 or X2 or X3) is packed into a BGV ciphertext), which can reduce the operational constraints of word splitting. Each ciphertext is grouped into 4 slots, and a plaintext byte is placed on each slot, requiring a total of 4 BGV ciphertexts C0, C1, C2, C3. Since a ciphertext contains multiple groups of slots, several groups of SM4 state matrices can be operated at once.

[0090] 1) Word addition: The first three BGV ciphertexts C0, C1, C2 and the homomorphic ciphertext Rk of the round key are added to obtain the word addition result R;

[0091] Specifically, Figure 2 As shown, assume that Rk=(k00, k01, k02, k03), C0=(B30, B31, B32, B33), C1=(B20, B21, B22, B23), C2=(B10, B11, B12, B13), C3=(B00, B01, B02, B03), where kij represents an element in the homomorphic ciphertext of the round key, and Bij represents a byte; Rk+C0+C1+C2=R=(R0, R1, R2, R3).

[0092] 2) Through the S-box: Input R into the linearized affine polynomial to obtain the result of the first layer affine transformation, and then perform the inversion operation on the result of the affine transformation to obtain the output result of the nonlinear layer;

[0093] Specifically, for each byte Ri in R = (R0, R1, R2, R3), calculate A Sbox (Ri) Get the first layer affine transformation result, and then calculate A for each affine transformed byte according to the steps in Table 1 Sbox (Ri) 254 , and the nonlinear layer output is obtained. For the convenience of representation, the result is still recorded as R, that is, R = ((A Sbox (R0) 254 , (A Sbox (R1) 254 , (A Sbox (R2) 254 , (A Sbox (R3) 254 ).

[0094] 3) Linear layer: such as Figure 3As shown, the output results of the nonlinear layer are shifted between slots to obtain R0 = (R0, R1, R2, R3) (no shift), R1 = (R3, R0, R1, R2) (shifted 12 slots), R2 = (R2, R3, R0, R1) (shifted 8 slots), R3 = (R1, R2, R3, R0) (shifted 4 slots), and input into the merged linearized affine polynomial A D0′ , A D1′ , A D2′ In the example, we obtain three intermediate results of linearized affine respectively, and then add the three results to get the result of linear operation:

[0095] S=A′0R0+A′2R1+A′1R2+A′1R3

[0096] =(A D0′ (R0), A D0′ (R1), A D0′ (R2),A D0′ (R3))+(A D2′ (R3),A D2′ (R0),A D2′ (R1), A D2′ (R2))+(A D1′ (R2),A D1′ (R3), A D1′ (R0), A D1′ (R1))+(A D1′ (R1),A D1′ (R2), A D1′ (R3),A D1′ (R0)

[0097] Where A′ i R j Represents vector R j Each byte and matrix A′ i The multiplication operation A Di′ (Rj) represents the linearized affine polynomial A applied to Rj Di′ , the linearized affine polynomials corresponding to the three transformations are:

[0098]

[0099] 4) Add B0: Add the linear operation result S and the fourth ciphertext C3 to obtain the result of one round of encryption B4 = (B40, B41, B42, B43). Replace C3 with B4 to enter the next round of encryption.

[0100] Specifically, Figure 4 As shown, B4=S+C3.

[0101] It should be noted that all bytes in the state matrix of SM4 are packed in a homomorphic ciphertext. It is necessary to add a word splitting operation before the first step of word addition, splitting a single 16-byte ciphertext into 4 4-byte ciphertexts. The subsequent homomorphic operations are the same. After obtaining a round of results, the matrix needs to be restored, that is, the output word of the current round and the next three input words together form a new 16-byte matrix. The use of a 16-byte packing scheme will only increase the operation time and noise accumulation, and will not have a practical improvement effect. Similarly, there are single-byte schemes and bit circuit schemes, which are to pack each byte into a ciphertext and each bit into a ciphertext. In the bit circuit scheme, each ciphertext representing 1 bit needs to be operated according to the Boolean circuit of SM4. Its implementation principle is a bit-level circuit, while the operations of the 16-byte, 4-byte and single-byte schemes are all byte-level circuits. After comparison, the bit circuit scheme, the 16-byte packing scheme, and the single-byte packing scheme are not as good as the 4-byte packing scheme in terms of operating efficiency and noise accumulation.

[0102] This embodiment provides an SM4 encryption method under BGV homomorphism, which optimizes the homomorphic implementation of SM4 by using the strategy of byte packing and merging linear layers. As shown in Tables 2, 3 and 4, compared with the solution using Boolean circuit implementation and the solution without merging linear layers, it has obvious advantages in multiplication depth, running time, noise accumulation, etc., and at the same time, it surpasses the hybrid homomorphic encryption implemented by the AES algorithm at the same security level in terms of speed.

