Efficient privacy protection image verification method based on threshold Paillier cryptosystem

Abstract

The invention discloses an efficient privacy protection image verification method based on a threshold Paillier cryptosystem. In the registration stage, each terminal device firstly preprocesses the image features in the database, divides the image features into two parts, encrypts the two parts, and then sends the two parts to the two servers for offline processing. In a verification stage, efficient ciphertext calculation is realized by designing a secure outsourcing calculation protocol, such as secure square summation and secure comparison, and meanwhile, a parallel calculation technology is adopted to store an encrypted database on two servers, so that the two servers can process an image verification task in parallel, and the verification efficiency is improved. According to the method, privacy protection of image verification can be ensured, and meanwhile, the method has relatively high reliability.

Description

Technical Field

[0001] The present invention relates to the technical field of image verification, and in particular to an efficient privacy-preserving image verification method based on a threshold Paillier cryptographic system. Background Art

[0002] Privacy-preserving image verification is a technology that aims to protect data privacy while achieving image verification. It is widely used in fields with high security requirements. In addition, image verification can be extended to other fields, such as face verification. The core of image verification technology is to extract unique features from images and then verify them through similarity measurements (such as Euclidean distance and cosine similarity). However, traditional image verification technology usually requires plaintext data to be transmitted to a cloud server for processing, which improves verification efficiency but also brings serious privacy risks. In addition, existing solutions usually require a trusted third party to distribute keys, or store data in plaintext on a trusted third party, which brings the risk of data leakage.

[0003] In traditional image verification systems, client devices are usually responsible for capturing images and sending these images or their feature vectors to a cloud server. The cloud server relies on powerful computing power to perform verification tasks and returns the results to the client. This architecture allows client devices to not have to bear a large amount of computing burden, and verification tasks can be completed efficiently in the cloud. However, in this process, data may face the risk of being intercepted or leaked during transmission and storage, especially when sensitive data is involved. For example, in some sensitive application scenarios, unauthorized image leakage may lead to the leakage of private information of individuals or organizations, thereby threatening their security.

[0004] In order to solve the above privacy issues, privacy-preserving image verification technology has emerged. This technology uses a variety of encryption methods to ensure that the cloud server cannot directly access the original data during the image verification process, thereby greatly reducing the risk of data leakage. The core of privacy-preserving image verification technology is to protect the privacy of image data through encryption methods such as homomorphic encryption, secret sharing or differential privacy.

[0005] Homomorphic encryption is an encryption technology that allows calculations to be performed in a ciphertext state, which means that cloud servers can directly process encrypted data without decrypting the data. Secret sharing technology divides data into multiple parts and stores them on different servers. The original data can only be reconstructed when these parts are combined together. Differential privacy protects individual privacy by introducing noise into the data, making it difficult to verify individual data points.

[0006] However, although privacy-preserving image verification technology has shown great potential in privacy protection, current technical solutions still face some challenges. First, the computational complexity of homomorphic encryption is high, especially when processing large-scale data, the computational cost increases significantly. Although some schemes improve efficiency through batch computing, operations such as multiplication and minimum value are still time-consuming and expensive in the ciphertext state. This means that in practical applications, cloud servers need stronger computing power and more resources to perform these tasks.

[0007] Secondly, privacy-preserving image verification technology has difficulties in balancing privacy protection and verification accuracy. In order to enhance privacy protection, some schemes use approximate calculations or introduce noise into the data. However, these measures inevitably reduce the accuracy of verification. For example, the differential privacy-based method introduces noise to cover up the real data, but this also affects the final verification result, making it less accurate than when processing the original data.

[0008] In addition, the actual deployment of privacy-preserving image verification technology also faces operational challenges. In a multi-server architecture, computing tasks between servers need to be coordinated, which may lead to a waste of computing resources. For example, a server may need to wait for another server to complete the calculation before continuing the task, thereby reducing the efficiency of the overall system. Therefore, how to optimize the allocation of server computing power and improve resource utilization is also a problem that privacy-preserving image verification technology needs to solve. Summary of the invention

[0009] The purpose of the present invention is to overcome the shortcomings of the prior art and provide an efficient privacy-preserving image verification method based on a threshold Paillier cryptographic system, which can efficiently complete the verification task of the privacy-preserving image with high reliability.

