Efficient privacy-preserving image verification method based on threshold paillier cryptosystem

Abstract

This invention discloses an efficient privacy-preserving image verification method based on a threshold Paillier cryptosystem. During the registration phase, each terminal device first preprocesses the image features in the database, dividing them into two parts and encrypting them, then sending them to two servers for offline processing. In the verification phase, by designing secure outsourced computation protocols, such as secure summation of squares and secure comparison, efficient ciphertext computation is achieved. Simultaneously, parallel computing technology is employed, storing the encrypted database on two servers, allowing the two servers to process the image verification task in parallel, thereby improving verification efficiency. This method ensures privacy protection in image verification while maintaining high reliability.

Description

Technical Field

[0001] This invention relates to the technical field of image verification, and in particular to an efficient privacy-preserving image verification method based on the threshold Paillier cryptosystem. Background Technology

[0002] Privacy-preserving image verification is a technology designed to protect data privacy while verifying images, widely used in fields with high security requirements. Furthermore, image verification can be extended to other areas, such as facial recognition. The core of image verification technology lies in extracting unique features from images and then verifying them through similarity measurements (such as Euclidean distance and cosine similarity). However, traditional image verification technologies typically require transmitting plaintext data to cloud servers for processing. While this improves verification efficiency, it also introduces serious privacy risks. Additionally, existing solutions often require a trusted third party to distribute keys or store data in plaintext with a trusted third party, which poses a risk of data leakage.

[0003] In traditional image verification systems, client devices typically capture images and send them, or their feature vectors, to a cloud server. The cloud server then leverages its powerful computing capabilities to perform the verification task and return the results to the client. This architecture allows the client device to avoid bearing a significant computational burden, enabling the verification task to be completed efficiently in the cloud. However, in this process, data may be intercepted or leaked during transmission and storage, especially when sensitive data is involved. For example, in some sensitive application scenarios, unauthorized image leaks could lead to the disclosure of personal or organizational privacy information, thereby threatening their security.

[0004] To address the aforementioned privacy concerns, privacy-preserving image verification technology has emerged. This technology employs multiple encryption methods to ensure that cloud servers cannot directly access the original data during the image verification process, thereby significantly reducing the risk of data leakage. The core of privacy-preserving image verification technology lies in protecting the privacy of image data through encryption methods such as homomorphic encryption, secret sharing, or differential privacy.

[0005] Homomorphic encryption is an encryption technique that allows computation to be performed in ciphertext, meaning cloud servers can process encrypted data directly without decryption. Secret sharing, on the other hand, divides data into multiple parts and stores them on different servers; the original data can only be reconstructed when these parts are combined. Differential privacy protects individual privacy by introducing noise into the data, making individual data points difficult to verify.

[0006] However, despite the significant potential of privacy-preserving image verification technology in protecting privacy, current solutions still face several challenges. First, homomorphic encryption is computationally complex, especially when dealing with large-scale data, where computational costs increase significantly. While some solutions improve efficiency through batch computation, operations such as multiplication and minimization remain time-consuming and expensive in the ciphertext state. This means that in practical applications, cloud servers require greater computing power and more resources to perform these tasks.

[0007] Secondly, privacy-preserving image verification technologies face challenges in balancing privacy protection and verification accuracy. To enhance privacy, some schemes employ approximate calculations or introduce noise into the data. However, these measures inevitably reduce verification accuracy. For example, differential privacy-based methods mask the true data by introducing noise; however, this still affects the final verification result, making it less accurate than when processing the original data.

[0008] Furthermore, the practical deployment of privacy-preserving image verification technology faces operational challenges. In multi-server architectures, the computational tasks between servers need to be coordinated, which can lead to a waste of computing resources. For example, one server may need to wait for another server to complete its computation before it can continue its task, thus reducing the overall system efficiency. Therefore, optimizing the allocation of server computing power and improving resource utilization are also problems that privacy-preserving image verification technology needs to address. Summary of the Invention

[0009] The purpose of this invention is to overcome the shortcomings of the prior art and provide an efficient privacy-preserving image verification method based on the threshold Paillier cryptosystem, which can efficiently complete the verification task of privacy-preserving images and has high reliability.

