Homomorphic encryption-based secret data parallel sorting method and system

Abstract

The application provides a ciphertext data parallel sorting method and system based on full homomorphic encryption, which comprises the following steps: generating public parameters, a public key and a private key through a security parameter, and publishing the public parameters and the public key; encoding and packing the plaintext array into several ciphertexts based on the private key, and publishing the ciphertexts, so that the server performs homomorphic comparison on the ciphertexts of the plaintext array based on the public parameters and the public key, obtains the ciphertext of the comparison matrix of the plaintext array, and sorts the plaintext array based on the public parameters and the public key according to the comparison matrix to obtain the ciphertext of the ordered array; and decrypting and decoding the ciphertext of the ordered array based on the private key to obtain the plaintext calculation result. The application can complete the sorting task of the corresponding plaintext array in the form of ciphertext, realizes parallel acceleration of the homomorphic sorting algorithm, improves the throughput and reduces the operation delay.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and particularly relates to a method and system for parallel sorting of ciphertext data based on full homomorphic encryption. BACKGROUND

[0002] With important fields such as medical treatment, education and finance rapidly moving towards informatization, digitization and intelligentization, cloud computing, Internet of Things and artificial intelligence and other cutting-edge information technologies have deeply integrated into daily work and life. More and more enterprise and personal data are processed and transmitted in real time on the Internet, and it is increasingly critical to protect sensitive data from threats.

[0003] Fully Homomorphic Encryption (FHE) is one of the key technologies of privacy computing, which can perform arbitrary computations on ciphertext data without accessing the private key. At present, the widely used fully homomorphic encryption schemes can be divided into two categories: hierarchical fully homomorphic encryption and bootstrap fully homomorphic encryption. Hierarchical fully homomorphic encryption includes BGV, BFV and CKKS schemes, while bootstrap fully homomorphic encryption includes FHEW and TFHE schemes. These schemes all rely on the (R)LWE difficulty assumption and introduce noise into the ciphertext to prevent algebraic attacks. However, as the computation process proceeds, the noise will gradually accumulate, and eventually may lead to decryption errors. Bootstrap fully homomorphic encryption schemes use bootstrap technology to clean up noise, and have a low throughput, which is not suitable for scenarios involving large-scale data. Hierarchical fully homomorphic encryption uses RLWE public key encryption algorithm and controls noise growth through modulus switching. An important feature is that hierarchical fully homomorphic encryption supports homomorphic operations in SIMD paradigm, which can pack multiple data in a single ciphertext, and only needs to perform a single homomorphic operation on this ciphertext to realize the parallel operation of multiple encrypted data.

[0004] Current fully homomorphic sorting algorithms are still inefficient, and designing special homomorphic algorithms for different computing tasks is an important research topic. Sorting algorithm is a kind of algorithm that is very important in the field of computer science, which allows software engineers to arrange data sets in order, so as to optimize the efficiency of data retrieval and management. In practical applications, efficient sorting algorithms such as quicksort, merge sort and heap sort are widely used in database systems, search engines, file processing and big data processing framework, etc. They minimize time complexity and space complexity to meet the performance requirements in different scenarios. However, in the sorting algorithm, a variety of complex operations are often needed: first, comparison operation, which cannot be written as a low-order interpolation polynomial, usually calculated by using Boolean circuit; second, data permutation, which places data in the right place according to the comparison result. These complex operations have high computational complexity under fully homomorphic encryption. With the increase of array size, the required computation increases superlinearly, further leading to the decrease of computing efficiency. At the same time, since the sorting result is not extracted from the polynomial coefficient, the input and output formats are not matched, which is difficult to be compatible with other homomorphic computing tasks.

[0005] Therefore, there is an urgent need for a parallel sorting method and system for encrypted data based on fully homomorphic encryption to solve the above problems. SUMMARY

[0006] In view of the problems existing in the prior art, the present application provides a parallel sorting method and system for encrypted data based on fully homomorphic encryption.

[0007] The present application provides a parallel sorting method for encrypted data based on fully homomorphic encryption, comprising:

[0008] Generate public parameters, public key and private key through security parameters, and publish the public parameters and the public key;

[0009] Based on the private key, encrypt the plaintext array and pack it into several ciphertexts, and publish the ciphertexts, so that the server can perform homomorphic comparison on the ciphertext of the plaintext array based on the public parameters and the public key, to obtain the ciphertext of the comparison matrix of the plaintext array;

[0010] Based on the public parameters and the public key, homomorphic sorting is performed on the plaintext array according to the comparison matrix, to obtain the ciphertext of the ordered array;

[0011] Based on the private key, the ciphertext of the ordered array is decrypted and decoded to obtain the plaintext calculation result.

