Privacy protection image recognition method based on threshold Paillier cryptosystem

Abstract

The invention discloses a privacy protection image recognition method based on a threshold Paillier cryptosystem, and the method comprises the steps: enabling a database mechanism to encrypt a database according to lines, horizontally dividing the encrypted database into two parts, transmitting the two parts to a server 1 and a server 2, and enabling the server 1 and the server 2 to execute an offline preprocessing mechanism; in the recognition stage, a user encrypts a feature vector of an image to be recognized and generates a random number, the encrypted feature vector and the encrypted random number are sent to a server 1, the encrypted feature vector is sent to a server 2, the server 1 and the server 2 calculate the square Euclidean distance in parallel and find the minimum value, the server 1 masks and partially decrypts the result, and the image to be recognized is obtained. The server 2 performs partial decryption and threshold decryption and sends a result to the user; and after obtaining the result returned by the server 2, the user recovers the result by using the random number generated by the user to obtain a correct identification result. According to the method, accurate identification of the privacy protection image can be efficiently completed.

Description

Technical Field

[0001] The present invention relates to the technical field of image recognition, and in particular to a privacy-preserving image recognition method based on a threshold Paillier cryptographic system. Background Art

[0002] Privacy-preserving image recognition is a technology that aims to achieve image recognition while protecting data privacy. It is widely used in fields with high security requirements. In addition, image recognition can be extended to other fields, such as face recognition. The core of image recognition technology is to extract unique features from images and then identify them through similarity measurement (such as Euclidean distance and cosine similarity). However, traditional image recognition technology usually requires the transmission of plaintext data to a cloud server for processing. Although this improves recognition efficiency, it also brings serious privacy risks.

[0003] In traditional image recognition systems, client devices are usually responsible for capturing images and sending these images or their feature vectors to a cloud server. The cloud server relies on powerful computing power to perform recognition tasks and returns the results to the client. This architecture allows client devices to not have to bear a large amount of computing burden, and recognition tasks can be completed efficiently in the cloud. However, in this process, data may face the risk of being intercepted or leaked during transmission and storage, especially when sensitive data is involved. For example, in some sensitive application scenarios, unauthorized image leakage may lead to the leakage of private information of individuals or organizations, thereby threatening their security.

[0004] In order to solve the above privacy issues, privacy-preserving image recognition technology has emerged. This technology uses a variety of encryption methods to ensure that the cloud server cannot directly access the original data during the image recognition process, thereby greatly reducing the risk of data leakage. The core of privacy-preserving image recognition technology is to protect the privacy of image data through encryption methods such as homomorphic encryption, secret sharing or differential privacy.

[0005] Homomorphic encryption is an encryption technology that allows calculations to be performed in a ciphertext state, which means that cloud servers can directly process encrypted data without decrypting the data. Secret sharing technology divides data into multiple parts and stores them on different servers. The original data can only be reconstructed when these parts are combined together. Differential privacy protects individual privacy by introducing noise into the data, making individual data points difficult to identify.

[0006] However, although privacy-preserving image recognition technology has shown great potential in privacy protection, current technical solutions still face some challenges. First, the computational complexity of homomorphic encryption is high, especially when processing large-scale data, the computational cost increases significantly. Although some solutions have improved efficiency through batch computing, operations such as multiplication and minimum value are still time-consuming and expensive in the ciphertext state. This means that in practical applications, cloud servers need stronger computing power and more resources to perform these tasks.

[0007] Secondly, privacy-preserving image recognition technology has difficulties in balancing privacy protection and recognition accuracy. In order to enhance privacy protection, some schemes use approximate calculations or introduce noise into the data. However, these measures inevitably reduce the accuracy of recognition. For example, the differential privacy-based method introduces noise to cover up the real data, but this also affects the final recognition result, making it less accurate than when processing the original data.

[0008] In addition, the actual deployment of privacy-preserving image recognition technology also faces operational challenges. In a multi-server architecture, computing tasks between servers need to be coordinated, which may lead to a waste of computing resources. For example, a server may need to wait for another server to complete the calculation before continuing the task, thereby reducing the efficiency of the overall system. Therefore, how to optimize the allocation of server computing power and improve resource utilization is also a problem that privacy-preserving image recognition technology needs to solve. Summary of the invention

[0009] The purpose of the present invention is to overcome the shortcomings of the prior art and provide a privacy-preserving image recognition method based on a threshold Paillier cryptographic system, which can efficiently and accurately recognize privacy-preserving images with high reliability.