[0010] To achieve the above objectives, the technical solution provided by this invention is: an efficient privacy-preserving image verification method based on a threshold Paillier cryptosystem, comprising the following steps:

[0011] During the registration phase, each terminal device in the terminal device group preprocesses its own database, including splitting the feature vectors of all images in the database in half to form two sub-databases and encrypting them. These two encrypted sub-databases are then sent to Server 1 and Server 2 respectively for comparison with the images to be verified during the verification phase. Server 1 and Server 2 perform offline preprocessing mechanisms, pre-calculating the data needed for the verification phase, including encrypted random numbers and encryption operators. The terminal device group contains Y terminal devices, each generating its own public key pk for the threshold Paillier cryptosystem. e and private key sk e And some private keys ske，1 and SK e，2 , will PK e and SK e，1 Send to server 1, and send the PK e and SK e，2 Send to server 2, e∈[1, Υ];

[0012] During the verification phase, any terminal device initiates a privacy-preserving image verification task request, requesting the terminal device to extract the feature vector (v1, v2, ..., v) of the n-dimensional image to be verified. i , ..., v n ), v i Representing the i-th feature vector, the feature vector is split in half to form two data to be sent. Each data to be sent includes a unique identifier for the terminal device (ED), a unique identifier for the image (ID), and partial image data, where the partial image data includes the feature vector of a portion of the image. The public key pk is used. e Encrypt a portion of the image data from two data sets to be sent and generate an encrypted random number. Send the encrypted first data set to server 1, and send the encrypted second data set and the encrypted random number to server 2. Server 1 receives the data ED, ID, v1, v2, ..., v i , ..., v n The data retrieved by server 2 is ED and ID. …, v i , ..., v n The system generates a random number and a encrypted random number. It then waits for server 1 to return the result. Servers 1 and 2 execute a secure square summation protocol in parallel, calculating the ciphertext of the partial square Euclidean distance between the image data to be verified and all partial image data in their respective encrypted sub-databases. Server 2 then sends its calculation result to server 1, which merges its result with server 2's to obtain the ciphertext of the square Euclidean distance. With the assistance of server 2, server 1 executes a secure comparison protocol, comparing the ciphertext of the square Euclidean distance with the ciphertext of the set verification threshold. Server 2 then obtains the ciphertext of the comparison result. Server 2 performs masking and partial decryption on the result, while server 1 performs partial decryption and threshold decryption, and sends the result to the requesting terminal device. After receiving the result returned by server 1, the requesting terminal device uses its own generated random number to recover the correct verification result.

[0013] Furthermore, during the registration phase, each terminal device's database consists of n+2 columns, where n represents the feature vector dimension. Each row of the database comprises: a unique identifier for the terminal device, a unique identifier for the image, and n values ​​representing the image feature vector. The terminal device preprocesses the database by vertically splitting the image feature vector in half along each column, resulting in two sub-databases. Each sub-database consists of... The sub-database is composed of columns, with each row including the terminal device's unique identifier, the image's unique identifier, and the image's feature vector. A number; use the generated public key pk e Two sub-databases are encrypted and sent to server 1 and server 2 respectively. The encrypted sub-databases ultimately possessed by server 1 and server 2 are respectively... and Each server has the same number of rows and columns of data; both server 1 and server 2 generate a preset number of random numbers, pre-calculate some operators needed for subsequent verification stages, and use the public keys of each terminal device to perform PK (player killing). e Encrypt the random numbers or operators so that they can be used directly in the subsequent verification stage.

[0014] Furthermore, server 1 and server 2 execute a secure square summation protocol in parallel to calculate the ciphertext of the partial square Euclidean distance between the partial image data to be verified and all partial image data in their respective encrypted sub-databases, including the following steps:

[0015] After receiving the data sent by the requesting terminal device, Server 1 and Server 2 first retrieve the row of encrypted image data with the same unique identifier as the requesting terminal device and the image to be verified from their respective encrypted sub-databases.

[0016] Based on homomorphic encryption, two servers calculate the ciphertext of the difference between the feature vectors of two partial images in parallel; Server 1 and Server 2 execute the secure square summation protocol in parallel to calculate the ciphertext of the partial square Euclidean distance between the feature vectors of the two partial images.

