A n-choose-k oblivious transmission method based on homomorphic encryption

Abstract

The invention discloses a method for n-select-k oblivious transmission based on homomorphic encryption, including: generating a pair of homomorphic encryption public and private keys at the receiver end and making the public key public; generating coefficient matrices at both ends in collaboration; using public key encryption after encoding k selected bits and n-k non-selected bits at the receiver end to obtain n homomorphic ciphertexts, and generating a digital homomorphic ciphertext, which is sent to the transmitter end; generating a symmetric key at the transmitter end to encrypt n salted messages, obtain n symmetric ciphertexts, and multiplying the homomorphic ciphertexts and the coefficient matrix to obtain k ciphertexts; obtaining the digital homomorphic ciphertext product based on the symmetric key and the digital homomorphic ciphertext; sending to the receiver end; decrypting the k ciphertexts and the digital homomorphic ciphertext product at the receiver end, recovering k symmetric ciphertexts and symmetric keys; desalting the k symmetric ciphertexts with the symmetric key, and obtaining k messages. The method achieves a balance between computational and communication complexity, and provides a safe and efficient n-select-k oblivious transmission protocol.

Description

Technical Field

[0001] The present invention relates to the technical field of ciphertext data transmission, and more specifically to an n-choose-k oblivious transmission method based on homomorphic encryption. Background Art

[0002] At present, the oblivious transfer protocol is a secure multi-party computing protocol that allows the sender to send multiple messages to the receiver, while the receiver only chooses to receive part of the information. The sender cannot know the specific information selected by the receiver. This protocol has important application value in multi-party secure computing and privacy protection, and can effectively protect the private data of participants. In the oblivious transfer protocol, the n-choose-k oblivious transfer method allows the receiver to obtain multiple messages in one operation, while the n-choose-1 method can only obtain one message. For some application scenarios, the receiver may need to obtain multiple messages at the same time, so the n-choose-k design can significantly improve efficiency. There is no need to repeat multiple n-choose-1 operations, which can reduce the communication rounds and data transmission overhead and improve the overall communication efficiency of the protocol. Secondly, the n-choose-k oblivious transfer protocol performs better in many complex application scenarios. For example, in scenarios such as private set intersection or private information retrieval, the receiver usually needs to obtain multiple data, and the n-choose-k protocol can meet this demand more efficiently.

[0003] With the rapid development of information technology, data security and privacy protection have become increasingly important. In this context, homomorphic encryption, as a cutting-edge encryption technology, allows encrypted data to be calculated without decryption, thereby protecting data privacy while achieving effective data processing. Calculations on ciphertext data are equivalent to calculations on plaintext, and are an ideal privacy computing technology. Although homomorphic encryption has low communication complexity, its computational complexity is high. Based on this, although there are precedents in the prior art for applying homomorphic encryption technology to oblivious transmission methods, there are still defects of large computational complexity. For example, in the invention patent application with publication number CN116781243A, entitled A Method, Medium and Electronic Device for Oblivious Transmission Based on Homomorphic Encryption, the overhead of using a homomorphic encryption method to generate an auxiliary homomorphic ciphertext matrix is ​​very large, and because the use of asymmetric encryption RSA public key and ciphertext obfuscation technology can only generate a valid symmetric key, only an n-choose-1 oblivious transmission protocol can be implemented. Although the communication complexity is reduced compared to traditional technologies, the computational complexity is greatly increased. Another example is the invention patent application with publication number CN118842659A, entitled "An RSA-based n-choose-k oblivious transfer method". This patent is based on the RSA algorithm and focuses on protecting k symmetric keys. In other words, these two patents are used to protect symmetric keys, and then use different symmetric keys to protect different messages, thereby implementing the n-choose-k oblivious transfer protocol, rather than directly protecting the message itself.