[0012] According to the parallel sorting method for encrypted data based on fully homomorphic encryption provided by the present application, the plaintext array is , the length is , and each integer Bit, satisfying and ,in, It is the number of plaintext slots. It is the plaintext slot dimension;

[0013] The process of encoding and encrypting the plaintext array into several ciphertexts includes:

[0014] Perform binary decomposition on each integer in the plaintext array: ;

[0015] Packaging and encryption are performed vertically, and the following calculations are made. To output ciphertext .

[0016] According to the present invention, a parallel sorting method for dense-state data based on fully homomorphic encryption is provided, the method further comprising:

[0017] The comparison matrix construction methods specifically include:

[0018] Input encrypted array ciphertext Using masking techniques and plaintext slot rotation techniques, the ciphertext is calculated:

[0019]

[0020] in, Circular rotation of the encryption arrays respectively ;

[0021] Using masking techniques and plaintext slot rotation techniques, A ciphertext Pack it into a single ciphertext and put Broadcast copy Second-rate;

[0022] Using a parallel prefix homomorphic comparison algorithm, the packaged... and Comparison results ,get The ciphertext is then used to construct half of the comparison matrix by arranging the comparison results diagonally.

[0023] Using the plaintext slot rotation technique, the ciphertext of the remaining half of the elements is copied, and the comparison matrix is ​​output. The encrypted package.

[0024] According to the present invention, a parallel sorting method for encrypted data based on fully homomorphic encryption is provided, wherein the parallel prefix homomorphic comparison algorithm includes:

[0025] The ciphertext of the first operand ciphertext of the second operand ciphertext of the initial signal , and ;

[0026] define the signal as a binary tuple the corresponding merge operation is:

[0027]

[0028] perform the merge operation of the signal based on the binary tree algorithm, and homomorphically calculate to obtain ;

[0029] calculate , and output the ciphertext , and the corresponding plaintext is and comparison result.

[0030] According to the parallel sorting method of ciphertext data based on full homomorphic encryption provided by the application, the method further comprises:

[0031] The sorting based on the index code specifically comprises:

[0032] Input the ciphertext of the encrypted array , and calculate the comparison matrix using the comparison matrix construction method The ciphertext of each diagonal line , and the corresponding plaintext ;

[0033] Encode the elements of the comparison matrix to the index,

[0034] ;

[0035] Calculate the continuous product using the SIMD norm to obtain the ciphertext:

[0036] ;

[0037] wherein, is the sorting order of the integer ;

[0038] Multiply the ciphertext and the ciphertext , specifically:

[0039] ;

[0040] Based on the plaintext slot rotation technology, use the halving accumulation algorithm to combine the contents of each plaintext slot to obtain the ciphertext:

[0041]

[0042] Output ciphertext array The corresponding plaintext slot is encrypted with a polynomial. Binary factorization, polynomial The coefficients under the standard basis are the ordered arrangement of the original plaintext array.

[0043] According to the present invention, a parallel sorting method for dense-state data based on fully homomorphic encryption is provided, the method further comprising:

[0044] Polynomial coefficient extraction is performed, and the algorithm for polynomial coefficient extraction includes:

[0045] Input ciphertext The corresponding plaintext is a polynomial. ;

[0046] Calculate each projection function Corresponding linear combination coefficients ;

[0047] Calculate ciphertext Results under different Frobenius mappings ;

[0048] According to each projection function coefficient Linear combination yields the projection result ciphertext ;

[0049] Using plaintext slot rotation technology, the ciphertext is... Packaged as ;

[0050] Output the ciphertext , corresponding plaintext It is an ordered array.

[0051] According to the present invention, a parallel sorting method for dense-state data based on fully homomorphic encryption is provided, the method further comprising:

[0052] Using BGV hierarchical fully homomorphic encryption, define The second subdivision of the integer ring The plaintext space in the BGV hierarchical fully homomorphic encryption method is a quotient ring. ,in, for Cyclic polynomial of degree. It is a prime number;

[0053] Based on the Ring-LWE hypothesis, the symmetric version of the BGV ciphertext is: ,in, It is the ciphertext modulus. They are secret and noise, respectively. It is plaintext, and the decryption algorithm is: The upper bound of the noise norm is .