[0017] Server 2 sends the encrypted result to Server 1, and Server 1 calculates the encrypted result of the squared Euclidean distance based on homomorphic addition.

[0018] Furthermore, the security comparison protocol includes the following steps:

[0019] Server 1 has two ciphertexts, x and y, where the plaintexts x and y ∈ [-2]. l ,2 l ], l is a constant that controls the size of the plaintext field;

[0020] Server 1 selects a random number π ∈ {0, 1} pre-generated during the registration phase. If π = 0, then the ciphertext is calculated. If π = 1, then calculate the ciphertext. Where N is a security parameter, and R1 and R2 are random numbers pre-generated during the registration phase, where R1 ← {0, 1} σ \{0}, σ is a security parameter; subsequently, server 1 performs partial decryption to obtain partially decrypted ciphertext C1, and sends C, C1, and π to server 2;

[0021] After receiving C, C1, and π, server 2 uses C and C1 to perform partial decryption and threshold decryption to obtain plaintext C. If If the plaintext u0 is 0, then u0 = 1; based on homomorphic encryption, calculate the ciphertext of the comparison result.

[0022] Furthermore, server 2 performs masking and partial decryption on the result, server 1 performs partial decryption and threshold decryption, and sends the result to the requesting terminal device, including the following steps:

[0023] After obtaining the ciphertext of the comparison result, server 2 uses the ciphertext of the random number sent by the requesting terminal device, and performs masking based on homomorphic encryption to obtain the ciphertext of the mask value.

[0024] Server 2 performs partial decryption on the mask value ciphertext, obtains partially decrypted ciphertext, and sends the mask value ciphertext and the partially decrypted ciphertext to server 1;

[0025] After receiving the ciphertext mask value and partially decrypted ciphertext sent by server 2, server 1 performs partial decryption and threshold decryption to obtain the plaintext mask value. Server 1 then returns the plaintext mask value to the requesting terminal device.

[0026] Furthermore, the secure square summation protocol includes the following steps:

[0027] The secure square summation protocol includes the following steps:

[0028] Server 1 has s ciphertexts x1, x2, ..., x3. i , ..., x s , where x i This represents the i-th ciphertext, where each plaintext is in the range (-2). l ,2 l ), Constant L≥2 σ+2 N and σ are security parameters, and l is a constant that controls the size of the plaintext field;

[0029] Server 1 generates a random number r. i ←{0, 1} σThe random number here can be pre-generated during the registration phase, and the ciphertext X is calculated based on homomorphic encryption. i ←x i ·δ·r i δ is a constant for converting negative numbers to non-negative numbers, and r i To encrypt random numbers, they can be pre-generated during the registration phase. Server 1 calculates the ciphertext... Multiple ciphertexts are packaged into one ciphertext, and then partial decryption is performed to obtain partially decrypted ciphertext C1. Server 1 sends C and C1 to server 2.

[0030] After receiving C and C1, server 2 performs partial decryption and threshold decryption to obtain plaintext C, and then calculates each plaintext... Where i∈[1, s], then for all i∈[1, s], calculate the plaintext. And encrypt, ciphertext Send to server 1;

[0031] Based on homomorphic encryption, server 1 encrypts plaintext. and The ciphertext was obtained separately. and Server 1 calculates the ciphertext: Then calculate the ciphertext. Obtain plaintext The encrypted text.

[0032] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0033] 1. Based on the threshold Paillier cryptosystem, this invention proposes an efficient and reliable privacy-preserving image verification scheme that does not require a trusted third-party institution. Each terminal device maintains its own public and private keys, supports efficient image verification by dual servers, does not disclose the privacy information of the image, including the image feature vector and the verification result, and does not reduce the accuracy of the verification.

[0034] 2. This invention designs a series of secure outsourced computation protocols, including a secure square summation protocol and a secure comparison protocol. This invention uses the proposed secure outsourced computation protocols to support efficient ciphertext computation in the privacy-preserving image verification process.