[0010] To achieve the above object, the technical solution provided by the present invention is: a privacy-preserving image recognition method based on a threshold Paillier cryptographic system, comprising the following steps:

[0011] In the registration phase, after the database organization encrypts the database by row, it divides the encrypted database horizontally into two parts and sends them to server 1 and server 2 respectively for comparison with the image to be identified in the identification phase. Server 1 and server 2 perform an offline preprocessing mechanism to precalculate the data required for the identification phase, including encrypted random numbers and encryption operators. The database organization has a database containing a large number of image feature vectors and is responsible for the generation and distribution of keys. The database organization generates a public key pk and a private key sk of a threshold Paillier cryptographic system and partial private keys sk1 and sk2, sends pk to the user, sends pk and sk1 to server 1, and sends pk and sk2 to server 2.

[0012] In the recognition stage, the user initiates a privacy-preserving image recognition task request, uses the public key pk to encrypt the feature vector of the image to be recognized and generates a random number, sends the encrypted feature vector and the encrypted random number to server 1, sends the encrypted feature vector to server 2, and then waits for server 2 to return the result; server 1 and server 2 calculate the square Euclidean distance between the feature vector of the image to be recognized and the feature vectors of all images in the encrypted database that they each own, and find the minimum value of the square Euclidean distance of their respective parts. Then, server 1 masks and partially decrypts the result, server 2 performs partial decryption and threshold decryption, and sends the result to the user; after the user obtains the result returned by server 2, he uses the random number generated by himself to restore the result to obtain the correct recognition result.

[0013] Furthermore, during the registration phase, the database mechanism encrypts the database to obtain an encrypted database. The encrypted database It consists of γ rows and n+1 columns, where γ represents the number of images and n represents the dimension of the feature vector. The encrypted database is divided into two parts by row level. If the number of rows in the two parts is the same, they are sent to server 1 and server 2 respectively. Otherwise, the part with a smaller number of rows is sent to server 2, and the part with a larger number of rows is sent to server 1. The encrypted database owned by server 1 is used Indicates that it is The partially encrypted database owned by server 2 is composed of n+1 rows and columns. Indicates that it is The server 1 and the server 2 both generate a preset number of random numbers, pre-calculate some operators required for the subsequent recognition stage, and encrypt some random numbers or operators for direct use in the subsequent recognition stage.

[0014] Furthermore, the server 1 and the server 2 calculate in parallel the squared Euclidean distance between the feature vector of the image to be identified and the feature vectors of all images in the encrypted database that each server 1 and server 2 owns, including the following steps:

[0015] After receiving the encrypted feature vector sent by the user, Server 1 and Server 2 calculate the ciphertext of the difference between the encrypted feature vector and all vectors in their respective partially encrypted databases in parallel based on homomorphic encryption;

[0016] After server 1 and server 2 calculate the ciphertext of the difference, they execute the secure batch square protocol in parallel to calculate the ciphertext of the square of the difference;

[0017] After server 1 and server 2 calculate the ciphertext of the square of the difference, they calculate the ciphertext of the squared Euclidean distance in parallel, that is, for each vector, based on homomorphic encryption, all ciphertext values ​​of the vector are multiplied cumulatively to obtain the ciphertext of the sum of the plaintext values.

[0018] Further, the server 1 and the server 2 find the minimum value of the squared Euclidean distances they each have, including the following steps:

[0019] After server 1 and server 2 calculate the ciphertext of the squared Euclidean distance between the encrypted feature vector of the image and all vectors in their respective partially encrypted databases, they execute the secure τ-minimum protocol in parallel, where τ = n, and find the ciphertext of the minimum squared Euclidean distance for each of them;

[0020] Server 2 sends its own minimum ciphertext to server 1. Server 1 uses its own minimum ciphertext, the minimum ciphertext sent by server 2, and the ciphertext of the set recognition threshold as input. With the assistance of server 2, server 1 executes the secure τ-minimum protocol again. At this time, τ=3, and obtains the ciphertext of the global minimum.