[0004] The invention patent application with publication number CN117910034A and name "A multi-keyword privacy information retrieval method, device and system for vulnerability scanning"; and the invention patent application with publication number CN117892342A and name "A vulnerability retrieval method based on homomorphic encryption and oblivious transfer"; both of these invention patent applications first use homomorphic encryption and then use oblivious transfer technology to jointly complete a certain privacy computing technology, rather than using homomorphic encryption technology for another oblivious transfer protocol, and cannot improve the n-choose-k oblivious transfer protocol.

[0005] Semi-honest setting refers to a secure multi-party computing protocol in which all participants follow the protocol steps, but may calculate other people's data based on the data in the protocol. Secure multi-party computing and homomorphic encryption are both key technologies of privacy computing. Secure multi-party computing has high communication complexity and low computational complexity, while homomorphic encryption has high computational complexity and low communication complexity.

[0006] Therefore, how to balance computational complexity and communication complexity based on secure multi-party computing and homomorphic encryption to implement a secure and efficient n-choose-k oblivious transfer protocol is an urgent problem that technical personnel in this field need to solve. Summary of the invention

[0007] In view of the above problems, the present invention provides an n-out-of-k oblivious transmission method based on homomorphic encryption to at least solve some of the technical problems mentioned in the above background technology.

[0008] In order to achieve the above object, the present invention adopts the following technical solution:

[0009] The present invention provides an n-choose-k oblivious transmission method based on homomorphic encryption, comprising the following steps:

[0010] S1. Generate a pair of homomorphic encryption public and private keys at the receiving end, and send the homomorphic encryption public key to the sending end; and collaboratively generate a k*n coefficient matrix based on the receiving end and the sending end;

[0011] S2, at the receiving end, respectively encode k selected bits and nk non-selected bits; encrypt n codes using the homomorphic encryption public key to obtain n homomorphic ciphertexts, and simultaneously generate a digital homomorphic ciphertext of a number; send the n homomorphic ciphertexts and the digital homomorphic ciphertext to the sending end in sequence;

[0012] S3, at the sender end, generating a symmetric key; adding salt to the n messages to be sent; and symmetrically encrypting the n messages after adding salt using the symmetric key to obtain n symmetric ciphertexts;

[0013] S4, at the sender end, correspondingly multiplying the n homomorphic ciphertexts and the n symmetric ciphertexts to obtain n ciphertexts; performing point multiplication on the n ciphertexts and the k*n coefficient matrix to obtain k ciphertexts; multiplying the symmetric key and the digital homomorphic ciphertext to obtain a digital homomorphic ciphertext product; and sending the k ciphertext and the digital homomorphic ciphertext product to the receiver end;

[0014] S5. At the receiving end, construct a group of equations according to the matrix coefficients corresponding to the k selected bits and the k ciphertexts; solve the group of equations to recover the k symmetric ciphertexts; decrypt the digital homomorphic ciphertext product based on the homomorphic encryption private key to recover the symmetric key; decrypt the k symmetric ciphertexts using the symmetric key and then perform a desalting operation to obtain k messages.

[0015] Furthermore, in the step S1, it also includes:

[0016] Or, generating a k*n coefficient matrix through the receiving end and sending it to the sending end;

[0017] Or, a k*n coefficient matrix is ​​generated by the sending end and sent to the receiving end.

[0018] Furthermore, in step S1, the k*n coefficient matrix satisfies that any k-order submatrix is ​​a full-rank matrix.

[0019] Further, in step S2, respectively encoding the k selected bits and the nk non-selected bits specifically includes:

[0020] Encode each selected bit as 1000000; encode each non-selected bit as 0000000.

[0021] Furthermore, the homomorphic encryption is Paillier semi-homomorphic encryption, CKKS fully homomorphic encryption, or fully homomorphic encryption based on modular components.