[0010] To achieve the above object, the technical solution provided by the present invention is: an efficient privacy-preserving image verification method based on a threshold Paillier cryptographic system, comprising the following steps:

[0011] In the registration phase, each terminal device in the terminal device group pre-processes its own database, including splitting the feature vectors of all images in the database in half to form two sub-databases and encrypting them, and sending the two encrypted sub-databases to server 1 and server 2 respectively for comparison with the image to be verified in the verification phase. Server 1 and server 2 perform an offline pre-processing mechanism to pre-calculate the data required for the verification phase, including encrypted random numbers and encryption operators; wherein the terminal device group includes Y terminal devices, each of which generates its own public key pk of the threshold Paillier cryptographic system e and private key sk e And part of the private key ske，1 and sk e，2 , pk e and sk e，1 Send to server 1, and send pk e and sk e，2 Send to server 2, e∈[1,Υ];

[0012] In the verification phase, any terminal device initiates a privacy-preserving image verification task request, requesting the terminal device to extract the feature vector (v1, v2, ..., v i , …, v n ), v i represents the ith feature vector, splits the feature vector in half to form two data to be sent, each of which includes the unique identification code ED of the terminal device, the unique identification code ID of the image and partial image data, wherein the partial image data includes the feature vector of the partial image; uses the public key pk e Encrypt part of the image data in the two data to be sent and generate an encrypted random number, send the encrypted first data to be sent to server 1, and send the encrypted second data to be sent and the encrypted random number to server 2; the data obtained by server 1 is ED, The data obtained by server 2 is ED. and an encrypted random number; then wait for server 1 to return the result; server 1 and server 2 execute the secure square sum protocol in parallel to calculate the ciphertext of the partial square Euclidean distance between the partial image data to be verified and all the partial image data in the encrypted sub-database owned by each, and then server 2 sends its calculation result to server 1, and server 1 combines its own calculation result with the calculation result of server 2 to obtain the ciphertext of the square Euclidean distance; server 1 executes the secure comparison protocol with the assistance of server 2, compares the ciphertext of the square Euclidean distance with the ciphertext of the set verification threshold, and finally server 2 obtains the ciphertext of the comparison result; server 2 masks and partially decrypts the result, server 1 performs partial decryption and threshold decryption, and sends the result to the requesting terminal device; after the requesting terminal device obtains the result returned by server 1, it uses the random number generated by itself to restore the result to obtain the correct verification result.

[0013] Furthermore, during the registration phase, the database owned by each terminal device consists of n+2 columns, where n represents the feature vector dimension, and each row of the database consists of the following: the terminal device unique identification code, the image unique identification code, and n values ​​of the image feature vector; the terminal device preprocesses the database, specifically by splitting the image feature vector in half by column, i.e., vertically splitting, and averaging the numbers to obtain two sub-databases, each of which consists of Each row of the sub-database includes the unique identification code of the terminal device, the unique identification code of the image, and the image feature vector. Use the generated public key pk e Encrypt two sub-databases and send them to server 1 and server 2 respectively. The encrypted sub-databases that server 1 and server 2 finally have are and Each server has the same number of rows and columns of data; Server 1 and Server 2 generate a preset number of random numbers, pre-calculate some operators required for the subsequent verification phase, and use the public key pk of each terminal device e Encrypt some random numbers or operators so that they can be used directly in the subsequent verification stage.