[0021] Further, the server 1 masks and partially decrypts the result, the server 2 performs partial decryption and threshold decryption, and sends the result to the user, including the following steps:

[0022] After server 1 obtains the ciphertext of the global minimum value, it uses the random number ciphertext sent by the user to perform masking based on homomorphic encryption to obtain the masked value ciphertext;

[0023] Server 1 performs partial decryption on the mask value ciphertext to obtain a partial decrypted ciphertext, and sends the mask value ciphertext and the partial decrypted ciphertext to server 2;

[0024] After server 2 obtains the mask value ciphertext and partial decryption ciphertext sent by server 1, it performs partial decryption and threshold decryption to obtain the mask value plaintext, and server 2 returns the mask value plaintext to the user.

[0025] Further, the secure batch square protocol comprises the following steps:

[0026] Server 1 has s ciphertexts in, represents the i-th ciphertext, and the range of each plaintext is Constant L ≥ 2 σ+2 , N and σ are safety parameters, A constant to control the size of the plaintext field;

[0027] Server 1 generates s random numbers r i ←{0,1} σ, where the random number can be pre-generated during the registration phase, based on homomorphic encryption, to calculate the ciphertext Where δ is a constant that converts negative numbers to non-negative numbers, To encrypt the random number, Server 1 calculates the ciphertext Pack multiple ciphertexts into one ciphertext, and then perform partial decryption to obtain partial decrypted ciphertext Server 1 will and Send to server 2;

[0028] Server 2 receives and After that, perform partial decryption and threshold decryption to obtain plaintext C, and then calculate each plaintext Where i∈[1,s], calculate the square of these s values ​​and encrypt them. Send to server 1;

[0029] For i∈[1,s], server 1 calculates the ciphertext And encryption and 2δr i Get encryption operator and Then calculate the ciphertext get The ciphertext.

[0030] Further, the secure τ-minimum protocol comprises the following steps:

[0031] Server 1 has τ ciphertexts in, represents the τth ciphertext, and the range of each plaintext is A constant to control the size of the plaintext field;

[0032] Let the minimum ciphertext Control loop variable t=2;

[0033] When t≤τ, Server 1 and Server 2 execute the secure 2-minimum protocol and assign the minimum ciphertext to And t=t+1, at the end of the cycle, server 1 obtains the minimum ciphertext

[0034] Further, the secure 2-minimum protocol comprises the following steps:

[0035] Server 1 has two ciphertexts and The plain text

[0036] Server 1 selects a random number π∈{0,1} generated in advance during the registration phase. If π=0, the ciphertext is calculated If π=1, then calculate the ciphertext Among them, N is the security parameter, R1 and R2 are random numbers pre-generated during the registration phase, and R1←{0,1} σ \{0}, Then, server 1 performs partial decryption to obtain Will Send to server 2;

[0037] Server 2 receives After that, use and Perform partial decryption and threshold decryption to obtain plaintext D. If Then calculate the ciphertext Otherwise calculate the ciphertext Among them, r' is the random number pre-generated during the registration phase for refreshing the ciphertext. Server 2 will Send to server 1;

[0038] The server receives After that, calculate the ciphertext of the minimum value result according to the value of π generated by yourself. If π=0, the minimum ciphertext otherwise,

[0039] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0040] 1. Based on the threshold Paillier cryptographic system, the present invention proposes an efficient and reliable privacy-preserving image recognition scheme, which supports dual servers to efficiently recognize images without leaking the user's privacy information, including image feature vectors and recognition results, and does not reduce the recognition accuracy.

[0041] 2. The present invention designs a series of secure outsourced computing protocols, including secure batch square and secure minimum protocols (i.e., secure τ-minimum protocol and secure 2-minimum protocol), etc. The present invention uses the proposed secure outsourced computing protocols to support efficient ciphertext computing in the privacy-preserving image recognition process.

[0042] 3. The present invention uses a parallel computing mechanism to evenly distribute the database to two servers, which perform the privacy-preserving image recognition task in parallel. In this task, each server needs to perform its own computing task while assisting another server in executing the secure computing protocol. The parallel computing mechanism used in the present invention improves the efficiency and performance of privacy-preserving image recognition.

