A method for generating batch ring multiplication triples based on NTRU

Abstract

The present invention provides a method for generating batch ring multiplication triples based on NTRU. First, a homomorphic encryption scheme is designed based on the decision NTRU hard problem, and then a two-party batch ring multiplication triple generation protocol is proposed. The participants P0 and P1 of the protocol each randomly select a secret share vector on the integer ring. P0 selects <subgt;0< / subgt;, <subgt;0< / subgt>, select P<subgt;1< / subgt> <subgt;1< / subgt;, <subgt;1< / subgt>, P<subgt;0< / subgt> generates an instantiated homomorphic encryption scheme, generates two ciphertexts through packing encoding and encryption, sends the public parameters, public key and ciphertext to another party P<subgt;1< / subgt>. P<subgt;1< / subgt> selects an n-dimensional random number vector r as a mask on a ring with a larger modulus, and calculates <subgt;0< / subgt;· <subgt;1< / subgt> + <subgt;1< / subgt;· The ciphertext ctd of 0+r, and send ctd to the participant P0. After the participants P1 and P0 perform homomorphic calculations and decryption operations using packing decoding and SIMD technology, the participant P0 obtains the share of the product of the elements of vectors a and b <c><subgt;0< / subgt>, the other party P<subgt;1< / subgt> obtains another share of the product <c>< / c> < / c>

Description

Technical Field

[0001] The present invention relates to the technical field of privacy computing, and in particular to a method for generating batch ring multiplication triples based on NTRU. Background Art

[0002] Secure multi-party computation allows a group of mutually untrusted participants to jointly compute a function on input data without revealing other input data except the computation result. Secure multi-party computation protocols are generally divided into an offline phase and an online phase. The offline phase is independent of the participants' inputs and is generally used for preprocessing and multiplication triple generation. Multiplication triples are used for multiplication operations in complex secure multi-party computation protocols and are key components for constructing secure multi-party computation protocols. Their efficiency directly affects the efficiency of secure multi-party computation protocols.

[0003] In 2012, Ivan Damgard et al. first used homomorphic encryption based on the RLWE hard problem to generate multiplication triples and designed a secure multi-party computation protocol SPDZ in a multi-party computation environment under the malicious model; in 2016, Keller et al. used the oblivious transfer protocol to generate multiplication triples to replace the multiplication triple generation in the offline phase of the SPDZ protocol and solve the inefficiency brought by homomorphic computation; in 2017, Keller et al. proposed a more compact parameter-based BGV multiplication triple protocol, but these protocols can only generate triples over a finite field and cannot generate upper triples; in 2018, Cramer et al. proposed a method for generating ring multiplication triples based on oblivious transfer, which is more in line with the current computing mode of information systems; in 2019, Orsini et al. proposed a method for generating ring multiplication triples based on homomorphic encryption, with higher efficiency than the method proposed by Cramer et al.; in 2019, Deevashwer et al. further improved the scheme of Orsini et al., based on the RLWE homomorphic scheme, introduced packing encoding, and reduced the communication overhead on a 64-bit ring to 14.5% of the original scheme and the computing overhead to 27.8% of the original scheme.

[0004] Through the analysis of the above technical solutions, it is found that the existing solutions still have the following technical problems:

[0005] (1) The communication and computing efficiency of multiplication triples is not high. Currently, the generation of multiplication triples based on homomorphic encryption requires the interaction of 6 polynomial ring elements, the execution of 4 multiplications on the polynomial ring and 4 additions on the polynomial ring, and the overall efficiency is not high, which cannot meet the needs of efficient computation of large-scale encrypted data. It is urgent to improve the efficiency of multiplication triples;

[0006] (2) Multiplication triples on the ring cannot be efficiently generated in large quantities. In order to utilize the properties of the Chinese Remainder Theorem to generate multiplication triples in batches, the modulus is generally required to be a prime number or the product of a series of prime numbers. However, when the modulus is a prime number or the product of a series of prime numbers, the generation of multiplication triples for the ring structure cannot be achieved. Therefore, it is difficult to support the batch generation of multiplication triples on the ring. Summary of the Invention

[0007] To address the above problems, the present invention proposes a method for batch generation of multiplication triples on the ring based on NTRU, which reduces the communication overhead to 3 polynomial ring elements and reduces the computational overhead to two multiplications and two additions on the polynomial ring, significantly improving the multiplication calculation efficiency of the secure multi-party computation protocol.