[0014] Furthermore, the server 1 and the server 2 execute the secure square sum protocol in parallel to calculate the ciphertext of the partial square Euclidean distance between the partial image data to be verified and all the partial image data in the encrypted sub-database owned by each server, including the following steps:

[0015] After receiving the data sent by the requesting terminal device, server 1 and server 2 first retrieve the row encrypted image data with the same unique identification code as the requesting terminal device and the image to be verified from the encryption sub-database they each own;

[0016] Based on homomorphic encryption, two servers calculate the ciphertext of the difference between the feature vectors of two partial images in parallel;

[0017] Server 1 and Server 2 execute the secure square sum protocol in parallel to calculate the ciphertext of the partial square Euclidean distance of the two partial image feature vectors;

[0018] Server 2 sends the ciphertext result to server 1, and server 1 calculates the ciphertext of the squared Euclidean distance result based on homomorphic addition.

[0019] Further, the security comparison protocol comprises the following steps:

[0020] Server 1 has two ciphertexts and The plain text A constant to control the size of the plaintext field;

[0021] Server 1 selects a random number π∈{0,1} generated in advance during the registration phase. If π=0, the ciphertext If π=1, then calculate the ciphertext Among them, N is the security parameter, R1 and R2 are random numbers pre-generated during the registration phase, and R1←{0, 1} σ \{0}, σ is a security parameter; then, server 1 performs partial decryption to obtain the partially decrypted ciphertext Will Send to server 2;

[0022] Server 2 receives After that, use and Perform partial decryption and threshold decryption to obtain plaintext C. If Then calculate the plaintext u0 = 0, otherwise calculate u0 = 1; based on homomorphic encryption, calculate the ciphertext of the comparison result

[0023] Further, the server 2 masks and partially decrypts the result, the server 1 performs partial decryption and threshold decryption, and sends the result to the requesting terminal device, including the following steps:

[0024] After server 2 obtains the comparison result ciphertext, it uses the random number ciphertext sent by the requesting terminal device to perform masking based on homomorphic encryption to obtain the mask value ciphertext;

[0025] Server 2 performs partial decryption on the mask value ciphertext to obtain a partial decrypted ciphertext, and sends the mask value ciphertext and the partial decrypted ciphertext to Server 1;

[0026] After server 1 obtains the mask value ciphertext and partial decryption ciphertext sent by server 2, server 1 performs partial decryption and threshold decryption to obtain the mask value plaintext, and server 1 returns the mask value plaintext to the requesting terminal device.

[0027] Furthermore, the secure square sum protocol comprises the following steps:

[0028] The secure square sum protocol comprises the following steps:

[0029] Server 1 has s ciphertexts in, represents the i-th ciphertext, and the range of each plaintext is Constant L ≥ 2 σ+2 , N and σ are safety parameters, A constant to control the size of the plaintext field;

[0030] Server 1 generates a random number r i ←{0, 1} σ , where the random number can be pre-generated during the registration phase, based on homomorphic encryption, to calculate the ciphertext δ is a constant that converts negative numbers to non-negative numbers. To encrypt random numbers, they can be generated in advance during the registration phase. Server 1 calculates the ciphertext Pack multiple ciphertexts into one ciphertext, and then perform partial decryption to obtain partial decrypted ciphertext Server 1 will and Send to server 2;

[0031] Server 2 receives and After that, perform partial decryption and threshold decryption to obtain plaintext C, and then calculate each plaintext where i∈[1,s], then, for all i∈[1,s], calculate the plaintext And encrypt the ciphertext Send to server 1;

[0032] Based on homomorphic encryption, server 1 encrypts the plaintext and Get the ciphertext respectively That is, the encryption operator, which can be pre-generated during the registration phase. Server 1 calculates the ciphertext: Then calculate the ciphertext Get the plaintext The ciphertext.

[0033] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0034] 1. Based on the threshold Paillier cryptographic system, the present invention proposes an efficient and reliable privacy-preserving image verification scheme, which does not require a trusted third-party organization. Each terminal device maintains its own public and private keys, supports dual servers to efficiently verify images, does not leak the privacy information of the image, including the image feature vector and the verification result, and does not reduce the accuracy of the verification.

[0035] 2. The present invention designs a series of secure outsourced computation protocols, including a secure square summation protocol and a secure comparison protocol. The present invention uses the proposed secure outsourced computation protocol to support efficient ciphertext computation in the privacy-preserving image verification process.