[0043] 4. The present invention does not require the user to frequently interact with the server during the recognition process, and the recognition task will not reduce the recognition accuracy while ensuring high efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 Schematic diagram of the method of the present invention.

[0045] Figure 2 This is a relationship diagram between database organizations, users, server 1 and server 2. DETAILED DESCRIPTION

[0046] The present invention is further described in detail below in conjunction with embodiments and drawings, but the embodiments of the present invention are not limited thereto.

[0047] See also Figure 1 and Figure 2 As shown, this embodiment discloses a privacy-preserving image recognition method based on a threshold Paillier cryptographic system, comprising the following steps:

[0048] In the registration phase, after the database organization encrypts the database by row, it divides the encrypted database horizontally into two parts and sends them to server 1 and server 2 respectively for comparison with the image to be identified in the identification phase. Server 1 and server 2 perform an offline preprocessing mechanism to precalculate the data required for the identification phase, including encrypted random numbers and encryption operators. The database organization has a database containing a large number of image feature vectors and is responsible for the generation and distribution of keys. The database organization generates a public key pk and a private key sk of a threshold Paillier cryptographic system and partial private keys sk1 and sk2, sends pk to the user, sends pk and sk1 to server 1, and sends pk and sk2 to server 2.

[0049] In the recognition stage, the user initiates a privacy-preserving image recognition task request, uses the public key pk to encrypt the feature vector of the image to be recognized (the user can obtain a picture of the image to be recognized through a terminal device such as a camera, mobile phone, etc., and extract the feature vector through a deep learning model) and generates a random number, sends the encrypted feature vector and the encrypted random number to server 1, sends the encrypted feature vector to server 2, and then waits for server 2 to return the result; server 1 and server 2 calculate the square Euclidean distance between the feature vector of the image to be recognized and the feature vectors of all images in the encrypted database that they each own, and find the minimum value of the square Euclidean distance of their respective parts. Subsequently, server 1 masks and partially decrypts the result, server 2 performs partial decryption and threshold decryption, and sends the result to the user; after the user obtains the result returned by server 2, he uses the random number generated by himself to restore the result to obtain the correct recognition result.

[0050] Specifically, during the registration phase, the database agency encrypts the database to obtain an encrypted database. The encrypted database It consists of γ rows and n+1 columns, where γ represents the number of images and n represents the dimension of the feature vector. The encrypted database is divided into two parts by row level. If the number of rows in the two parts is the same, they are sent to server 1 and server 2 respectively. Otherwise, the part with a smaller number of rows is sent to server 2, and the part with a larger number of rows is sent to server 1. The encrypted database owned by server 1 is used Indicates that it is The partially encrypted database owned by server 2 is composed of n+1 rows and columns. Indicates that it is The server 1 and the server 2 both generate a preset number of random numbers, pre-calculate some operators needed for the subsequent recognition stage (the secure batch square protocol, secure τ-minimum protocol and secure 2-minimum protocol will be called during the recognition. There are some random numbers and operators in these protocols, which can be pre-calculated here. The operators can be understood as some constants, or operations performed on constants and random numbers), and encrypt some random numbers or operators for direct use in the subsequent recognition stage.

[0051] Specifically, the server 1 and the server 2 calculate in parallel the squared Euclidean distance between the feature vector of the image to be identified and the feature vectors of all images in the encrypted database that each server 1 and server 2 owns, including the following steps:

[0052] After receiving the encrypted feature vector sent by the user, Server 1 and Server 2 calculate the ciphertext of the difference between the encrypted feature vector and all vectors in their respective partially encrypted databases in parallel based on homomorphic encryption;

[0053] After server 1 and server 2 calculate the ciphertext of the difference, they execute the secure batch square protocol in parallel to calculate the ciphertext of the square of the difference;

[0054] After server 1 and server 2 calculate the ciphertext of the square of the difference, they calculate the ciphertext of the squared Euclidean distance in parallel, that is, for each vector, based on homomorphic encryption, all ciphertext values ​​of the vector are multiplied cumulatively to obtain the ciphertext of the sum of the plaintext values.