[0022] Further, for the fully homomorphic encryption of the module component, the use of the homomorphic encryption public key to encrypt n codes to obtain n homomorphic ciphertexts specifically includes:

[0023] Generate a random number for each code as scrambling information;

[0024] Based on the modulus component, the n codes after adding the scrambling information are encrypted using the homomorphic encryption public key to obtain the corresponding real modulus component; expressed as:

[0025]

[0026] Among them, y ijRepresents the i-th code S i The corresponding j-th real modulus component; r i Represents the i-th code S i The corresponding scrambling information; b j represents the jth modulus in the common modulus component;

[0027] According to the positional basis of the homomorphic encryption private key, the real modulus component is filled, and the remaining positions are filled with random numbers to obtain n homomorphic ciphertexts.

[0028] Furthermore, in the step S3, salt filling is performed on the n messages to be sent, specifically including:

[0029] The sender uses a salting technique to generate n random numbers, and performs salting filling on the n messages to be sent.

[0030] Furthermore, in the step S5, the digital homomorphic ciphertext product is decrypted based on the homomorphic encryption private key to recover the symmetric key; specifically including:

[0031] When the value of the number is 1, the digital homomorphic ciphertext product is decrypted by the homomorphic encryption private key to recover the symmetric key;

[0032] When the value of the number is not 1, the digital homomorphic ciphertext product is decrypted by the homomorphic encryption private key and then divided by the value corresponding to the number to restore the symmetric key.

[0033] It can be seen from the above technical solution that, compared with the prior art, the present invention discloses a method for n-choose-k oblivious transmission based on homomorphic encryption, which has the following beneficial effects:

[0034] The present invention utilizes the homomorphism of homomorphic multiplication and addition and the unique solution of the full-rank equation group to ensure that only k ciphertexts are true ciphertexts. Compared with other existing technologies, the present invention has the characteristics of small communication volume and wide application, and meets the requirements of efficient and secure n-choose-k non-transmission solutions in many occasions.

[0035] The present invention uses homomorphic encryption and symmetric encryption to directly protect messages, with smaller communication volume and stronger security. Symmetric encryption has the characteristics of small computational complexity. However, in the present invention, since each symmetric key is the same, the present invention adopts salting technology in the hybrid encryption of symmetric encryption and homomorphic encryption to meet the anti-exhaustive attack of the scheme and further improve the security of symmetric encryption.

[0036] The present invention can adopt semi-homomorphic encryption and fully homomorphic encryption schemes, and can therefore be applied to a variety of privacy computing scenarios.

[0037] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0039] Figure 1 A flow chart of an n-out-of-k oblivious transmission method based on homomorphic encryption provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0040] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0041] The embodiment of the present invention discloses an n-choose-k oblivious transmission method based on homomorphic encryption, comprising:

[0042] S1. Generate a pair of homomorphic encryption public and private keys at the receiving end, and send the homomorphic encryption public key to the sending end; based on the collaborative generation of a k*n coefficient matrix between the receiving end and the sending end;

[0043] S2. At the receiving end, respectively encode the k selected bits and nk non-selected bits; encrypt the n codes using the homomorphic encryption public key to obtain n homomorphic ciphertexts, and generate a digital homomorphic ciphertext of a number; send the n homomorphic ciphertexts and the digital homomorphic ciphertext to the sending end in sequence;

[0044] S3. At the sender end, generate a symmetric key; add salt to the n messages to be sent; use the symmetric key to symmetrically encrypt the n messages after adding salt to obtain n symmetric ciphertexts;

[0045] S4. At the sender end, n homomorphic ciphertexts and n symmetric ciphertexts are correspondingly multiplied to obtain n ciphertexts; n ciphertexts are point-multiplied with a k*n coefficient matrix to obtain k ciphertexts; the symmetric key is multiplied with the digital homomorphic ciphertext to obtain the digital homomorphic ciphertext product; the k ciphertexts and the digital homomorphic ciphertext product are sent to the receiver end;

[0046] S5. At the receiving end, a system of equations is constructed based on the matrix coefficients corresponding to the k selected bits and the k ciphertexts; the system of equations is solved to recover the k symmetric ciphertexts; the product of the digital homomorphic ciphertexts is decrypted based on the homomorphic encryption private key to recover the symmetric key; the k symmetric ciphertexts are decrypted using the symmetric key and then desalted to obtain k messages.