[0103] Table 2. Test environment

[0104]

[0105] Table 3. Operation efficiency and noise accumulation

[0106] Implementation Serial running time (s) Noise capacity remaining SM4 - Boolean Circuit 1172 190 SM4 - Packed - Unmerged Linear Layers 104 227 AES-Packing 84 - SM4 - Packing-Merging Linear Layer 72 313

[0107] Table 4. Optimized multiplication depth

[0108]

[0109] Embodiment 2

[0110] This embodiment provides an SM4 encryption system under BGV homomorphism, which specifically includes:

[0111] A data acquisition module is configured to: acquire plain text;

[0112] The encryption module is configured to: split the plaintext into several words, pack each word into a BGV ciphertext, perform multiple rounds of encryption on all BGV ciphertexts, and then perform reverse transformation to obtain the final encryption result;

[0113] In each round of encryption, the affine transformation and word shift operations in the S-box are combined into a linear transformation.

[0114] It should be noted here that each module in this embodiment corresponds to each step in Example 1 one by one, and the specific implementation process is the same, which will not be repeated here.

[0115] Embodiment 3

[0116] This embodiment provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps of the SM4 encryption method under BGV homomorphism as described in the above embodiment 1 are implemented.

[0117] Embodiment 4

[0118] This embodiment provides a computer device, such as Figure 6 As shown, it includes a computer-readable storage medium 1003, a processor 1001, a communication interface 1002, and a computer program stored on the computer-readable storage medium 1003 and executable on the processor 1001, wherein the processor 1001, the communication interface 1002, and the computer-readable storage medium 1003 can be connected via a bus or other means. The communication interface 1002 is used to receive and send data, and when the processor 1001 executes the program, the steps in the SM4 encryption method under the BGV homomorphism described in the first embodiment are implemented.

[0119] Embodiment 5

[0120] This embodiment provides a computer program product, which is a computer program product containing a computer program. When a processor executes the computer program, the steps of the SM4 encryption method under BGV homomorphism as described in the above embodiment 1 are implemented.

[0121] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0122] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0123] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0124] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A SM4 encryption method under BGV homomorphism, characterized in that: include: Get the plaintext; The plaintext is split into several words, each word is packaged into a BGV ciphertext, and all BGV ciphertexts are encrypted for multiple rounds, and then reversed to obtain the final encryption result; In each round of encryption, the affine transformation and word shift operations in the S-box are combined into a linear transformation.

2. The SM4 encryption method under BGV homomorphism as claimed in claim 1, characterized in that: The steps of each round of encryption include: Add the first n-1 BGV ciphertexts and the homomorphic ciphertext of the round key to obtain the word addition result; where n represents the number of BGV ciphertexts; Based on the word addition result, after affine transformation through linearized affine polynomial, the inverse operation is performed to obtain the result of the nonlinear layer; After the results of the nonlinear layer are shifted between slots, they are affine transformed by linearizing the affine polynomial and then added to obtain the linear operation result; Add the linear operation result to the nth BGV ciphertext to get the encryption result of one round.

3. The SM4 encryption method under BGV homomorphism as claimed in claim 2, characterized in that: After the inversion operation is converted into a power operation, the calculation is performed using an automorphism operation.

4. The SM4 encryption method under BGV homomorphism as claimed in claim 1, characterized in that: The plaintext is split into 4 32-bit words, each word consisting of 4 bytes.

5. A BGV homomorphic SM4 encryption system, characterized in that: include: A data acquisition module is configured to: acquire plain text; The encryption module is configured to: split the plaintext into several words, pack each word into a BGV ciphertext, perform multiple rounds of encryption on all BGV ciphertexts, and then perform reverse transformation to obtain the final encryption result; In each round of encryption, the affine transformation and word shift operations in the S-box are combined into a linear transformation.

6. The SM4 encryption system under BGV homomorphism as claimed in claim 5, characterized in that: The steps of each round of encryption include: Add the first n-1 BGV ciphertexts and the homomorphic ciphertext of the round key to obtain the word addition result; where n represents the number of BGV ciphertexts; Based on the word addition result, after affine transformation through linearized affine polynomial, the inverse operation is performed to obtain the result of the nonlinear layer; After the results of the nonlinear layer are shifted between slots, they are affine transformed by linearizing the affine polynomial and then added to obtain the linear operation result; Add the linear operation result to the nth BGV ciphertext to get the encryption result of one round.

7. The SM4 encryption system under BGV homomorphism as claimed in claim 6, characterized in that: After the inversion operation is converted into a power operation, the calculation is performed using an automorphism operation.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the SM4 encryption method under BGV homomorphism as described in any one of claims 1 to 4 are implemented.

9. A computer device comprising a computer-readable storage medium, a processor, and a computer program stored on the computer-readable storage medium and executable on the processor, characterized in that: When the processor executes the program, the steps in the SM4 encryption method under BGV homomorphism as described in any one of claims 1-4 are implemented.

10. A computer program product, which is a computer program product containing a computer program, characterized in that When the processor executes the computer program, the steps of the SM4 encryption method under BGV homomorphism as described in any one of claims 1 to 4 are implemented.

Images