[0055] Specifically, the server 1 and the server 2 find the minimum value of the squared Euclidean distances they each have, including the following steps:

[0056] After server 1 and server 2 calculate the ciphertext of the squared Euclidean distance between the encrypted feature vector of the image and all vectors in their respective partially encrypted databases, they execute the secure τ-minimum protocol in parallel, where τ = n, and find the ciphertext of the minimum squared Euclidean distance for each of them;

[0057] Server 2 sends its own minimum ciphertext to server 1. Server 1 uses its own minimum ciphertext, the minimum ciphertext sent by server 2, and the ciphertext of the set recognition threshold as input. With the assistance of server 2, server 1 executes the secure τ-minimum protocol again. At this time, τ=3, and obtains the ciphertext of the global minimum.

[0058] Specifically, the server 1 masks and partially decrypts the result, the server 2 performs partial decryption and threshold decryption, and sends the result to the user, including the following steps:

[0059] After server 1 obtains the ciphertext of the global minimum value, it uses the random number ciphertext sent by the user to perform masking based on homomorphic encryption to obtain the masked value ciphertext;

[0060] Server 1 performs partial decryption on the mask value ciphertext to obtain a partial decrypted ciphertext, and sends the mask value ciphertext and the partial decrypted ciphertext to server 2;

[0061] After server 2 obtains the mask value ciphertext and partial decryption ciphertext sent by server 1, it performs partial decryption and threshold decryption to obtain the mask value plaintext, and server 2 returns the mask value plaintext to the user.

[0062] Specifically, the secure batch square protocol comprises the following steps:

[0063] Server 1 has s ciphertexts in, represents the i-th ciphertext, and the range of each plaintext is Constant L ≥ 2 σ+2 , N and σ are safety parameters, A constant to control the size of the plaintext field;

[0064] Server 1 generates s random numbers r i ←{0,1} σ , where the random number can be pre-generated during the registration phase, based on homomorphic encryption, to calculate the ciphertext Where δ is a constant that converts negative numbers to non-negative numbers, To encrypt the random number, Server 1 calculates the ciphertext Pack multiple ciphertexts into one ciphertext, and then perform partial decryption to obtain partial decrypted ciphertext Server 1 will and Send to server 2;

[0065] Server 2 receives and After that, perform partial decryption and threshold decryption to obtain plaintext C, and then calculate each plaintext Where i∈[1,s], calculate the square of these s values ​​and encrypt them. Send to server 1;

[0066] For i∈[1,s], server 1 calculates the ciphertext And encryption and 2δr i Get encryption operator and Then calculate the ciphertext get The ciphertext.

[0067] Specifically, the secure τ-minimum protocol comprises the following steps:

[0068] Server 1 has τ ciphertexts in, represents the τth ciphertext, and the range of each plaintext is A constant to control the size of the plaintext field;

[0069] Let the minimum ciphertext Control loop variable t=2;

[0070] When t≤τ, Server 1 and Server 2 execute the secure 2-minimum protocol and assign the minimum ciphertext to And t=t+1, at the end of the cycle, server 1 obtains the minimum ciphertext

[0071] Specifically, the secure 2-minimum protocol comprises the following steps:

[0072] Server 1 has two ciphertexts and The plain text

[0073] Server 1 selects a random number π∈{0,1} generated in advance during the registration phase. If π=0, the ciphertext is calculated If π=1, then calculate the ciphertext Among them, N is the security parameter, R1 and R2 are random numbers pre-generated during the registration phase, and R1←{0,1} σ \{0}, Then, server 1 performs partial decryption to obtain Will Send to server 2;

[0074] Server 2 receives After that, use and Perform partial decryption and threshold decryption to obtain plaintext D. If Then calculate the ciphertext Otherwise calculate the ciphertext Among them, r' is the random number pre-generated during the registration phase for refreshing the ciphertext. Server 2 will Send to server 1;

[0075] The server receives After that, calculate the ciphertext of the minimum value result according to the value of π generated by yourself. If π=0, the minimum ciphertext otherwise,

[0076] In summary, the present invention designs a series of secure outsourced computing protocols, including the secure batch square protocol and the secure minimum protocol (i.e., the secure τ-minimum protocol and the secure 2-minimum protocol), which support efficient ciphertext calculation in the process of privacy-preserving image recognition, and uses a parallel computing mechanism to divide the database into two parts and store them on dual servers respectively. The dual servers execute the privacy-preserving image recognition task in parallel, greatly improving the performance of privacy-preserving image recognition.