[0047] This method is targeted at the n-choose-k protocol. It does not require the pre-generation of the ciphertext auxiliary matrix and the RSA public key. It uses the polynomial properties, homomorphic properties, and symmetric salting operations to implement a secure semi-honest n-choose-k oblivious transfer protocol that is resistant to attacks. Next, each of the above steps is described in detail.

[0048] In the above step S1, a pair of homomorphically encrypted public and private keys is generated at the receiving end, and the homomorphically encrypted public key is sent to the sending end; a k*n coefficient matrix is ​​collaboratively generated based on the receiving end and the sending end; specifically:

[0049] The receiving end generates a pair of homomorphic encryption public and private keys (PK, SK) and makes the homomorphic encryption public key (PK) public; that is, the homomorphic encryption public key is sent to the sending end so that the sending end can use the homomorphic encryption public key for encryption operations; and the homomorphic encryption private key (SK) is retained by the receiving end for subsequent decryption operations.

[0050] Since the homomorphic ciphertext operation of the present invention only involves one multiplication and several additions, Paillier semi-homomorphic encryption can be selected, or CKKS fully homomorphic encryption scheme or fully homomorphic encryption scheme based on modular components can be selected. Taking the fully homomorphic encryption scheme based on modular components as an example, it can be assumed that the public modular components B={b1,b2,...,b t}, where b t represents the t-th modulus in B, any two moduli in the public modulus component B are mutually prime; the position basis of the homomorphic encryption private key is = {w1,w2,...w t}, where w t Represents the tth position in W. For details about the homomorphic encryption scheme of the modular component, please refer to patent CN111526000A.

[0051] The receiving end and the sending end jointly generate a k*n coefficient matrix, denoted as A; either the receiving end generates a k*n coefficient matrix and makes it public, or the sending end generates a k*n coefficient matrix and makes it public. The k*n coefficient matrix A satisfies that any k-order submatrix is ​​a full-rank matrix, which is used to prevent the receiving end from cheating and preventing the receiving end from obtaining more messages. The k*n coefficient matrix A is expressed as:

[0052]

[0053] in, Represents the element in the kth row and nth column of the k*n coefficient matrix A;

[0054] In the above step S2, at the receiving end, k selected bits and nk non-selected bits are encoded respectively; each selected bit is encoded as 1000000; each non-selected bit is encoded as 0000000, and a total of n codes are obtained; the n codes are encrypted using the homomorphic encryption public key to obtain n homomorphic ciphertexts, and a digital homomorphic ciphertext of a number is generated at the same time; the n homomorphic ciphertexts and the digital homomorphic ciphertext are sent to the sending end in sequence;

[0055] In the above encoding process, the original selected bit is 1 and the non-selected bit is 0; the original selected bit is 1 and encoded as 1000000, which is equivalent to multiplying the selected bit by one million (the decrypted result can be divided by one million without affecting the result), and the non-selected bit is encoded as 0000000 and 0. The reason for encoding here is to cover CKKS, Paillier, and different homomorphic encryption algorithms based on modular components.

[0056] The above k selection bit sets are expressed as ; Wherein, represents the kth selection bit;

[0057] Among them, for the fully homomorphic encryption of the module component, n codes are encrypted using a homomorphic encryption public key to obtain n homomorphic ciphertexts, specifically including:

[0058] (1) Generate a random number as scrambling information for each code. These n random numbers are represented as r={r1,r2,...r n};

[0059] (2) Based on the modulus component, use the homomorphic encryption public key to encrypt the n codes after adding the scrambling information to obtain the corresponding true modulus component; expressed as:

[0060]

[0061] Among them, y ij Represents the i-th code S i The corresponding j-th real modulus component, j={1,...t}; r i Represents the i-th code S i The corresponding scrambling information; b j represents the jth modulus in the common modulus component;

[0062] (3) According to the position basis W of the homomorphic encryption private key, the real modulus component is filled, and the remaining positions are filled with random numbers to obtain n two-dimensional homomorphic encryption ciphertexts, referred to as n homomorphic ciphertexts; due to the existence of the above-mentioned scrambling information, the ciphertexts are indistinguishable.