[0008] A method for batch generation of multiplication triples on the ring based on NTRU proposed by the present invention includes the following steps:

[0009] Step S1, design a homomorphic encryption scheme NtruHE based on the decision-based NTRU hard problem. The homomorphic encryption scheme supports homomorphic addition Ntru.Add, homomorphic plaintext-ciphertext addition NtruHE.AddPlain, and homomorphic plaintext-ciphertext multiplication NtruHE.MultPlain operations;

[0010] Step S2, implement a multiplication triple generation protocol on the ring based on the homomorphic encryption scheme NtruHE. Set two participating parties, namely P0 and P1. Party P0 generates an instantiated homomorphic encryption scheme NtruHE and randomly selects two n-dimensional vectors on the ring as its own secret shares 0， 0. Generate two ciphertexts ct a,0 and ct b，0 through packing encoding and encryption, and send the public parameters, public key, ciphertext ct a,0 and ct b,0 to another participant P1; Participant P1 randomly selects two n-dimensional vectors on the ring as its own secret shares 1， 1, and select an n-dimensional random number vector r on a ring with a larger modulus as a mask, and calculate 0· 1+ 1· The ciphertext ct of 0 + r d , and send ct d to the participant P0; After the participants P1 and P0 perform a series of homomorphic calculations and decryption operations using the packing decoding and SIMD techniques, the participant P0 obtains the shares of the products of the elements in the same positions of the vectors a and b <c>0, the other party P1 obtains another share of the product <c>1.

[0011] Furthermore, the designed homomorphic encryption scheme NtruHE is specifically as follows:

[0012] Establish the algorithm NtruHE.Setup(1 λ ): Given the security parameter λ, based on the Decisional_NTRU N，q，σ difficult problem, generate the parameters Params = (N, q, σ, l, t, Δ) such that the complexity of solving the difficult problem is not lower than 2 λ , where N represents the degree of the polynomial in the integral domain for generating polynomials, q represents the ciphertext modulus, σ represents the standard deviation of the discrete Gaussian distribution, t represents the plaintext modulus,

[0013] Key generation algorithm NtruHE.KeyGen(Params): Given the parameter Params, randomly select f′ from the discrete Gaussian distribution , calculate f = tf′ + 1, and check if f is invertible. If not, reselect f′ until f is invertible. Let the secret key sk = f, randomly select g from the discrete Gaussian distribution , and calculate h = g·f -1 mod q;

[0014] Encryption algorithm NtruHE.Enc(pk, m): Given the plaintext m ∈ R t , randomly select u from the discrete Gaussian distribution , and calculate the ciphertext ct = u·h + Δ·m mod q;

[0015] Decryption algorithm NtruHE.Dec(sk, ct): Given the ciphertext ct and the decryption key sk, calculate and output

[0016] Homomorphic addition NtruHE.Add(ct0, ct1): Given two ciphertexts ct0, c t 1 ∈ R q , calculate and output ct Add = ct0 + ct1 mod q;

[0017] Homomorphic plaintext-ciphertext addition NtruHE.AddPlain(ct, pt): Given the ciphertext ct ∈ R q and a plaintext pt ∈ R t , calculate and output ct AddPlain = ct + Δ·pt mod q;

[0018] Homomorphic plaintext-ciphertext multiplication NtruHE.MultPlain(ct, pt): Input ciphertext ct ∈ R q and a plaintext pt ∈ R t , compute and output ct MultPlain = ct · pt mod q.

[0019] Furthermore, in step S2, the packing encoding is applied to the homomorphic encryption scheme NtruHE scheme, specifically:

[0020] Packing encoding NtruHE.PackEncoding(a): Input a vector the number of plaintext slots where is the Euler's totient function, ord represents the order of t in the group , use the packing encoding to compute and output plaintext pt ∈ R t ;

[0021] Packing decoding NtruHE.PackDecoding(pt): Input a plaintext pt ∈ R t , use the packing decoding to compute and output the vector

[0022] Furthermore, step S2 is specifically as follows:

[0023] Step S21: Party P0 calls the setup algorithm NtruHE.Setup(1 λ ), to generate the public parameters Params;

[0024] Step S22: Party P0 calls the key generation algorithm NtruHE.KeyGen(Params), to generate the public-private key pair (sk, pk), and send the public parameters Params and the public key pk to Party P1;

[0025] Step S23: Party P0 randomly selects two n-dimensional vectors as the shares held by Party P0 in