[0036] 3. The present invention uses a parallel computing mechanism to evenly distribute the database to two servers. No server can have a complete feature vector. The two servers perform the privacy-preserving image verification task in parallel. In this task, each server needs to perform its own computing task while assisting another server in executing the secure outsourcing computing protocol. The parallel computing mechanism used in the present invention improves the efficiency and performance of privacy-preserving image verification.

[0037] 4. The present invention does not require the terminal device to frequently interact with the server during the verification process, and the verification task will not reduce the accuracy of the verification while ensuring high efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 Schematic diagram of the method of the present invention.

[0039] Figure 2 This is a relationship diagram between the terminal device group, server 1 and server 2. DETAILED DESCRIPTION

[0040] The present invention is further described in detail below in conjunction with embodiments and drawings, but the embodiments of the present invention are not limited thereto.

[0041] See also Figure 1 and Figure 2 As shown, this embodiment discloses an efficient privacy-preserving image verification method based on a threshold Paillier cryptographic system, comprising the following steps:

[0042] In the registration phase, each terminal device in the terminal device group pre-processes its own database, including splitting the feature vectors of all images in the database in half to form two sub-databases and encrypting them, and sending the two encrypted sub-databases to server 1 and server 2 respectively for comparison with the image to be verified in the verification phase. Server 1 and server 2 perform an offline pre-processing mechanism to pre-calculate the data required for the verification phase, including encrypted random numbers and encryption operators; wherein the terminal device group includes Y terminal devices, each of which generates its own public key pk of the threshold Paillier cryptographic system e and private key sk e And part of the private key sk e，1 and sk e，2 , pk e and sk e，1 Send to server 1, and send pk e and sk e，2 Send to server 2, e∈[1,Υ];

[0043] In the verification phase, any terminal device initiates a privacy-preserving image verification task request, requesting the terminal device to extract the feature vector (v1, v2, ..., v i , …, v n ), v i represents the ith feature vector, splits the feature vector in half to form two data to be sent, each of which includes the unique identification code ED of the terminal device, the unique identification code ID of the image and partial image data, wherein the partial image data includes the feature vector of the partial image; uses the public key pk e Encrypt part of the image data in the two data to be sent and generate an encrypted random number, send the encrypted first data to be sent to server 1, and send the encrypted second data to be sent and the encrypted random number to server 2; the data obtained by server 1 is ED, The data obtained by server 2 is ED. and an encrypted random number; then wait for server 1 to return the result; server 1 and server 2 execute the secure square sum protocol in parallel to calculate the ciphertext of the partial square Euclidean distance between the partial image data to be verified and all the partial image data in the encrypted sub-database owned by each, and then server 2 sends its calculation result to server 1, and server 1 combines its own calculation result with the calculation result of server 2 to obtain the ciphertext of the square Euclidean distance; server 1 executes the secure comparison protocol with the assistance of server 2, compares the ciphertext of the square Euclidean distance with the ciphertext of the set verification threshold, and finally server 2 obtains the ciphertext of the comparison result; server 2 masks and partially decrypts the result, server 1 performs partial decryption and threshold decryption, and sends the result to the requesting terminal device; after the requesting terminal device obtains the result returned by server 1, it uses the random number generated by itself to restore the result to obtain the correct verification result.

[0044] Specifically, during the registration phase, the database owned by each terminal device consists of n+2 columns, where n represents the feature vector dimension, and each row of the database consists of the following: the terminal device unique identification code, the image unique identification code, and n values ​​of the image feature vector; the terminal device preprocesses the database, specifically by splitting the image feature vector in half by column, that is, vertically splitting, and averaging the numbers to obtain two sub-databases, each of which consists of Each row of the sub-database includes the unique identification code of the terminal device, the unique identification code of the image, and the image feature vector. Use the generated public key pk e Encrypt two sub-databases and send them to server 1 and server 2 respectively. The encrypted sub-databases that server 1 and server 2 finally have are and Each server has the same number of rows and columns of data; Server 1 and Server 2 generate a preset number of random numbers, pre-calculate some operators required for the subsequent verification phase, and use the public key pk of each terminal device e Encrypt some random numbers or operators so that they can be used directly in the subsequent verification stage.