[0063] After obtaining n homomorphic ciphertexts, encrypt a number to obtain the digital homomorphic ciphertext of the number; for example, encrypt the number "1" to obtain the homomorphic encrypted ciphertext of the number "1". The digital homomorphic ciphertext here is for homomorphic multiplication with the symmetric key in the subsequent step S4. In this way, the symmetric key always remains encrypted during the transmission process and will not be intercepted or tampered with by the middleman. It can also ensure that the receiving end can correctly decrypt the symmetric key using homomorphism, thereby ensuring the security of the key.

[0064] Finally, the receiver sends the n homomorphic ciphertexts and digital homomorphic ciphertexts to the sender in sequence.

[0065] In the above step S3, at the sender end, a symmetric key is generated; the n messages to be sent are salted and filled; the n messages filled with salt are symmetrically encrypted using the symmetric key to obtain n symmetric ciphertexts; specifically:

[0066] (1) Salting technology refers to adding a random string or random number to the encrypted data before encrypting it. In the process of implementing security protocols, salting technology is widely used in symmetric encryption to improve the security of cryptographic systems. It can effectively prevent dictionary attacks and collision attacks, increasing the difficulty of cracking. The above-mentioned salting of the n messages to be sent specifically includes: using salting technology at the sender end to generate n random numbers, and salting the n messages to be sent; salting can be expressed as:

[0067]

[0068] Among them, m i Indicates the i-th message to be sent; Represents the i-th message after salt filling; Slat i Indicates the salt value, .

[0069] (2) The above uses a symmetric key to symmetrically encrypt the n messages after salting, expressed as:

[0070]

[0071] Where E(·) represents symmetric encryption; key represents the symmetric key, and C i Indicates m i The corresponding ciphertext;

[0072] In the above step S4, at the sender end, n homomorphic ciphertexts and n symmetric ciphertexts are correspondingly multiplied to obtain n ciphertexts; n ciphertexts are point-multiplied with a k*n coefficient matrix to obtain k ciphertexts; the symmetric key is multiplied with the digital homomorphic ciphertext to obtain the digital homomorphic ciphertext product; the k ciphertexts and the digital homomorphic ciphertext product are sent to the receiver end;

[0073] The multiplication principle is expressed as:

[0074]

[0075] in, represents the element in the kth row and nth column of the k*n coefficient matrix A; He(·) represents the encryption of the homomorphic encryption scheme; He(1) represents the homomorphic encryption of the original selected bit 1 (after non-coding); He(0) represents the homomorphic encryption of the original non-selected bit 0 (after non-coding); m n represents the nth message to be sent; the formula represents the effect of multiplying the message by the corresponding item of the matrix element and the homomorphic ciphertext;

[0076]

[0077] Among them, TC k represents the kth ciphertext. This formula is an extension of the previous formula, which shows that the calculated k ciphertexts can be inversely solved using the equation group.

[0078] In the above step S5, at the receiving end, a system of equations is constructed according to the matrix coefficients corresponding to the k selected bits and the k ciphertexts; the system of equations is solved to recover the k symmetric ciphertexts; the digital homomorphic ciphertext product is decrypted based on the homomorphic encryption private key to recover the symmetric key; the k symmetric ciphertexts are decrypted by the symmetric key and then desalted to obtain k messages; specifically:

[0079] (1) The receiver forms a k*k matrix of equations based on the matrix coefficients corresponding to the selected bits being 1, and takes the k ciphertexts sent by the sender as the result. The equations are solved to obtain a unique solution, which is the symmetric ciphertext corresponding to the k selected bits.

