NTRU-based efficient homomorphic ciphertext multiplication method

Abstract

The invention relates to an efficient homomorphic ciphertext multiplication method based on NTRU, and belongs to the field of information security. The method is implemented by an efficient homomorphic ciphertext multiplication system based on the NTRU, and the efficient homomorphic ciphertext multiplication system based on the NTRU is formed by connecting a client and a server through a network; the method comprises the following steps: S1, setting related parameters of an NTRU encryption scheme; s2, generating a public and private key pair; s3, encoding the plaintext vector; s4, encrypting the plaintext polynomial by using the public key; s5, the client sends a ciphertext and adds a label; s6, according to the requirement of the calculation task, homomorphic operation is executed, and a label is calculated; s7, sending the ciphertext and the label to the client; and S8, decrypting the ciphertext. According to the homomorphic multiplication method without relinearization, the decryption key is determined by adding the label to the ciphertext, so that the calculation complexity is greatly reduced, and the homomorphic multiplication efficiency can be effectively improved.

Description

Technical Field

[0001] The invention relates to an efficient homomorphic ciphertext multiplication method based on NTRU (Number Theory Research Unit), belongs to the field of information security, and is particularly suitable for efficient homomorphic ciphertext multiplication based on NTRU. Background Art

[0002] How to maintain the ciphertext structure is one of the difficulties in designing fully homomorphic encryption (FHE). For example, the ciphertext of the fully homomorphic encryption scheme based on the RLWE (Ring-based Learning With Error) problem is a two-dimensional vector composed of at least two polynomials.

[0003] In order to obtain the result of plaintext multiplication, the operation corresponding to the ciphertext is tensor multiplication, and the corresponding decryption key also becomes a tensor of the original key. Therefore, the dimension of the ciphertext increases exponentially with the number of multiplication operations. In order to reduce the ciphertext after tensor multiplication to the original dimension, each homomorphic multiplication requires a relinearization operation.

[0004] The relinearization of ciphertext requires the participation of the computation key. In general, the computation key is the ciphertext of the private key. To ensure security, this requires the introduction of a cyclic security assumption. In addition, relinearization introduces additional noise and computational overhead. For relinearization techniques based on bit decomposition, such as BGV, [1] Scheme, ciphertext tensor multiplication and relinearization involves approximately 4+2logq polynomial multiplications, where q is the ciphertext modulus; for relinearization techniques based on module exchange, such as CKKS [2] and BFV [3] The whole process involves about 6 polynomial multiplications. The above process makes the ciphertext multiplication very complicated.

[0005] Compared with the CKKS or BGV schemes, the encryption scheme based on NTRU has obvious advantages. This is because the public key and ciphertext of NTRU are both single polynomials, so the ciphertext structure does not change when performing homomorphic operations. Whether it is homomorphic addition or homomorphic multiplication, the output result is just a polynomial. The downside is that after homomorphic multiplication, the square of the public key will appear in the ciphertext. In order to decrypt correctly, a relinearization operation is still required after homomorphic multiplication to eliminate the square of the public key. For example, the homomorphic encryption scheme based on NTRU, YASHE [4] The complexity of homomorphic multiplication is very high due to the relinearization technique based on bit decomposition.

[0006] [1]Brakerski,Zvika,Craig Gentry,and Vinod Vaikuntanathan."(Leveled)fully homomorphic encryption without bootstrapping."ACM Transactions onComputation Theory(TOCT)6.3(2014):1-36.

[0007] [2]Cheon,Jung Hee,et al."Homomorphic encryption for arithmetic ofapproximate numbers."Advances in Cryptology–ASIACRYPT 2017:23rd InternationalConference on the Theory and Applications of Cryptology and InformationSecurity,Hong Kong,China,December 3-7,2017,Proceedings,Part I 23.SpringerInternational Publishing,2017.

[0008] [3]Fan,Junfeng,and Frederik Vercauteren."Somewhat practical fullyhomomorphic encryption."Cryptology ePrint Archive(2012). https: / / eprint.iacr.org / 2012 / 144 .