[0045] Specifically, the server 1 and the server 2 execute the secure square sum protocol in parallel to calculate the ciphertext of the partial square Euclidean distance between the partial image data to be verified and all the partial image data in the encrypted sub-database owned by each server, including the following steps:

[0046] After receiving the data sent by the requesting terminal device, server 1 and server 2 first retrieve the row encrypted image data with the same unique identification code as the requesting terminal device and the image to be verified from the encryption sub-database they each own;

[0047] Based on homomorphic encryption, two servers calculate the ciphertext of the difference between the feature vectors of two partial images in parallel;

[0048] Server 1 and Server 2 execute the secure square sum protocol in parallel to calculate the ciphertext of the partial square Euclidean distance of the two partial image feature vectors;

[0049] Server 2 sends the ciphertext result to server 1, and server 1 calculates the ciphertext of the squared Euclidean distance result based on homomorphic addition.

[0050] Specifically, the safety comparison protocol includes the following steps:

[0051] Server 1 has two ciphertexts and The plain text A constant to control the size of the plaintext field;

[0052] Server 1 selects a random number π∈{0,1} generated in advance during the registration phase. If π=0, the ciphertext If π=1, then calculate the ciphertext Among them, N is the security parameter, R1 and R2 are random numbers pre-generated during the registration phase, and R1←{0, 1} σ \{0}, σ is a security parameter; then, server 1 performs partial decryption to obtain the partially decrypted ciphertext Will Send to server 2;

[0053] Server 2 receives After that, use and Perform partial decryption and threshold decryption to obtain plaintext C. If Then calculate the plaintext u0 = 0, otherwise calculate u0 = 1; based on homomorphic encryption, calculate the ciphertext of the comparison result

[0054] Specifically, the server 2 masks and partially decrypts the result, the server 1 performs partial decryption and threshold decryption, and sends the result to the requesting terminal device, including the following steps:

[0055] After server 2 obtains the comparison result ciphertext, it uses the random number ciphertext sent by the requesting terminal device to perform masking based on homomorphic encryption to obtain the mask value ciphertext;

[0056] Server 2 performs partial decryption on the mask value ciphertext to obtain a partial decrypted ciphertext, and sends the mask value ciphertext and the partial decrypted ciphertext to Server 1;

[0057] After server 1 obtains the mask value ciphertext and partial decryption ciphertext sent by server 2, server 1 performs partial decryption and threshold decryption to obtain the mask value plaintext, and server 1 returns the mask value plaintext to the requesting terminal device.

[0058] Specifically, the secure square sum protocol includes the following steps:

[0059] Server 1 has s ciphertexts in, represents the i-th ciphertext, and the range of each plaintext is Constant L ≥ 2 σ+2 , N and σ are safety parameters, A constant to control the size of the plaintext field;

[0060] Server 1 generates a random number r i ←{0, 1} σ , where the random number can be pre-generated during the registration phase, based on homomorphic encryption, to calculate the ciphertext δ is a constant that converts negative numbers to non-negative numbers, To encrypt random numbers, they can be generated in advance during the registration phase. Server 1 calculates the ciphertext Pack multiple ciphertexts into one ciphertext, and then perform partial decryption to obtain partial decrypted ciphertext Server 1 will and Send to server 2;

[0061] Server 2 receives and After that, perform partial decryption and threshold decryption to obtain plaintext C, and then calculate each plaintext where i∈[1,s], then, for all i∈[1,s], calculate the plaintext And encrypt the ciphertext Send to server 1;

[0062] Based on homomorphic encryption, server 1 encrypts the plaintext and Get the ciphertext respectively and That is, the encryption operator, which can be pre-generated during the registration phase. Server 1 calculates the ciphertext: Then calculate the ciphertext Get the plaintext The ciphertext.