[0035] 3. This invention employs a parallel computing mechanism, distributing the database evenly among two servers. No single server possesses a complete feature vector, and the two servers execute the privacy-preserving image verification task in parallel. In this task, each server performs its own computational task while simultaneously assisting the other server in executing a secure outsourced computation protocol. The parallel computing mechanism used in this invention improves the efficiency and performance of privacy-preserving image verification.

[0036] 4. This invention eliminates the need for frequent interaction between terminal devices and the server during the verification process, ensuring high efficiency without compromising accuracy. Attached Figure Description

[0037] Figure 1 This is an architectural diagram of the method of the present invention.

[0038] Figure 2 This is a diagram showing the relationship between the terminal device group, server 1, and server 2. Detailed Implementation

[0039] The present invention will be further described in detail below with reference to the embodiments and accompanying drawings, but the embodiments of the present invention are not limited thereto.

[0040] See Figure 1 and Figure 2 As shown, this embodiment discloses an efficient privacy-preserving image verification method based on the threshold Paillier cryptosystem, including the following steps:

[0041] During the registration phase, each terminal device in the terminal device group preprocesses its own database, including splitting the feature vectors of all images in the database in half to form two sub-databases and encrypting them. These two encrypted sub-databases are then sent to Server 1 and Server 2 respectively for comparison with the images to be verified during the verification phase. Server 1 and Server 2 perform offline preprocessing mechanisms, pre-calculating the data needed for the verification phase, including encrypted random numbers and encryption operators. The terminal device group contains Y terminal devices, each generating its own public key pk for the threshold Paillier cryptosystem. e and private key sk e And some private keys sk e，1 and SK e，2 , will PK e and SK e，1 Send to server 1, and send the PK e and Sk e，2 Send to server 2, e∈[1, Υ];

[0042] During the verification phase, any terminal device initiates a privacy-preserving image verification task request, requesting the terminal device to extract the feature vector (v1, v2, ..., v) of the n-dimensional image to be verified. i , ..., v n ), v i Representing the i-th feature vector, the feature vector is split in half to form two data to be sent. Each data to be sent includes a unique identifier for the terminal device (ED), a unique identifier for the image (ID), and partial image data, where the partial image data includes the feature vector of a portion of the image. The public key pk is used. eEncrypt a portion of the image data from two data sets to be sent and generate an encrypted random number. Send the encrypted first data set to server 1, and send the encrypted second data set and the encrypted random number to server 2. Server 1 receives the data ED, ID, v1, v2, ..., v i , ..., v n The data retrieved by server 2 is ED and ID. …, v i , ..., v n The system generates a random number and a encrypted random number. It then waits for server 1 to return the result. Servers 1 and 2 execute a secure square summation protocol in parallel, calculating the ciphertext of the partial square Euclidean distance between the image data to be verified and all partial image data in their respective encrypted sub-databases. Server 2 then sends its calculation result to server 1, which merges its result with server 2's to obtain the ciphertext of the square Euclidean distance. With the assistance of server 2, server 1 executes a secure comparison protocol, comparing the ciphertext of the square Euclidean distance with the ciphertext of the set verification threshold. Server 2 then obtains the ciphertext of the comparison result. Server 2 performs masking and partial decryption on the result, while server 1 performs partial decryption and threshold decryption, and sends the result to the requesting terminal device. After receiving the result returned by server 1, the requesting terminal device uses its own generated random number to recover the correct verification result.

[0043] Specifically, during the registration phase, each terminal device's database consists of n+2 columns, where n represents the feature vector dimension. Each row of the database comprises: a unique identifier for the terminal device, a unique identifier for the image, and n values ​​representing the image feature vector. The terminal device preprocesses the database by vertically splitting the image feature vector in half along each column, resulting in two sub-databases. Each sub-database consists of... The sub-database is composed of columns, with each row including the terminal device's unique identifier, the image's unique identifier, and the image's feature vector. A number; use the generated public key pk e Two sub-databases are encrypted and sent to server 1 and server 2 respectively. The encrypted sub-databases ultimately possessed by server 1 and server 2 are respectively... and Each server has the same number of rows and columns of data; both server 1 and server 2 generate a preset number of random numbers, pre-calculate some operators needed for subsequent verification stages, and use the public keys of each terminal device to perform PK (player killing). e Encrypt the random numbers or operators so that they can be used directly in the subsequent verification stage.