[0009] [4]Bos,Joppe W.,et al."Improved security for a ring-based fullyhomomorphic encryption scheme."Cryptography and Coding:14th IMAInternationalConference,IMACC 2013,Oxford,UK,December 17-19,2013.Proceedings 14.SpringerBerlin Heidelberg,2013.

[0010] [5]Albrecht,Martin,et al."Homomorphic encryption standard."Protectingprivacy through homomorphic encryption(2021):31-62. Summary of the invention

[0011] In view of this, the present invention first records the power of the public key by appending a label to the ciphertext after multiplication in order to determine the decryption key. Secondly, in combination with the encoding method of CKKS, a larger scaling factor is multiplied when encoding the plaintext polynomial so as to classify the redundant decryption results as noise. Therefore, the relinearization operation is avoided, thereby improving the efficiency of homomorphic multiplication, while enhancing the scalability and practicality of the system, thereby providing a more efficient and secure encryption solution for practical applications.

[0012] In order to achieve the above object, the present invention provides the following technical solutions:

[0013] The efficient homomorphic ciphertext multiplication method based on NTRU is implemented by an efficient homomorphic ciphertext multiplication system based on NTRU, wherein the efficient homomorphic ciphertext multiplication system based on NTRU is composed of a client and a server connected through a network; the method comprises the following steps:

[0014] S1: The server sets the relevant parameters of the NTRU encryption scheme and sends them to the client;

[0015] S2: The client generates a public-private key pair based on the set parameters;

[0016] S3: The client encodes the plaintext vector to obtain a plaintext polynomial.

[0017] S4: The client uses the public key to encrypt the plaintext polynomial to generate ciphertext;

[0018] S5: The client sends the ciphertext to the server, and the server adds a tag to the ciphertext;

[0019] S6: The server performs homomorphic operations on the ciphertext and calculates the label according to the computing task requirements;

[0020] S7: After the server completes the homomorphic operation, it sends the ciphertext and label to the client;

[0021] S8: The client modifies the decryption private key according to the label and decrypts the ciphertext to obtain the plaintext vector of the calculation result.

[0022] In step S1, the encryption parameters should at least include the degree n of the polynomial, the set of integers The variance σ, scaling factor Δ, multiplication depth L, and ciphertext modulus q of the Gaussian distribution D on the network; the degree n and scaling factor Δ of the polynomial are powers of 2 respectively, and the degree n of the polynomial is greater than the length of the plaintext vector; the mean of the Gaussian distribution D is 0.

[0023] The process of generating the public-private key pair described in step S2 is specifically as follows:

[0024] S201: sampling polynomial coefficients on Gaussian distribution D to obtain n-order polynomials f and g about indefinite variable x;

[0025] S202: Determine if f is in the polynomial ring R: Is there an inverse element on R? If yes, proceed to step S203, otherwise resample f until f has an inverse on R;

[0026] S203: Remainder class ring R in module q q :R / qR calculates the public key h=g·f -1 , and set f as the private key.

[0027] The encoding described in step S3 is specifically: for any given The plaintext vector v on is encoded as a polynomial on the polynomial ring R, and the output encoded plaintext polynomial is Among them, the symbol represents rounding, M is the Vandermonde matrix consisting of the 2nth primitive unit root ω

[0028]

[0029] Preferably, the encoding in step S3 may also be a scheme supporting SIMD technology.

[0030] The step S4 is: sampling the coefficients of noise polynomials r and e on Gaussian distribution D, and encrypting the plaintext polynomial m using the generated noise polynomials r and e to generate a ciphertext c=hr+e+m.

[0031] The adding of labels in step S5 is: adding labels with an initial value of 1 to each ciphertext one by one.

[0032] The computing task described in step S6 is described by the client.

[0033] Preferably, the computing task described in step S6 is a computing model owned by the server.