[0063] In summary, the present invention designs a series of secure outsourced computing protocols, including a secure square sum protocol and a secure comparison protocol, which support efficient ciphertext calculations in the process of privacy-preserving image verification, and uses a parallel computing mechanism to divide the encrypted database into two parts and store them on dual servers. The dual servers execute the privacy-preserving image verification task in parallel, thereby improving the performance of privacy-preserving image verification.

[0064] The above embodiments are preferred implementation modes of the present invention, but the implementation modes of the present invention are not limited to the above embodiments. Any other changes, modifications, substitutions, combinations, and simplifications that do not deviate from the spirit and principles of the present invention should be equivalent replacement methods and are included in the protection scope of the present invention.

Claims

1. An efficient privacy-preserving image verification method based on a threshold Paillier cryptographic system, characterized in that: The following steps are involved: In the registration phase, each terminal device in the terminal device group pre-processes its own database, including splitting the feature vectors of all images in the database in half to form two sub-databases and encrypting them. The two encrypted sub-databases are sent to server 1 and server 2 respectively for comparison with the image to be verified in the verification phase. Server 1 and server 2 perform an offline pre-processing mechanism to pre-calculate the data required in the verification phase, including encrypted random numbers and encryption operators. The terminal device group contains γ terminal devices, and each terminal device generates its own public key Pk of the threshold Paillier cryptosystem. e and private key sk e And part of the private key sk e，1 and sk e，2 , Pk e and sk e，1 Send to server 1, and send pk e and sk e，2 Send to server 2, e∈[1,γ]; In the verification phase, any terminal device initiates a privacy-preserving image verification task request, requesting the terminal device to extract the feature vector (v1, v2, ..., v i , …, v n ), v i represents the ith feature vector, splits the feature vector in half to form two data to be sent, each of which includes the unique identification code ED of the terminal device, the unique identification code ID of the image and partial image data, wherein the partial image data includes the feature vector of the partial image; uses the public key pk e Encrypt part of the image data in the two data to be sent and generate an encrypted random number, send the encrypted first data to be sent to server 1, and send the encrypted second data to be sent and the encrypted random number to server 2; the data obtained by server 1 is ED, The data obtained by server 2 is ED. and an encrypted random number; then wait for server 1 to return the result; server 1 and server 2 execute the secure square sum protocol in parallel to calculate the ciphertext of the partial square Euclidean distance between the partial image data to be verified and all the partial image data in the encrypted sub-database owned by each, and then server 2 sends its calculation result to server 1, and server 1 combines its own calculation result with the calculation result of server 2 to obtain the ciphertext of the square Euclidean distance; server 1 executes the secure comparison protocol with the assistance of server 2, compares the ciphertext of the square Euclidean distance with the ciphertext of the set verification threshold, and finally server 2 obtains the ciphertext of the comparison result; server 2 masks and partially decrypts the result, server 1 performs partial decryption and threshold decryption, and sends the result to the requesting terminal device; after the requesting terminal device obtains the result returned by server 1, it uses the random number generated by itself to restore the result to obtain the correct verification result.

2. According to claim 1, the efficient privacy-preserving image verification method based on the threshold Paillier cryptographic system is characterized in that: During the registration phase, the database owned by each terminal device consists of n+2 columns, where n represents the feature vector dimension. Each row of the database consists of the following: the terminal device unique identification code, the image unique identification code, and n values ​​of the image feature vector; the terminal device preprocesses the database, specifically by splitting the image feature vector in half by column, that is, vertically splitting, and averaging the number to obtain two sub-databases, each of which consists of Each row of the sub-database includes the unique identification code of the terminal device, the unique identification code of the image, and the image feature vector. Use the generated public key pk e Encrypt two sub-databases and send them to server 1 and server 2 respectively. The encrypted sub-databases that server 1 and server 2 finally have are and Each server has the same number of rows and columns of data; Server 1 and Server 2 generate a preset number of random numbers, pre-calculate some operators required for the subsequent verification phase, and use the public key pk of each terminal device e Encrypt some random numbers or operators so that they can be used directly in the subsequent verification stage.