[0054] This invention also provides a parallel sorting system for encrypted data based on fully homomorphic encryption, comprising:

[0055] The parameter generation module is used to generate public parameters, a public key, and a private key through security parameters, and to publish the public parameters and the public key;

[0056] The homomorphic comparison module is used to encode and package the plaintext array into several ciphertexts based on the private key, and publish the ciphertexts so that the server can perform a homomorphic comparison on the ciphertexts of the plaintext array based on the public parameters and the public key to obtain the ciphertext of the comparison matrix of the plaintext array.

[0057] The homomorphic sorting module is used to perform homomorphic sorting on the plaintext array based on the public parameters and the public key, according to the comparison matrix, to obtain the ciphertext of the ordered array;

[0058] The result output module is used to decrypt and decode the ciphertext of the ordered array based on the private key to obtain the plaintext calculation result.

[0059] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the parallel sorting method for encrypted data based on fully homomorphic encryption as described above.

[0060] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the above-described parallel sorting methods for encrypted data based on fully homomorphic encryption.

[0061] The application provides a ciphertext data parallel sorting method and system based on full homomorphic encryption, which fully utilizes the algebraic structure and SIMD parallel computing capability of the BGV scheme, uses appropriate basic homomorphic operations to simulate the required Boolean operation and arithmetic addition, and is therefore more efficient. BRIEF DESCRIPTION OF DRAWINGS

[0062] In order to more clearly illustrate the technical solutions in the application or the prior art, the drawings needed to be used in the embodiments or the prior art description will be briefly introduced below. Obviously, the drawings in the following description are some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0063] Figure 1 A flowchart of the ciphertext data parallel sorting method based on full homomorphic encryption provided by the application is shown in the figure.

[0064] Figure 2 A flowchart of generating public and private keys provided by the application is shown in the figure.

[0065] Figure 3 A flowchart of packing and encoding provided by the application is shown in the figure.

[0066] Figure 4 A flowchart of the parallel homomorphic sorting algorithm provided by the application is shown in the figure.

[0067] Figure 5 A schematic diagram of the parallel prefix comparator provided by the application is shown in the figure.

[0068] Figure 6 A schematic diagram of the polynomial sorting algorithm provided by the application is shown in the figure.

[0069] Figure 7 A structural schematic diagram of the ciphertext data parallel sorting system based on full homomorphic encryption provided by the application is shown in the figure.

[0070] Figure 8 A structural schematic diagram of the electronic device provided by the application is shown in the figure. DETAILED DESCRIPTION

[0071] In order to make the objects, technical solutions and advantages of the present application clearer, the technical solutions in the present application will be described clearly and completely below in combination with the drawings in the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of protection of the present application.

[0072] In order to clearly describe the contents of the embodiments of the present application, the conceptual technical terms appearing in the present application are described. Specifically, the SIMD packing technology is a technology that can encode several plaintexts into a single polynomial and encrypt them into a single FHE ciphertext. Each plaintext is abstractly stored in a structure called plaintext slot. The plaintext slot rotation technology abstractly organizes all plaintext slots into a one-dimensional array using Galois automorphism and Benes permutation network, and realizes the shift or cyclic rotation of the array. The Frobenius mapping technology is a technology that can realize the linear mapping of plaintext slots to their base ring.

[0073] Figure 1 The flowchart of the parallel sorting method of ciphertext data based on fully homomorphic encryption provided by the present application is shown in FIG. 1, which includes the following steps. Figure 1

[0074] In step 101, public parameters, a public key and a private key are generated through a security parameter, and the public parameters and the public key are published.

[0075] In step 102, plaintext arrays are encoded and packed and encrypted into several ciphertexts based on the private key, and the ciphertexts are published. The server performs homomorphic comparison on the ciphertexts of the plaintext arrays based on the public parameters and the public key to obtain the ciphertext of the comparison matrix of the plaintext arrays.

[0076] In step 103, the plaintext arrays are homomorphically sorted based on the public parameters and the public key according to the comparison matrix to obtain the ciphertext of the ordered array.

[0077] In step 104, the ciphertext of the ordered array is decrypted and decoded to obtain the plaintext calculation result based on the private key.

[0078] It can be understood that the present application is mainly applied to the following outsourcing computing application scenarios: the user needs to outsource the server to sort some private data. Then the process can be divided into several stages. The first stage is the user generating the private key and the public key in step 101. In step 102, the user packs and encrypts the plaintext array. In step 103, the server homomorphically sorts. And in the last step 104, the user decrypts.