[0026] Step S24: Party P0 uses the packing encoding to encode the shares< / c> < / c> 0， 0 is encoded into two plaintexts: pt a,0 = NtruHE.PackEncoding( 0), pt b,0 = NtruHE.PackEncoding( 0);

[0027] Step S25: Party P0 inputs the public key pk for the plaintext pt a,0 , pt b，0 to perform encryption, and calls the encryption algorithm to generate two homomorphic ciphertexts: ct a,0 = NtruHE.Enc(pk, pt a,0 ), ct b,0 = NtruHE.Enc(pk, pt b,0 ), and sends the generated ciphertexts ct a，0 and ct b，0 to Party P1;

[0028] Step S26: After receiving the public parameters Params and the public key pk, Party P1 randomly selects two n-dimensional vectors as the shares held by Party P1 in

[0029] Step S27: Party P1 uses packet encoding for the shares 1， 1 Encoded into two plain texts: pt a,1 = NtruHE.PackEncoding( 1), pt b，1 = NtruHE.PackEncoding( 1);

[0030] Step S28: Participant P1 Randomly select an n-dimensional vector r and use packing encoding to encode r into plaintext pt r =NtruHE.PackEncoding(r);

[0031] Step S29: Participant P1 receives the ciphertext ct a,0 and ct b，0 After that, perform homomorphic calculation to obtain two ciphertexts ct a0b1 =NtruHE.MultPlain(ct a,0 , pt b,1 ), ct b0a1 =NtruHE.MultPlain(ct b,0 , pt a,1 ), ct d =NtruHE.AddPlain(NtruHE.Add(ct a0b1 , ct b0a1 ), pt r ), and calculate the result ct d Sent to participant P0;

[0032] Step S210: Participant P0 receives the ciphertext ct d After that, enter the private key sk and encrypt the ciphertext ct d Decrypt and package decode: pt d =NtruHE.Dec(sk,ct d ), d=NtruHE.PackDecoding(pt d )mod 2 l ;

[0033] Step S211: Participant P0 calculates the product share it holds in an encrypted state: <c> 0＝< / c> 0· 0 + d mod 2 l ;

[0034] Step S212: Output at the side of Party P0 0， 0， <c>0;

[0035] Step S213: Perform the calculation <c> 1＝< / c> < / c> 1· 1 - r mod 2 l ;

[0036] Step S214: Output at the side of Party P1 1， 1， <c>1.

[0037] This paper focuses on the need to improve the efficiency of multiplication triples calculation and communication, and addresses the problems of low communication and calculation efficiency of multiplication triples and the inability to efficiently generate multiplication triples on the ring in large quantities. It proposes a batched ring multiplication triple generation method based on NTRU. This method first designs a homomorphic encryption scheme NtruHE based on the decision-type NTRU difficulty problem to support operations such as homomorphic addition Ntru.Add, homomorphic plaintext addition NtruHE.AddPlain, and homomorphic plaintext multiplication NtruHE.MultPlain. Then, a two-party batched ring multiplication triple generation protocol is proposed. The participant P0 of the protocol generates an instantiated homomorphic encryption scheme NtruHE and randomly selects two n-dimensional vectors on the ring as its own secret shares.< / c> 0， 0. Generate two ciphertexts ct a，0 and ct b，0 through packing encoding and encryption, and send the public parameters, public key, ciphertext ct a，0 and Ct b，0 to another participant P1; Participant P1 randomly selects two n-dimensional vectors on the ring as its own secret shares 1， 1, and select an n-dimensional random number vector r on a ring with a larger modulus as a mask, and calculate 0· 1+ 1· The ciphertext ct of 0+r d , and send ct d to the participant P0; after the participants P1 and P0 perform a series of homomorphic calculations and decryption operations using the packing decoding and SIMD techniques, the participant P0 obtains the shares of the products of the elements in the same positions of the vectors a and b <c>0, Participant P1 obtains another share of the product <c>1. The triple generation protocol proposed by the present invention has excellent computational and communication efficiency and quantum-resistant security.

[0038] In summary, the beneficial technical effects of the present invention are as follows:

[0039] (1) The generation of multiplication triples is more efficient. The batch ring multiplication triple generation method based on NTRU proposed by the present invention reduces the communication overhead to 3 polynomial ring elements and reduces the computational overhead to two multiplications and two additions on the polynomial ring, resulting in a significant improvement in efficiency.