[0044] Specifically, server 1 and server 2 execute the secure square summation protocol in parallel to calculate the ciphertext of the partial square Euclidean distance between the partial image data to be verified and all partial image data in their respective encrypted sub-databases, including the following steps:

[0045] After receiving the data sent by the requesting terminal device, Server 1 and Server 2 first retrieve the row of encrypted image data with the same unique identifier as the requesting terminal device and the image to be verified from their respective encrypted sub-databases.

[0046] Based on homomorphic encryption, two servers compute the ciphertext of the difference between the feature vectors of two partial images in parallel;

[0047] Server 1 and Server 2 execute the secure square summation protocol in parallel to calculate the ciphertext of the partial square Euclidean distance between the feature vectors of the two partial images;

[0048] Server 2 sends the encrypted result to Server 1, and Server 1 calculates the encrypted result of the squared Euclidean distance based on homomorphic addition.

[0049] Specifically, the security comparison protocol includes the following steps:

[0050] Server 1 has two ciphertexts, x and y, where the plaintexts x, y ∈ [-2]. l ,2 l ], l is a constant that controls the size of the plaintext field;

[0051] Server 1 selects a random number π ∈ {0, 1} pre-generated during the registration phase. If π = 0, then the ciphertext is calculated. If π = 1, then calculate the ciphertext. Where N is a security parameter, and R1 and R2 are random numbers pre-generated during the registration phase, where R1 ← {0, 1} σ \{0}, σ is a security parameter; subsequently, server 1 performs partial decryption to obtain partially decrypted ciphertext C1, and sends C, C1, and π to server 2;

[0052] After receiving C, C1, and π, server 2 uses C and C1 to perform partial decryption and threshold decryption to obtain plaintext C. If If the plaintext u0 is 0, then u0 = 1; based on homomorphic encryption, calculate the ciphertext of the comparison result.

[0053] Specifically, server 2 performs masking and partial decryption on the result, server 1 performs partial decryption and threshold decryption, and sends the result to the requesting terminal device, including the following steps:

[0054] After obtaining the ciphertext of the comparison result, server 2 uses the ciphertext of the random number sent by the requesting terminal device, and performs masking based on homomorphic encryption to obtain the ciphertext of the mask value.

[0055] Server 2 performs partial decryption on the mask value ciphertext, obtains partially decrypted ciphertext, and sends the mask value ciphertext and the partially decrypted ciphertext to server 1;

[0056] After receiving the ciphertext mask value and partially decrypted ciphertext sent by server 2, server 1 performs partial decryption and threshold decryption to obtain the plaintext mask value. Server 1 then returns the plaintext mask value to the requesting terminal device.

[0057] Specifically, the secure square summation protocol includes the following steps:

[0058] Server 1 has s ciphertexts x1, x2, ..., x3. i , ..., x s , where x i This represents the i-th ciphertext, where each plaintext is in the range (-2). l ,2 l ), Constant L≥2 σ+2 N and σ are security parameters, and l is a constant that controls the size of the plaintext field;

[0059] Server 1 generates a random number r. i ←{0, 1} σ The random number here can be pre-generated during the registration phase, and the ciphertext X is calculated based on homomorphic encryption. i ←x i ·δ·r i δ is a constant for converting negative numbers to non-negative numbers, r i To generate encrypted random numbers, these numbers can be pre-generated during the registration phase. Server 1 calculates the ciphertext... Multiple ciphertexts are packaged into one ciphertext, and then partial decryption is performed to obtain partially decrypted ciphertext C1. Server 1 sends C and C1 to server 2.

[0060] After receiving C and C1, server 2 performs partial decryption and threshold decryption to obtain plaintext C, and then calculates each plaintext... Where i∈[1, s], then for all i∈[1, s], calculate the plaintext. And encrypt, ciphertext Send to server 1;

[0061] Based on homomorphic encryption, server 1 encrypts plaintext. and The ciphertext was obtained separately. and Server 1 calculates the ciphertext: Then calculate the ciphertext. Obtain plaintext The encrypted text.