[0077] The above embodiments are preferred implementation modes of the present invention, but the implementation modes of the present invention are not limited to the above embodiments. Any other changes, modifications, substitutions, combinations, and simplifications that do not deviate from the spirit and principles of the present invention should be equivalent replacement methods and are included in the protection scope of the present invention.

Claims

1. A privacy-preserving image recognition method based on a threshold Paillier cryptographic system, characterized in that: The following steps are involved: In the registration phase, after the database organization encrypts the database by row, it divides the encrypted database horizontally into two parts and sends them to server 1 and server 2 respectively for comparison with the image to be identified in the identification phase. Server 1 and server 2 perform an offline preprocessing mechanism to precalculate the data required for the identification phase, including encrypted random numbers and encryption operators. The database organization has a database containing a large number of image feature vectors and is responsible for the generation and distribution of keys. The database organization generates a public key pk and a private key sk of a threshold Paillier cryptographic system and partial private keys sk1 and sk2, sends pk to the user, sends pk and sk1 to server 1, and sends pk and sk2 to server 2. In the recognition phase, the user initiates a privacy-preserving image recognition task request, uses the public key pk to encrypt the feature vector of the image to be recognized and generates a random number, sends the encrypted feature vector and the encrypted random number to server 1, sends the encrypted feature vector to server 2, and then waits for server 2 to return the result; server 1 and server 2 calculate the squared Euclidean distance between the feature vector of the image to be recognized and the feature vectors of all images in the encrypted database they each own, and find the minimum value of the squared Euclidean distance of their respective parts, then server 1 masks and partially decrypts the result, server 2 performs partial decryption and threshold decryption, and sends the result to the user; After the user obtains the result returned by the server 2, he uses the random number generated by himself to restore the result to obtain the correct recognition result.

2. The privacy-preserving image recognition method based on the threshold Paillier cryptographic system according to claim 1, characterized in that: During the registration phase, the database agency encrypts the database to obtain an encrypted database. The encrypted database It consists of γ rows and n+1 columns, where γ represents the number of images and n represents the dimension of the feature vector. The encrypted database is divided into two parts by row level. If the number of rows in the two parts is the same, they are sent to server 1 and server 2 respectively. Otherwise, the part with a smaller number of rows is sent to server 2, and the part with a larger number of rows is sent to server 1. The encrypted database owned by server 1 is used Indicates that it is The partially encrypted database owned by server 2 is composed of n+1 rows and columns. Indicates that it is The server 1 and the server 2 both generate a preset number of random numbers, pre-calculate some operators required for the subsequent recognition stage, and encrypt some random numbers or operators for direct use in the subsequent recognition stage.

3. The privacy-preserving image recognition method based on the threshold Paillier cryptographic system according to claim 2 is characterized in that: The server 1 and the server 2 calculate in parallel the squared Euclidean distance between the feature vector of the image to be identified and the feature vectors of all images in the encrypted database that each server 1 and server 2 owns, including the following steps: After receiving the encrypted feature vector sent by the user, Server 1 and Server 2 calculate the ciphertext of the difference between the encrypted feature vector and all vectors in their respective partially encrypted databases in parallel based on homomorphic encryption; After server 1 and server 2 calculate the ciphertext of the difference, they execute the secure batch square protocol in parallel to calculate the ciphertext of the square of the difference; After server 1 and server 2 calculate the ciphertext of the square of the difference, they calculate the ciphertext of the squared Euclidean distance in parallel, that is, for each vector, based on homomorphic encryption, all ciphertext values ​​of the vector are multiplied cumulatively to obtain the ciphertext of the sum of the plaintext values.