[0040] (2) The ring multiplication triple generation has stronger adaptability. The present invention designs a homomorphic encryption scheme based on the NTRU mathematical hard problem, realizes secure multi-party computation on the ring, which is more in line with the computational mode of modern computing systems and has stronger adaptability. It is more suitable for the computational mode of modern computing systems and has stronger adaptability.

[0041] (3) Multiplication triples can be generated in large quantities. The present invention takes into account secure multi-party computation on the ring, applies the Chinese Remainder Theorem to the protocol by using the relationship between parameters, realizes single instruction multiple output streams, and supports one protocol execution to generate even up to thousands of multiplication triples. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or in the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the following drawings are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0043] < / c> < / c> Figure 1 It is a schematic flowchart of a method for generating batch ring multiplication triples based on NTRU provided by an embodiment of the present invention. Specific implementation manners

[0044] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0045] Multiplication triples are key components of secure multi-party computation protocols based on secret sharing, and are used to assist multi-party participants in performing multiplication calculations. Focusing on the requirements for improving the communication and calculation efficiency of multiplication triples, aiming at problems such as low communication and calculation efficiency of multiplication triples and inability to generate a large number of ring multiplication triples efficiently, the present invention proposes a method for generating batch ring multiplication triples based on NTRU. This method has two participating parties P0 and P1. First, the participating party P0 instantiates the NTRU cryptosystem and sends the public parameters and public key to the other participating party P1. Both participating parties randomly select share vectors on the integer ring. P0 selects 0， 0, P1 selects 1， 1. Then, through a series of ciphertext calculations and plaintext-ciphertext calculations, multiplication triples are generated in batches.

[0046] First, the relevant symbols involved in the present invention are described as follows:

[0047] For a positive integer Let represent the residue class of an integer modulo q, and the symbol denote rounding to the nearest integer. If the fractional part of a is 0.5, then take its integer part. The positive integer N is a power of 2, that is, there exists an integer such that N = 2 k , then x N +1 is a cyclotomic polynomial of degree 2N, and the integral domain is a cyclotomic polynomial ring. Any element a in R can be regarded as the sum of a unique polynomial with degree less than N and a multiple of x N +1. For convenience, the element in R is directly represented by the polynomial whose coefficient vector is (a₀, a₁,..., a N-1 ). For any integer there is a quotient ring

[0048] When A is a set, x ← A means randomly and uniformly selecting an element x from the set A. When χ is a probability distribution, x ← χ means randomly sampling an element x from the probability distribution χ. When f is a function, x ← f means the output of the function f.

[0049] The protocol is represented by m participating parties using P₀, P₁,..., P m-1 For an element The symbol Indicates that all parties' secret shares of a, namely a0, a1, …, a m-1 , and the party P i holds the secret share a i , which is expressed as i , i = 0, 1, …, m - 1, which satisfies a0 + a1 + … + a m-1 = a mod 2 l .

[0050] A batch ring multiplication triple generation method based on NTRU proposed by the present invention includes the following steps:

[0051] Step S1, design a homomorphic encryption scheme NtruHE based on the decision NTRU hard problem, and the homomorphic encryption scheme supports homomorphic addition Ntru.Add, homomorphic plaintext and ciphertext addition NtruHE.AddPlain, and homomorphic plaintext and ciphertext multiplication NtruHE.MultPlain operations;

[0052] Step S2, implement a ring multiplication triple generation protocol based on the homomorphic encryption scheme NtruHE, set two participating parties, namely P0 and P1, the participating party P0 generates an instantiated homomorphic encryption scheme NtruHE, and randomly selects two n-dimensional vectors on the ring as its own secret shares 0， 0. Generate two ciphertexts ct a,0 and ct b，0 through packing encoding and encryption, and send the public parameters, public key, ciphertext ct a,0 and ct b,0 to another participant P1; Participant P1 randomly selects two n-dimensional vectors on the ring as its own secret shares 1， 1, and select an n-dimensional random number vector r on a ring with a larger modulus as a mask, and calculate 0· 1+ 1· The ciphertext ct of 0+r d , and send ct d to the participant P0; After the participants P1 and P0 perform a series of homomorphic calculations and decryption operations using the packing decoding and SIMD (Single Instruction Multiple Data) technology, the participant P0 obtains the shares of the products of the elements in the same positions of the vectors a and b <c>0, Participant P1 obtains another share of the product <c>1.