[0062] In summary, this invention designs a series of secure outsourced computing protocols, including a secure square summation protocol and a secure comparison protocol, which support efficient ciphertext computation in the privacy-preserving image verification process. Furthermore, it uses a parallel computing mechanism, dividing the encrypted database into two parts and storing them on two servers. The two servers execute the privacy-preserving image verification task in parallel, thereby improving the performance of privacy-preserving image verification.

[0063] The above embodiments are preferred embodiments of the present invention, but the embodiments of the present invention are not limited to the above embodiments. Any changes, modifications, substitutions, combinations, or simplifications made without departing from the spirit and principle of the present invention shall be considered equivalent substitutions and shall be included within the protection scope of the present invention.

Claims

1. An efficient privacy-preserving image verification method based on a threshold Paillier cryptosystem, characterized in that, Includes the following steps: During the registration phase, each terminal device in the terminal device group preprocesses its own database, including splitting the feature vectors of all images in the database in half to form two sub-databases and encrypting them. These two encrypted sub-databases are then sent to Server 1 and Server 2 respectively for comparison with the images to be verified during the verification phase. Server 1 and Server 2 perform offline preprocessing mechanisms, pre-calculating the data needed for the verification phase, including encrypted random numbers and encryption operators. The terminal device group contains Y terminal devices, each generating its own public key pk for the threshold Paillier cryptosystem. e and private key sk e And some private keys sk e，1 and SK e，2 , will PK e and SK e，1 Send to server 1, and send the PK e and SK e，2 Send to server 2, e∈[1,Y]; During the verification phase, any terminal device initiates a privacy-preserving image verification task request, requesting the terminal device to extract the feature vector (v1, v2, ..., v) of the n-dimensional image to be verified. i , ..., v n ), v i Representing the i-th feature vector, the feature vector is split in half to form two data to be sent. Each data to be sent includes a unique identifier for the terminal device (ED), a unique identifier for the image (ID), and partial image data, where the partial image data includes the feature vector of a portion of the image. The public key pk is used. e Encrypt a portion of the image data from two data sets to be sent and generate an encrypted random number. Send the encrypted first data set to server 1, and send the encrypted second data set and the encrypted random number to server 2. Server 1 receives the data ED, ID, v1, v2, ..., v i , ..., v n The data obtained by server 2 is The system generates an encrypted random number and waits for server 1 to return the result. Servers 1 and 2 execute a secure square summation protocol in parallel to calculate the ciphertext of the partial square Euclidean distance between the image data to be verified and all partial image data in their respective encrypted sub-databases. Server 2 then sends its calculation result to server 1, which merges its result with server 2's result to obtain the ciphertext of the square Euclidean distance. With the assistance of server 2, server 1 executes a secure comparison protocol to compare the ciphertext of the square Euclidean distance with the ciphertext of the set verification threshold. Server 2 then obtains the ciphertext of the comparison result. Server 2 performs masking and partial decryption on the result, while server 1 performs partial decryption and threshold decryption, and sends the result to the requesting terminal device. After obtaining the result returned by server 1, the requesting terminal device uses its own generated random number to recover the correct verification result.

2. The efficient privacy-preserving image verification method based on the threshold Paillier cryptosystem according to claim 1, characterized in that, During the registration phase, each terminal device's database consists of n+2 columns, where n represents the feature vector dimension. Each row of the database comprises: a unique identifier for the terminal device, a unique identifier for the image, and n values ​​representing the image feature vector. The terminal device preprocesses the database by vertically splitting the image feature vector in half along each column, resulting in two sub-databases. Each sub-database consists of... The sub-database is composed of columns, with each row including the terminal device's unique identifier, the image's unique identifier, and the image's feature vector. A number; use the generated public key pk e Two sub-databases are encrypted and sent to server 1 and server 2 respectively. The encrypted sub-databases ultimately possessed by server 1 and server 2 are respectively... and Each server has the same number of rows and columns of data; both server 1 and server 2 generate a preset number of random numbers, pre-calculate some operators needed for subsequent verification stages, and use the public keys of each terminal device to perform PK (player killing). e Encrypt the random numbers or operators so that they can be used directly in the subsequent verification stage.