[0080] (2) Use the homomorphic encryption private key to decrypt the homomorphically encrypted key (i.e., the digital homomorphic ciphertext product) to obtain the symmetric key key; expressed as:

[0081] key = De (key * He(f ))

[0082] Where De(·) represents homomorphic decryption; He(f ) represents generating a number f and performing homomorphic encryption; the purpose is to use the properties of homomorphic multiplication to protect the symmetric key;

[0083] For example, when the digital homomorphic ciphertext of the number "1" is generated in step S2, because 1 multiplied by any number is equal to 1, the symmetric key is obtained after homomorphic decryption (1*key = key). When the digital homomorphic ciphertext of the number "2" is generated in step S2 (other numbers are the same), the plaintext after homomorphic decryption is (2*key), and the receiving end needs to perform a division (key=[2*key] / 2) to obtain the symmetric key; that is, after decrypting the digital homomorphic ciphertext product with the homomorphic encryption private key, divide it by the value corresponding to the number to recover the symmetric key.

[0084] (3) Use the symmetric key key to decrypt k symmetric ciphertexts and obtain k salted messages; then extract k messages (m k , ).

[0085] Next, the correctness and security of the n-choose-k oblivious transmission method based on homomorphic encryption provided by the present invention are explained.

[0086] 1. Proof of Correctness:

[0087] Theorem 1: For a given k*k full-rank augmented matrix, there is a unique solution.

[0088] Proof: Let the augmented matrix be [A|b], where A is a k*k coefficient matrix and b is a k-dimensional column vector. Since A is full rank, it means that its rank rank(A)=k. According to the basic principles of linear algebra, the solution of the full rank square matrix A satisfies:

[0089] 1. Invertibility of full-rank matrices: If A is full-rank, then A is invertible, which means there exists a matrix A -1 , making AA -1 =I, where I is the identity matrix.

[0090] 2. Solution of linear equations: Consider the linear equation system Ax=b. Since A is reversible, the unique solution of x can be found by the following steps:

[0091] x=A -1 b

[0092] This solution is unique because for the same linear system of equations, if there exists another solution x', then:

[0093] Ax'=b

[0094] From this we can get:

[0095] Ax=Ax'

[0096] Multiply both sides by A. -1 ,get:

[0097] x=x'

[0098] It is shown that the solution is unique and its correctness is proved.

[0099] 2. Safety instructions:

[0100] The security of this protocol is based on the security of homomorphic encryption and symmetric encryption. The use of existing homomorphic encryption schemes (such as Paillier, CKKS, modular component-based schemes, etc.) can satisfy the requirement of not leaking any information based on homomorphic operations, so the selected bit information k on the receiving end is safe. At the same time, from the above correctness proof, it can be seen that the system of equations can only have a unique solution, so the receiving end can only obtain k message ciphertexts, and the remaining nk message ciphertexts cannot be obtained, which ensures the data security of the sender. At the same time, due to the salting technology, the receiver cannot obtain additional information through exhaustive enumeration. In summary, this scheme satisfies the security of both parties through technologies such as homomorphic encryption, system of equations, and symmetric salting.

[0101] Therefore, in summary, given a coefficient matrix that meets the conditions, a secure and efficient n-choose-k oblivious transfer protocol can be implemented.

[0102] In summary, the present invention provides an n-choose-k oblivious transmission method based on homomorphic encryption, which focuses on considering an efficient n-choose-k oblivious transmission scheme under a semi-honest setting, that is, the focus is on ensuring the safe and accurate execution of the protocol, giving the style requirements of the equation group, and giving the relationship between the equation group and the security of the protocol. The prior art is often used to protect symmetric keys, and then different symmetric keys are used to protect different messages, thereby realizing the n-choose-k oblivious transmission protocol. Therefore, compared with the prior art, the present invention uses homomorphic encryption technology to protect the secret itself, rather than the symmetric key.