[0053] Among them, the NTRU hard problem assumption is:

[0054] NTRU Sampling: Randomly select f and g from the distribution χ σ and f is invertible on R q . Take f as the secret information and calculate h = g·f -1 , then the sampled h of NTRU N，q，σ (f) is obtained;

[0055] Decisional NTRU Problem Decisional_NTRU N，q，σ : Let integers N > 0, q > 0, real number σ > 0. Select f as an element on R from the discrete Gaussian distribution and f is invertible on R q . Take f as the secret information and select as an element on R. h = g·f -1 mod q to form a probability distribution NTRU N，q，σ (f), and distinguish NTRU N，q，σ (f) and the random uniform distribution u ← R q .

[0056] Decisional_NTRU N，q，σ is a mathematical hard problem and can be used to construct public key encryption, key agreement, homomorphic encryption and other schemes.

[0057] The homomorphic encryption scheme NtruHE designed in step S1 is specifically as follows:

[0058] Establish the algorithm NtruHE.Setup(1 λ ): Input the security parameter λ. According to the Decisional NTRU hard problem Decisional_NTRU N，q，σ , generate the parameters Params = (N, q, σ, B, l, t, Δ) such that the complexity of solving the hard problem is not lower than 2 λ , where N represents the degree of the polynomial generated by the integral domain , q represents the ciphertext modulus, σ represents the standard deviation of the discrete Gaussian distribution, t represents the plaintext modulus,

[0059] Key Generation Algorithm NtruHE.KeyGen(Params): Input the parameter Params, randomly select as the discrete Gaussian distribution, calculate f = tf'+1, judge whether f is invertible. If it is not invertible, reselect f' until f is invertible. Let the secret key sk = f, and randomly select Compute \(h = g\cdot f\) -1 \(\bmod q\);

[0060] Encryption algorithm \(NtruHE.Enc(pk, m)\): Input the plaintext \(m\in R\) t , randomly select Compute the ciphertext \(ct = u\cdot h+\Delta\cdot m\bmod q\);

[0061] Decryption algorithm \(NtruHE.Dec(sk, ct)\): Input the ciphertext \(ct\) and the decryption key \(sk\), compute and output

[0062] Homomorphic addition \(NtruHE.Add(ct0, ct1)\): Input two ciphertexts \(ct0, ct1\in R\) q , compute and output \(ct\) Add \(= ct0 + ct1\bmod q\);

[0063] Homomorphic plaintext-ciphertext addition \(NtruHE.AddPlain(ct, pt)\): Input the ciphertext \(ct\in R\) q and a plaintext \(pt\in R\) t , compute and output \(ct\) AddPlain \(= ct+\Delta\cdot pt\bmod q\);

[0064] Homomorphic plaintext-ciphertext multiplication \(NtruHE.MultPlain(ct, pt)\): Input the ciphertext \(ct\in R\) q and a plaintext \(pt\in R\) t , compute and output \(ct\) MultPlain \(= ct\cdot pt\bmod q\).

[0065] In step S2, apply the packing encoding to the homomorphic encryption scheme \(NtruHE\) scheme, specifically:

[0066] Packing encoding \(NtruHE.PackEncoding(a)\): Input a vector is an \(n\)-dimensional vector, each element in the vector is within the range of modulo \(t\), the number of plaintext slots where is the Euler's totient function, \(ord\) represents the order of \(t\) in the group compute and output the plaintext \(pt\in R\) using the packing encoding t ;

[0067] Packing decoding \(NtruHE.PackDecoding(pt)\): Input a plaintext \(pt\in R\) t , compute and output the vector using the packing decoding

[0068] In step S2, the ring multiplication triple generation protocol is implemented based on the homomorphic encryption scheme NtruHE. Specifically:

[0069] Step S21: According to the security parameter λ, the participant P0 calls the setup algorithm NtruHE.Setup(1 λ ), to generate the public parameters Params;

[0070] Step S22: The participant P0 calls the key generation algorithm NtruHE.KeyGen(Params) to generate a public-private key pair (sk, pk), and sends the public parameters Params and the public key pk to the participant P1;

[0071] Step S23: The participant P0 randomly selects two n-dimensional vectors as the shares held by the participant P0 ​< / c> < / c> 0， 0 ∈

[0072] Step S24: Party P0 uses packet encoding to process the shares 0， 0 is encoded into two plaintexts: pt a,0 = NtruHE.PackEncoding( 0), pt b,0 = NtruHE.PackEncoding( 0);