[0034] The step S6 is specifically as follows:

[0035] S601: Split the calculation task factor by factor into addition or multiplication forms;

[0036] S602: For ciphertext c1, c2, ..., c n , with labels l1,2,…,l n The addition calculation of the result is The label calculation result is max(l1,l2,…,l n );

[0037] S602: For ciphertext c1, c2, ..., c n , with labels l1,l2,…,l n The multiplication calculation of , the ciphertext of the calculation result is The label calculation result is

[0038] For the ciphertext calculation result c and the tag value l sent by the server, the step S8 is specifically as follows:

[0039] S801: Modify the decryption private key to f according to label l l ;

[0040] S802: Using the decryption private key f l Decrypt the ciphertext calculation result c to obtain the polynomial f l c;

[0041] S803: Calculate the conjugate transposed matrix of the Vandermonde matrix M consisting of the 2n primitive unit roots, which is the inverse matrix M of M. -1 ;

[0042] S804: Using M -1 f l c decoding, we get The complex vector f on l ·c·M -1 ;

[0043] S805: Using M -1 f l Decode and get The complex vector f on l ·M -1 ;

[0044] S806: Calculate the plaintext vector v=(f l ·c·M -1 ) / (f l ·M -1 ), where / represents bitwise division of vectors.

[0045] It should be noted that the calculated vector v is an approximation of the result calculated directly using the plain text.

[0046] The client and server are electronic devices, including at least one processor; and a memory connected to the at least one processor in communication; wherein,

[0047] The memory stores a computer program executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the above-mentioned NTRU-based efficient homomorphic ciphertext multiplication method.

[0048] Finally, the present invention also discloses a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the above-mentioned NTRU-based efficient homomorphic ciphertext multiplication method when executed.

[0049] The beneficial effects of the present invention are as follows: the present invention provides an efficient homomorphic ciphertext multiplication method based on NTRU, designs a homomorphic multiplication method that does not require relinearization, and determines the decryption key by adding a label to the ciphertext, thereby greatly reducing the computational complexity and effectively improving the efficiency of homomorphic multiplication. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to make the purpose and technical solution of the present invention clearer, the present invention provides the following appendix Figure 1 To explain:

[0051] Figure 1 Flow chart of an embodiment of the method of the present invention;

[0052] Figure 2 This is a schematic diagram of outsourcing calculation in Example 1 of the method of the present invention;

[0053] Figure 3 This is a schematic diagram of the structure of an electronic device according to Embodiment 3 of the method of the present invention. DETAILED DESCRIPTION

[0054] Example 1: Assuming that the client (1) has a need to outsource computing, it sends data to the server (2) through the network (3) for computing. In order to protect the privacy and security of the customer's data, the present invention provides an "efficient homomorphic ciphertext multiplication method based on NTRU".

[0055] Assume that the client needs to calculate (v1+v2)*(v3*v4), where v1, v2, v3, and v4 are all The symbol "*" indicates that the elements at each position of the vector are multiplied by position. The specific steps are:

[0056] Step 1: The server (2) sets the relevant parameters of the NTRU encryption scheme and sends them to the client (1).

[0057] Among them, the homomorphic encryption parameters are: polynomial degree n = 8142, scaling factor Δ = 2 60 , the variance of the noise distribution σ=3.3, and the ciphertext modulus q is 2 202 The first prime number after . The output NTRU encryption scheme parameters are (n, Δ, σ, q), and the security level of this parameter is λ=138.

[0058] Specifically:

[0059] S101: Let the polynomial ring Take the remainder class ring R q =R / qR is the ciphertext space,

[0060] S102: Take D as A discrete Gaussian distribution with a variance of σ and a mean of 0,

[0061] S103: The server (2) sends the parameters (n, Δ, σ, q) to the client (1).

[0062] Step 2: The client (1) generates a public-private key pair according to the set parameters. Specifically:

[0063] S201: The client (1) samples polynomial coefficients on a discrete Gaussian distribution D to obtain n-order polynomials f and g with respect to an indeterminate variable x;

[0064] S202: Determine whether f is in a polynomial ring Is there an inverse element on R? If yes, proceed to step S203, otherwise resample f until f has an inverse on R;

[0065] S203: Remainder class ring R in module q q :R / qR calculates the public key h=g·f -1 , and set f as the private key.

[0066] Step 3: The client (1) encodes the plaintext vector to obtain a plaintext polynomial.