4. The privacy-preserving image recognition method based on the threshold Paillier cryptographic system according to claim 3 is characterized in that: The server 1 and the server 2 find the minimum value of the squared Euclidean distance of each of them, including the following steps: After server 1 and server 2 calculate the ciphertext of the squared Euclidean distance between the encrypted feature vector of the image and all vectors in their respective partially encrypted databases, they execute the secure τ-minimum protocol in parallel, where τ = n, and find the ciphertext of the minimum squared Euclidean distance for each of them; Server 2 sends its own minimum ciphertext to server 1. Server 1 uses its own minimum ciphertext, the minimum ciphertext sent by server 2, and the ciphertext of the set recognition threshold as input. With the assistance of server 2, server 1 executes the secure τ-minimum protocol again. At this time, τ=3, and obtains the ciphertext of the global minimum.

5. The privacy-preserving image recognition method based on the threshold Paillier cryptographic system according to claim 4 is characterized in that: The server 1 masks and partially decrypts the result, the server 2 performs partial decryption and threshold decryption, and sends the result to the user, including the following steps: After server 1 obtains the ciphertext of the global minimum value, it uses the random number ciphertext sent by the user and performs masking based on homomorphic encryption to obtain the masked value ciphertext; Server 1 performs partial decryption on the mask value ciphertext to obtain a partial decrypted ciphertext, and sends the mask value ciphertext and the partial decrypted ciphertext to server 2; After server 2 obtains the mask value ciphertext and partial decryption ciphertext sent by server 1, it performs partial decryption and threshold decryption to obtain the mask value plaintext, and server 2 returns the mask value plaintext to the user.

6. The privacy-preserving image recognition method based on the threshold Paillier cryptographic system according to claim 3 is characterized in that: The secure batch square protocol comprises the following steps: Server 1 has s ciphertexts in, represents the i-th ciphertext, and the range of each plaintext is (-2 l ,2 l ), Constant L ≥ 2 σ+2 , N and σ are security parameters, and l is a constant that controls the size of the plaintext field; Server 1 generates s random numbers r i ←{0,1} σ , where the random number can be pre-generated during the registration phase, based on homomorphic encryption, to calculate the ciphertext Where δ is a constant that converts negative numbers to non-negative numbers, To encrypt the random number, Server 1 calculates the ciphertext Pack multiple ciphertexts into one ciphertext, and then perform partial decryption to obtain partial decrypted ciphertext Server 1 will and Send to server 2; Server 2 receives and After that, perform partial decryption and threshold decryption to obtain plaintext C, and then calculate each plaintext Where i∈[1,s], calculate the square of these s values ​​and encrypt them. Send to server 1; For i∈[1,s], server 1 calculates the ciphertext and encrypt-r i 2 and 2δr i Get encryption operator and Then calculate the ciphertext get The ciphertext.

7. The privacy-preserving image recognition method based on the threshold Paillier cryptographic system according to claim 4, characterized in that: The secure τ-minimum protocol comprises the following steps: Server 1 has τ ciphertexts in, represents the τth ciphertext, and the range of each plaintext is (-2 l ,2 l ), l is a constant that controls the size of the plaintext field; Let the minimum ciphertext Control loop variable t=2; When t≤π, Server 1 and Server 2 execute the secure 2-minimum protocol and assign the minimum ciphertext to And t=t+1, at the end of the cycle, server 1 obtains the minimum ciphertext 8. The privacy-preserving image recognition method based on threshold Paillier cryptographic system according to claim 7, characterized in that: The secure 2-minimum protocol comprises the following steps: Server 1 has two ciphertexts and Where the plaintext x,y∈[-2 l ,2 l ]; Server 1 selects a random number π∈{0,1} generated in advance during the registration phase. If π=0, the ciphertext is calculated If π=1, then calculate the ciphertext Among them, N is the security parameter, R1 and R2 are random numbers pre-generated during the registration phase, R1←{0,1}σ\{0}, Then, server 1 performs partial decryption to obtain Will Send to server 2; Server 2 receives After that, use and Perform partial decryption and threshold decryption to obtain plaintext D. If Then calculate the ciphertext Otherwise calculate the ciphertext Among them, r' is the random number pre-generated during the registration phase for refreshing the ciphertext. Server 2 will Send to server 1; The server receives After that, calculate the ciphertext of the minimum value result according to the value of π generated by yourself. If π=0, the minimum ciphertext otherwise,

Images