[0073] Step S25: Party P0 inputs the public key pk for the plaintext pt a,0 , pt b，0 to perform encryption, and calls the encryption algorithm to generate two homomorphic ciphertexts: ct a,0 = NtruHE.Enc(pk, pt a,0 ), ct b,0 = NtruHE.Enc(pk, pt b,0 ), and sends the generated ciphertexts ct a,0 and ct b，0 to Party P1;

[0074] Step S26: After Party P 1 receives the public parameters Params and the public key pk, randomly selects two n-dimensional vectors as the shares held by Party P1 in

[0075] Step S27: Party P1 uses packet encoding for the shares 1， 1 Encoded into two plaintexts: pt a,1 = NtruHE.PackEncoding( 1), pt b，1 = NtruHE.PackEncoding( 1);

[0076] Step S28: Party P1 randomly selects an n-dimensional vector r, and encodes r into a plaintext pt using packed encoding = NtruHE.PackEncoding(r); r

[0077] Step S29: After Party P1 receives the ciphertext ct a,0 and ct b，0 , perform homomorphic calculations to obtain two ciphertexts ct aob1 = NtruHE.MultPlain(ct a,0 , pt b,1 ), ct b0a1 = NtruHE.MultPlain(ct b,0 , pt a,1 ), ct d = NtruHE.AddPlain(NtruHE.Add(ct a0b1 , ct b0a1 ), pt r ), and send the calculation result ct d to Party P0;

[0078] Step S210: After Party P0 receives the ciphertext ct d , input the private key sk, decrypt the ciphertext ct d , and perform packed decoding: Pt d = NtruHE.Dec(sk, ct d ), d = NtruHE.PackDecoding(pt d ) mod 2 l ;

[0079] Step S211: Party P0 calculates the held product share in the encrypted state: <c> 0＝< / c> ​ 0· 0 + d mod 2 l ;

[0080] Step S212: Output at the side of Party P0 0， 0， <c>0;

[0081] Step S213: Perform calculations <c> 1＝< / c> < / c> 1· 1-r mod 2 l ;

[0082] Step S214: Output at the side of Party P1 1， 1， <c>1.

[0083] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or perform equivalent replacements on some or all of the technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.< / c>

Claims

1. A batched ring multiplication triple generation method based on NTRU, characterized in that: The method comprises: Step S1, designing a homomorphic encryption scheme NtruHE based on the decision-type NTRU difficulty problem, wherein the homomorphic encryption scheme supports homomorphic addition Ntru.Add, homomorphic plaintext and ciphertext addition NtruHE.AddPlain, and homomorphic plaintext and ciphertext multiplication NtruHE.MultPlain operations; Step S2: Implement the ring multiplication triple generation protocol based on the homomorphic encryption scheme NtruHE. Set two participants, P0 and P1. Participant P0 generates an instantiated homomorphic encryption scheme NtruHE and randomly selects two n-dimensional vectors on the ring as its own secret shares. 0, 0, generate two ciphertexts ct by packing encoding and encryption a，0 ,ct b，0 , and the public parameters, public key, ciphertext ct a，0 and ct b，0 Send to another participant P1; participant P1 randomly selects two n-dimensional vectors on the ring as its own secret share 1, 1, and select an n-dimensional random number vector r on a ring with a larger modulus as a mask, and calculate in the encrypted state 0· 1+ 1· 0+r ciphertext ct d , and ct d Sent to participant P0; after participants P1 and P0 use packed decoding and single instruction multiple data (SIMD) technology to perform a series of homomorphic calculations and decryption operations, participant P0 obtains a share of the product of the elements at the same position of vectors a and b <c>0, participant P1 gets the other share of the product <c> 1。< / c> < / c> 2. The method according to claim 1, characterized in that The designed homomorphic encryption scheme NtruHE is: Establish the algorithm NtruHE.Setup(1 λ ):Input security parameter λ, according to the decision-type NTRU problem Decisional_NTRU N，q，σ , generate parameters Params = (N, q, σ, l, t, Δ), so that the complexity of solving the difficult problem is not less than 2 λ , where N represents an entire ring The degree of the generating polynomial, q represents the ciphertext modulus, σ represents the standard deviation of the discrete Gaussian distribution, t represents the plaintext modulus, Key generation algorithm NtruHE.KeyGen(Params): Input parameter Params, from discrete Gaussian distribution Randomly select f', calculate f = tf' + 1, determine whether f is reversible, if not, reselect f' until f is reversible, let the key sk = f, and select the key from the discrete Gaussian distribution Randomly select g and calculate h = g·f -1 mod q; Encryption algorithm NtruHE.Enc(pk, m): Input plaintext m∈R t , from the discrete Gaussian distribution Randomly select u from the ciphertext and calculate the ciphertext ct = u·h+Δ·m mod q; Decryption algorithm NtruHE.Dec(sk, ct): Input ciphertext ct and decryption key sk, calculate and output Homomorphic addition NtruHE.Add(ct0, ct1): Input two ciphertexts ct0, ct1∈R q , calculate and output ct Add =ct0+ct1mod q; Homomorphic plaintext addition NtruHE.AddPlain(ct, pt): Input ciphertext ct∈R q and a plaintext pt∈R t , calculate and output ct AddPlain =ct+Δ·pt mod q; Homomorphic plaintext multiplication NtruHE.MultPlain(ct, pt): Input ciphertext ct∈R q and a plaintext pt∈R t , calculate and output ct MultPlain =ct·pt mod q.