[0103] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0104] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A homomorphic encryption-based n select k An oblivious transfer method, characterized in that The steps include: S1. Generate a pair of homomorphic encryption public and private keys at the receiving end, and send the homomorphic encryption public key to the sending end; based on the collaborative generation of a k * n coefficient matrix; S2. At the receiving end, respectively k The selection bits and n - k non-selected bits are encoded; the homomorphic encryption public key is used for encryption n Code, get n homomorphic ciphertexts, and generate a digital homomorphic ciphertext of a number at the same time; n homomorphic ciphertexts and the digital homomorphic ciphertext are sent to the sender end in sequence; S3, at the sender end, generate a symmetric key; n Messages are filled with salt; Use the symmetric key to add salt to fill n The message is symmetrically encrypted to obtain n A symmetric ciphertext; S4, at the sender end, n homomorphic ciphertext and the n The corresponding symmetric ciphertexts are multiplied to obtain n ciphertext; n The ciphertext and k * n Perform dot multiplication on the coefficient matrix to obtain k ciphertext; multiplying the symmetric key by the digital homomorphic ciphertext to obtain a digital homomorphic ciphertext product; k The product of a ciphertext and the digital homomorphic ciphertext is sent to the receiving end; S5. At the receiving end, according to the k The matrix coefficients corresponding to the selected bits and the k The ciphertext constructs a system of equations; solves the system of equations and recovers k symmetric ciphertext; decrypting the digital homomorphic ciphertext product based on the homomorphic encryption private key to recover the symmetric key; The symmetric key is used to k After the symmetric ciphertext is decrypted and desalted, we can obtain k Message; The homomorphic encryption is Paillier semi-homomorphic encryption, CKKS fully homomorphic encryption or fully homomorphic encryption based on modular components; For the fully homomorphic encryption of the module component, the encryption using the homomorphic encryption public key n Code, get n Homomorphic ciphertexts, including: Generate a random number for each code as scrambling information; Based on the modulus component, the homomorphic encryption public key is used to respectively add the scrambled information n Encrypt the code to obtain the corresponding real modulus component; it is expressed as: ; in, y ij Indicates i Code S i The corresponding j True mode components; r i Indicates i Code S i Corresponding scrambling information; b j represents the first j modulus; According to the position basis of the homomorphic encryption private key, the real modulus component is filled, and the remaining position is filled with a random number to obtain n Homomorphic ciphertext.

2. A homomorphic encryption-based method according to claim 1 n select k An oblivious transfer method, characterized in that In the step S1, it also includes: The receiving end generates a k * n A coefficient matrix is ​​generated and sent to the sending end; Or, the sender generates a k * n The coefficient matrix is ​​generated and sent to the receiving end.

3. A homomorphic encryption-based method according to claim 1 n select k An oblivious transfer method, characterized in that In step S1, the k * n The coefficient matrix satisfies that any k-order submatrix is ​​a full-rank matrix.

4. A homomorphic encryption-based method according to claim 1 n select k An oblivious transfer method, characterized in that In the step S2, the k The selection bits and n - k The non-selected bits are encoded, including: Encode each selected bit as 1000000; encode each non-selected bit as 0000000.

5. A homomorphic encryption-based method according to claim 1 n select k An oblivious transfer method, characterized in that In step S3, n The message is filled with salt, including: The sender uses salting technology to generate n A random number, to be sent n The message is filled with salt.

6. A homomorphic encryption-based method according to claim 1 n select k An oblivious transfer method, characterized in that In the step S5, the digital homomorphic ciphertext product is decrypted based on the homomorphic encryption private key to recover the symmetric key; Specifically include: When the value of the number is 1, the digital homomorphic ciphertext product is decrypted by the homomorphic encryption private key to recover the symmetric key; When the value of the number is not 1, the digital homomorphic ciphertext product is decrypted by the homomorphic encryption private key and then divided by the value corresponding to the number to restore the symmetric key.

Images