[0067] The encoding is specifically as follows: the client (1) encodes the plaintext vector {v1, v2, v3, v4} into a polynomial {m1, m2, m3, m4} on a polynomial ring R,

[0068] S301: The client calculates the 2nth primitive unit root ω and calculates the Vandermonde matrix formed by ω

[0069]

[0070] S302: The plaintext vector {v i} 1≤i≤4 Encoded as plaintext polynomial {m i}1≤i≤4 ,in symbol Indicates rounding.

[0071] Step 4: The client (1) uses the public key to encrypt the plaintext polynomial to generate ciphertext.

[0072] Step S4 is specifically as follows:

[0073] S401: The client samples the polynomial coefficients on the discrete Gaussian distribution D to obtain an n-order polynomial {r i} 1≤i≤4 and {e i} 1≤i≤4 ,

[0074] S402: The client sends the plaintext {m i} 1≤i≤4 Encryption generates ciphertext {c i} 1≤i≤4 , where c i =hr i +e i +m i , and {c i} 1≤i≤4 Send to the server.

[0075] Step 5: After receiving the ciphertext {c i} i∈[4] After that, the ciphertext c i Set the initial label i =1.

[0076] Step 6: Server (2) performs homomorphic operations on the ciphertext and calculates the label according to the computing task requirements (v1+v2)*(v3*v4). Specifically:

[0078] S601: The server (2) splits the computing task into one addition and two multiplications;

[0079] S602: Perform a homomorphic addition on the ciphertext c1 and c2 to calculate c add =c1+c2, record label l add =Max{l1,l2}=1;

[0080] S603: Perform a homomorphic multiplication on the ciphertext c3 and c4 to calculate Record Label mult =l3+l4=2;

[0081] S604: For ciphertext c add , c mult Perform a homomorphic multiplication to calculate Record Label result = l add +l mult =3.

[0082] Step 7: Server (2) takes the homomorphic operation result c obtained in step 6 result And the ciphertext label l result Sent to the client (1).

[0083] Step 8: The client (1) modifies the decryption private key according to the label and decrypts the ciphertext to obtain the plaintext vector of the calculation result. Specifically:

[0084] S801: The client (1) receives c result and l result After that, according to the label l result =3, the modified decryption key is f 3 ,

[0085] S802: Client (1) uses f 3 C result Decryption, get polynomial f 3 ·c result ,

[0086] S803: The client (1) calculates the conjugate transposed matrix of the Vandermonde matrix M consisting of the 2n primitive unit roots, which is the inverse matrix M of M. -1 ,

[0087] S804: Client (1) uses M -1 f 3 ·c result Decode and get The complex vector f on 3 ·c result ·M -1 ,

[0088] S805: Client (1) uses M -1 f 3 Decode and get The complex vector f on 3 ·M -1 ,

[0089] S806: Client (1) calculates plaintext vector

[0090]

[0091] Among them, f 3 ·c result ·M -1 and Δ·f 3 ·M -1 Both For the vector on, the division in the above formula is phase division, and the obtained v′ is the approximate value of (v1+v2)*(v3*v4).

[0092] For this embodiment, the method of the present invention and the prior art CKKS [2] In order to ensure the same multiplication depth, the homomorphic encryption standard document [5] The parameter sets A and B recommended in the paper were used and the experiment was repeated 10 times to compare the multiplication time. The results are shown in Table 1.

[0093] Parameter set A: (n = 8192, Δ = 2 60 ,L=2,σ<3.3,q=2 146 )

[0094] Parameter set B: (n = 8192, Δ = 2 60 ,L=2,σ<3.3,q=2 202 )

[0095] Where d represents the dimension of the polynomial ring, Δ represents the scaling factor, L represents the multiplication depth, σ represents the variance of the noise, and q represents the ciphertext modulus size.

[0096] Table 1 Comparative experimental results

[0097]

[0098] The size of the public key and ciphertext is statistically measured in Mb. Encryption, decryption, and multiplication record the time required for encryption, decryption, and ciphertext multiplication, respectively, and the statistical unit is seconds. When the polynomial degree is n=8192, a ciphertext packs 4096 plaintexts, and the amortized time records the time it takes for a plaintext slot to perform multiplication, and the statistical unit is milliseconds. It can be seen that the homomorphic multiplication efficiency of the method of the present invention is 4 to 5 times that of CKKS, and it occupies less memory space.