3. The efficient privacy-preserving image verification method based on the threshold Paillier cryptosystem according to claim 2, characterized in that, Server 1 and Server 2 execute the secure square summation protocol in parallel to calculate the ciphertext of the partial square Euclidean distance between the partial image data to be verified and all partial image data in their respective encrypted sub-databases, including the following steps: After receiving the data sent by the requesting terminal device, Server 1 and Server 2 first retrieve the encrypted image data with the same unique identifier as the requesting terminal device and the image to be verified from their respective encrypted sub-databases; Based on homomorphic encryption, two servers compute the ciphertext of the difference between the feature vectors of two partial images in parallel; Server 1 and Server 2 execute the secure square summation protocol in parallel to calculate the ciphertext of the partial square Euclidean distance between the feature vectors of the two partial images; Server 2 sends the encrypted result to Server 1, and Server 1 calculates the encrypted result of the squared Euclidean distance based on homomorphic addition.

4. The efficient privacy-preserving image verification method based on the threshold Paillier cryptosystem according to claim 3, characterized in that, The security comparison protocol includes the following steps: Server 1 has two ciphertexts, x and y, where the plaintexts x and y ∈ [-2]. l ,2 l ], l is a constant that controls the size of the plaintext field; Server 1 selects a random number π ∈ {0, 1} pre-generated during the registration phase. If π = 0, then the ciphertext is calculated. If π = 1, then calculate the ciphertext. Where N is a security parameter, and R1 and R2 are random numbers pre-generated during the registration phase, where R1 ← {0, 1} σ \{0}, σ is a security parameter; subsequently, server 1 performs partial decryption to obtain partially decrypted ciphertext C1, and sends C, C1, and π to server 2; After receiving C, C1, and π, server 2 uses C and C1 to perform partial decryption and threshold decryption to obtain plaintext C. If If the plaintext u0 is 0, then u0 = 1; based on homomorphic encryption, calculate the ciphertext of the comparison result.

5. The efficient privacy-preserving image verification method based on the threshold Paillier cryptosystem according to claim 4, characterized in that, Server 2 performs masking and partial decryption on the result, while server 1 performs partial decryption and threshold decryption, and then sends the result to the requesting terminal device, including the following steps: After obtaining the ciphertext of the comparison result, server 2 uses the ciphertext of the random number sent by the requesting terminal device, and performs masking based on homomorphic encryption to obtain the ciphertext of the mask value. Server 2 performs partial decryption on the mask value ciphertext, obtains partially decrypted ciphertext, and sends the mask value ciphertext and the partially decrypted ciphertext to server 1; After receiving the ciphertext mask value and partially decrypted ciphertext sent by server 2, server 1 performs partial decryption and threshold decryption to obtain the plaintext mask value. Server 1 then returns the plaintext mask value to the requesting terminal device.

6. The efficient privacy-preserving image verification method based on the threshold Paillier cryptosystem according to claim 3, characterized in that, The secure square summation protocol includes the following steps: Server 1 has s ciphertexts x1, x2, ..., x3. i , ..., x s , where x i This represents the i-th ciphertext, where each plaintext is in the range (-2). l ,2 l ), Constant L≥2 σ+2 N and σ are security parameters, and l is a constant that controls the size of the plaintext field; Server 1 generates a random number r. i ←{0, 1} σ The random number here can be pre-generated during the registration phase, and the ciphertext X is calculated based on homomorphic encryption. i ←x i ·δ·r i δ is a constant for converting negative numbers to non-negative numbers, and r i To encrypt random numbers, they can be pre-generated during the registration phase. Server 1 calculates the ciphertext... Multiple ciphertexts are packaged into one ciphertext, and then partial decryption is performed to obtain partially decrypted ciphertext C1. Server 1 sends C and C1 to server 2. After receiving C and C1, server 2 performs partial decryption and threshold decryption to obtain plaintext C, and then calculates each plaintext... Where i∈[1, s], then for all i∈[1, s], calculate the plaintext. And encrypt, ciphertext Send to server 1; Based on homomorphic encryption, server 1 encrypts plaintext. and The ciphertext was obtained separately. and Server 1 calculates the ciphertext: Then calculate the ciphertext. Obtain plaintext The encrypted text.

Images