3. The efficient privacy-preserving image verification method based on the threshold Paillier cryptographic system according to claim 2 is characterized in that: The server 1 and the server 2 execute the secure square sum protocol in parallel to calculate the ciphertext of the partial square Euclidean distance between the partial image data to be verified and all the partial image data in the encrypted sub-database owned by each server, including the following steps: After receiving the data sent by the requesting terminal device, server 1 and server 2 first retrieve the row encrypted image data with the same unique identification code as the requesting terminal device and the image to be verified from the encryption sub-database they each own; Based on homomorphic encryption, two servers calculate the ciphertext of the difference between the feature vectors of two partial images in parallel; Server 1 and Server 2 execute the secure square sum protocol in parallel to calculate the ciphertext of the partial square Euclidean distance of the two partial image feature vectors; Server 2 sends the ciphertext result to server 1, and server 1 calculates the ciphertext of the squared Euclidean distance result based on homomorphic addition.

4. The efficient privacy-preserving image verification method based on the threshold Paillier cryptographic system according to claim 3 is characterized in that: The safety comparison protocol comprises the following steps: Server 1 has two ciphertexts and The plain text A constant to control the size of the plaintext field; Server 1 selects a random number π∈{0,1} generated in advance during the registration phase. If π=0, the ciphertext If π=1, then calculate the ciphertext Among them, N is the security parameter, R1 and R2 are random numbers pre-generated during the registration phase, and R1←{0, 1} σ \{0}, σ is a security parameter; then, server 1 performs partial decryption to obtain the partially decrypted ciphertext Will Send to server 2; Server 2 receives After that, use and Perform partial decryption and threshold decryption to obtain plaintext C. If Then calculate the plaintext u0 = 0, otherwise calculate u0 = 1; based on homomorphic encryption, calculate the ciphertext of the comparison result 5. The efficient privacy-preserving image verification method based on threshold Paillier cryptographic system according to claim 4 is characterized in that: The server 2 masks and partially decrypts the result, the server 1 performs partial decryption and threshold decryption, and sends the result to the requesting terminal device, including the following steps: After server 2 obtains the comparison result ciphertext, it uses the random number ciphertext sent by the requesting terminal device to perform masking based on homomorphic encryption to obtain the mask value ciphertext; Server 2 performs partial decryption on the mask value ciphertext to obtain a partial decrypted ciphertext, and sends the mask value ciphertext and the partial decrypted ciphertext to Server 1; After server 1 obtains the mask value ciphertext and partial decryption ciphertext sent by server 2, server 1 performs partial decryption and threshold decryption to obtain the mask value plaintext, and server 1 returns the mask value plaintext to the requesting terminal device.

6. The efficient privacy-preserving image verification method based on threshold Paillier cryptographic system according to claim 3 is characterized in that: The secure square sum protocol comprises the following steps: Server 1 has s ciphertexts in, represents the i-th ciphertext, and the range of each plaintext is Constant L ≥ 2 σ+2 , N and σ are safety parameters, A constant to control the size of the plaintext field; Server 1 generates a random number r i ←{0, 1} σ , where the random number can be pre-generated during the registration phase, based on homomorphic encryption, to calculate the ciphertext δ is a constant that converts negative numbers to non-negative numbers. To encrypt random numbers, they can be generated in advance during the registration phase. Server 1 calculates the ciphertext Pack multiple ciphertexts into one ciphertext, and then perform partial decryption to obtain partial decrypted ciphertext Server 1 will and Send to server 2; Server 2 receives and After that, perform partial decryption and threshold decryption to obtain plaintext C, and then calculate each plaintext where i∈[1,s], then, for all i∈[1,s], calculate the plaintext And encrypt the ciphertext Send to server 1; Based on homomorphic encryption, server 1 encrypts the plaintext and Get the ciphertext respectively and That is, the encryption operator, which can be pre-generated during the registration phase. Server 1 calculates the ciphertext: Then calculate the ciphertext Get the plaintext The ciphertext.

Images