[0099] Example 2: Assume that the client (1) has data x and needs to use the weights W trained in plain text on the server (2) i and bias b i Deep learning network To perform prediction and sorting, in order to protect the privacy and security of customer data, the client (1) encrypts and sends the data to the server (2) through the network (3) for calculation. The present invention provides an "efficient homomorphic ciphertext multiplication method based on NTRU". The specific steps are:

[0100] Step 1: The server (2) sets the relevant parameters of the NTRU encryption scheme and sends them to the client (1).

[0101] Step 2: The client (1) generates a public-private key pair according to the set parameters.

[0102] Step 3: The client (1) performs SIMD-supported encoding on the plaintext vector, such as the encoding method based on the Chinese Remainder Theorem in the BGV scheme, to obtain a plaintext polynomial.

[0103] Step 4: The client (1) uses the public key to encrypt the plaintext polynomial to generate ciphertext.

[0104] Step 5: The client (1) sends the ciphertext to the server (2), and the server adds a tag to the ciphertext.

[0105] Step 6. The server (2) preprocesses its own deep learning network, splits it into factors that can be added and multiplied in pairs, performs homomorphic operations on the ciphertext factor by factor, and calculates the label.

[0106] Step 7: After the server (2) completes the homomorphic operation, it sends the ciphertext and label to the client (1).

[0107] Step 8: The client (1) modifies the decryption private key according to the label, and decrypts the ciphertext to obtain the plaintext vector of the calculation result.

[0108] It should be noted that the specific steps are the same as those in Example 1 and will not be repeated here.

[0109] Embodiment 3: For the scenario of embodiment 1, Figure 3 A schematic diagram of an electronic device (40) that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers.

[0110] Electronic devices may also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are only examples and are not intended to limit the implementation of the invention described and / or claimed herein.

[0111] like Figure 3As shown, the electronic device (40) includes at least one processor (41), and a memory connected to the at least one processor (41), such as a read-only memory (ROM) (42), a random access memory (RAM) (43), etc., wherein the memory stores a computer program that can be executed by the at least one processor, and the processor (41) can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) (42) or the computer program loaded from the storage unit (48) to the random access memory (RAM) (43). In RAM 43, various programs and data required for the operation of the electronic device (40) can also be stored. The processor (41), ROM 42 and RAM 43 are connected to each other through a bus (44). An input / output (I / O) interface (45) is also connected to the bus (44).

[0112] A number of components in the electronic device (40) are connected to the I / O interface (45), including: an input unit (46), such as a keyboard, a mouse, etc.; an output unit (47), such as various types of displays, speakers, etc.; a storage unit (48), such as a disk, an optical disk, etc.; and a communication unit (49), such as a network card, a modem, a wireless communication transceiver, etc. The communication unit (49) allows the electronic device (40) to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0113] The processor (41) may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor (41) include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor (41) executes the various methods and processes described above, such as the efficient homomorphic ciphertext multiplication method based on NTRU.

[0114] In some embodiments, the NTRU-based efficient homomorphic ciphertext multiplication method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit (48). In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device (40) via the ROM (42) and / or the communication unit (49). When the computer program is loaded into the RAM (43) and executed by the processor (41), one or more steps of the NTRU-based efficient homomorphic ciphertext multiplication method described above may be performed. Alternatively, in other embodiments, the processor (41) may be configured to execute the NTRU-based efficient homomorphic ciphertext multiplication method by any other suitable means (e.g., by means of firmware).

[0115] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0116] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0117] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0118] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0119] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0120] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0121] Finally, it should be noted that the above preferred embodiments are only used to illustrate the technical solutions of the present invention rather than to limit the present invention.

[0122] The present invention has been described in detail, but it should be understood by those skilled in the art that various changes may be made in form and details without departing from the scope of the present invention as defined in the claims.