3. The method according to claim 1, characterized in that In step S2, the package encoding is applied to the homomorphic encryption scheme NtruHE, specifically: Pack encoding NtruHE.PackEncoding(a): Input a vector Number of plaintext slots in, is the Euler function, ord represents t in the group The order in , uses packing coding to calculate and output the plaintext pt∈R t ; Pack decoding NtruHE.PackDecoding(pt): Input a plaintext pt∈R t , using packed decoding to calculate and output vector 4. The method according to claim 3, characterized in that In step S2, the ring multiplication triple generation protocol is implemented based on the homomorphic encryption scheme NtruHE, which specifically includes: Step S21: Participant P0 calls the establishment algorithm NtruHE.Setup(1 according to the security parameter λ) λ ), generate public parameters Params; Step S22: Participant P0 calls the key generation algorithm NtruHE.KeyGen(Params) to generate a public-private key pair (sk, pk), and sends the public parameters Params and public key pk to participant P1; Step S23: Participant P0 Randomly select two n-dimensional vectors as the shares held by participant P0 Step S24: Participant P0 uses package coding to 0, 0 is encoded as two plaintexts: pt a，0 =NtruHE.PackEncoding( 0),pt b，0 =NtruHE.PackEncoding( 0)； Step S25: Participant P0 inputs the public key pk to the plaintext pt a，0 ,pt b，0 Execute encryption and call the encryption algorithm to generate two homomorphic ciphertexts: ct a，0 =NtruHE.Enc(pk,pt a，0 ), ct b，0 =NtruHE.Enc(pk,pt b，0 ), and generate the ciphertext ct a，0 and ct b，0 Sent to participant P1; Step S26: After receiving the public parameters Params and public key pk, the participant P1 Randomly select two n-dimensional vectors as the shares held by participant P1 Step S27: Participant P1 uses package coding to 1, 1 is encoded into two plaintexts: pt a，1 =NtruHE.PackEncoding( 1),pt b，1 =NtruHE.PackEncoding( 1)； Step S28: Participant P1 Randomly select an n-dimensional vector r and use packing encoding to encode r into plaintext pt r =NtruHE.PackEncoding(r); Step S29: Participant P1 receives the ciphertext ct a，0 and ct b，0 After that, perform homomorphic calculation to obtain two ciphertexts ct a0b1 =NtruHE.MultPlain(ct a，0 , pt b，1 ), ct b0a1 =NtruHE.MultPlain(ct b，0 , pt a，1 ), ct d =NtruHE.AddPlain(NtruHE.Add(ct a0b1 , ct b0a1 ), pt r ), and calculate the result ct d Sent to participant P0; Step S210: Participant P0 receives the ciphertext ct d After that, enter the private key sk and encrypt the ciphertext ct d Decrypt and package decode: pt d =NtruHE.Dec(sk,ct d ), d=NtruHE.PackDecoding(pt d )mod2 l ; Step S211: Participant P0 calculates the product share it holds in an encrypted state: <c> 0＝< / c> 0· 0+d mod 2 l ; Step S212: Output at participant P0 0, 0, <c> 0；< / c> Step S213: Execute calculation <c> 1＝< / c> 1· 1-r mod 2 l ; Step S214: Output on the participant P1 side 1, 1, <c> 1。< / c>

Images