Claims

1. An efficient homomorphic ciphertext multiplication method based on NTRU, implemented by the client and the server; characterized in that: The following steps are involved: S1: The server sets the relevant parameters of the NTRU encryption scheme and sends them to the client; S2: The client generates a public-private key pair based on the set parameters; S3: The client encodes the plaintext vector to obtain a plaintext polynomial; S4: The client uses the public key to encrypt the plaintext polynomial to generate ciphertext; S5: The client sends the ciphertext to the server, and the server adds a tag to the ciphertext; S6: The server performs homomorphic operations on the ciphertext and calculates the label according to the computing task requirements; S7: After the server completes the homomorphic operation, it sends the ciphertext and label to the client; S8: The client modifies the decryption private key according to the label and decrypts the ciphertext to obtain the plaintext vector of the calculation result; The encryption parameters should at least include the degree n of the polynomial, the set of integers The variance σ, scaling factor Δ, multiplication depth L, and ciphertext modulus q of the Gaussian distribution D on the ciphertext vector; the degree n and scaling factor Δ of the polynomial are powers of 2 respectively, and the degree n of the polynomial is greater than the length of the plaintext vector; the mean of the Gaussian distribution D is 0; The encoding described in step S3 is specifically: for any given The plaintext vector v on is encoded as a polynomial on the polynomial ring R, and the output encoded plaintext polynomial is Among them, the symbol represents rounding, M is the Vandermonde matrix consisting of the 2nth primitive unit root The step S4 is: sampling the coefficients of noise polynomials r and e on Gaussian distribution D, and encrypting the plaintext polynomial m using the generated noise polynomials r and e to generate a ciphertext c=hr+e+m; The adding of labels in step S5 is as follows: adding labels with an initial value of 1 to each ciphertext; The computing task described in step S6 is described by the client; Step S6 is specifically as follows: S601: Split the calculation task factor by factor into addition or multiplication forms; S602: For ciphertext c1, c2, ..., c n , with labels 1,l2,…,l n The addition calculation of the result is The label calculation result is max(l1,l2,…,l n ); S602: For ciphertext c1, c2, ..., c n , with labels l1,l2,…,l n The multiplication calculation of , the ciphertext of the calculation result is The label calculation result is For the ciphertext calculation result c and the tag value l sent by the server, the step S8 is specifically as follows: S801: Modify the decryption private key to f according to label l l ; S802: Using the decryption private key f l Decrypt the ciphertext calculation result c to obtain the polynomial f l c; S803: Calculate the conjugate transposed matrix of the Vandermonde matrix M consisting of the 2n primitive unit roots, which is the inverse matrix M of M. -1 ; S804: Using M -1 f l c decoding, we get The complex vector f on l ·c·M -1 ; S805: Using M -1 f l Decode and get The complex vector f on l ·M -1 ; S806: Calculate the plaintext vector v=(f l ·c·M -1 ) / (f l ·M -1 ), where / represents bitwise division of vectors.

2. The efficient homomorphic ciphertext multiplication method based on NTRU according to claim 1, characterized in that: The process of generating the public-private key pair described in step S2 is specifically as follows: S201: sampling polynomial coefficients on Gaussian distribution D to obtain n-order polynomials f and g about indefinite variable x; S202: Determine if f is in the polynomial ring R: Is there an inverse element on R? If yes, proceed to step S203, otherwise resample f until f has an inverse on R; S203: Remainder class ring R in module q q :R / qR calculates the public key h=g·f -1 , and set f as the private key.

3. The efficient homomorphic ciphertext multiplication method based on NTRU according to claim 1, characterized in that: The computing task described in step S6 is a computing model owned by the server.

4. The efficient homomorphic ciphertext multiplication method based on NTRU according to claim 1, characterized in that: The encoding described in step S3 may also be a scheme supporting SIMD technology.

5. The NTRU-based efficient homomorphic ciphertext multiplication system applied to any one of claims 1 to 4, characterized in that: The NTRU-based efficient homomorphic ciphertext multiplication system is composed of a client and a server connected via a network, wherein the client and the server are electronic devices, including at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the above-mentioned NTRU-based efficient homomorphic ciphertext multiplication method.

6. A computer-readable storage medium as claimed in any one of claims 1 to 4, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the processor to implement the above-mentioned NTRU-based efficient homomorphic ciphertext multiplication method when executed.

Images