[0079] ​Specifically, in the user-generated public key and private key phase, Figure 2 The public key and private key generation process provided by the present application is shown in the following figure: Figure 2 As shown, first, according to the input security parameters And the scene needs, generate public parameters Among them Is the order of the cyclotomic ring, Is the ciphertext modulus, Is the plaintext space feature, Is the Hensel factor, Is the plaintext slot dimension, Is the number of plaintext slots;

[0080] Then randomly sample a short ring element As a private key, uniformly sample , sample noise , calculate , set the public key to ;

[0081] Finally, keep the private key secret , publish public parameters And public key .

[0082] In the user packing encrypted plaintext array phase, Figure 3 The packing encoding process provided by the present application is shown in the following figure: Figure 3 As shown, first input: Integer Bit, meet And , binary decomposition is performed on each integer, Packed encryption in vertical mode, Calculate , finally output: ciphertext .

[0083] In the server homomorphic sorting phase of the ciphertext, Figure 4 The parallel homomorphic sorting algorithm process provided by the present application is shown in the following figure: Figure 4 As shown, first input the ciphertext .

[0084] Using masking technology and plaintext slot rotation technology, the following ciphertext is calculated:

[0085]

[0086] Simply ;

[0087] Then use the masking technology and plaintext slot rotation technology to calculate Ciphertext packed into a single ciphertext, and broadcasted ;

[0088] and the comparison results of the above packed and are calculated using the proposed parallel prefix homomorphic comparison method, and then a comparison matrix is composed of the packed ciphertexts of the half diagonal elements of the comparison matrix ;

[0089] Then, the ciphertexts of the remaining half elements are duplicated using the plaintext slot rotation technique;

[0090] Next, the elements of the comparison matrix are encoded into exponents using the following formula,

[0091] ;

[0092] The continuous product is calculated using the SIMD paradigm to obtain the ciphertext:

[0093] ;

[0094] where is the ordering sequence of the integer ;

[0095] The ciphertext is multiplied by the ciphertext , specifically:

[0096]

[0097] Finally, based on the plaintext slot rotation technique, the contents of each plaintext slot are combined using the binary accumulation algorithm to obtain the following ciphertext:

[0098]

[0099] where the ciphertext encrypts the polynomial ;

[0100] The linear combination coefficients corresponding to each projection function are calculated;

[0101] The results of the ciphertext under different Frobenius mappings are calculated ;

[0102] The ciphertext of the projection result is linearly combined according to the coefficients of each projection function ;

[0103] The ciphertexts are packed into ;

[0104] The final output ciphertext , whose plaintext is the ordered arrangement of the input array .

[0105] Specifically, the user decryption stage includes inputting ciphertexts .

[0106] The ciphertexts are decrypted from ; ;

[0107] The ciphertexts are recovered by binary combination ;

[0108] The final output ordered array is obtained.

[0109] It can be understood that, in order to realize the above scheme, the present application mainly uses the BGV scheme with parameters , uses the algebraic structure of the plaintext slot , uses the addition and multiplication on the base ring to simulate XOR logic and AND logic respectively, uses the polynomial multiplication on the extension field to simulate the arithmetic addition of multi-bit integers, and realizes an efficient homomorphic sorting algorithm.

[0110] For the stage of constructing the comparison matrix in the sorting algorithm, the present application uses a parallel prefix comparator, and the progressive complexity is reduced by a logarithmic factor compared with the commonly used linear comparator. The present application fully utilizes the SIMD parallel computing capability of the BGV scheme, and through the plaintext slot rotation technology, the times of comparison operations that need to be calculated are packed into several ciphertexts in a diagonal line manner, and each homomorphic comparison can process comparison tasks at the same time. In addition, by using the anti-symmetry property of the comparison matrix, the present application saves half of the calculation overhead.

[0111] In the stage of homomorphic sorting of the plaintext array according to the comparison matrix, the present application adopts an exponential encoding technology, takes the Hamming weight of the rows / columns of the comparison matrix as the arrangement order , calculates the polynomial , and the coefficients in the standard base are naturally the ordered arrangement of the array . The present application uses Frobenius mapping to construct a trace function, realizes the coefficient extraction of the polynomial in the plaintext slot, and uses a “hoisting” technique to optimize its performance.

[0112] ​In summary, the parallel sorting method for encrypted data based on fully homomorphic encryption provided by this invention can sort integer arrays in encrypted form. This method fully utilizes the algebraic structure and SIMD parallel computing capabilities of the BGV scheme, using appropriate basic homomorphic operations to simulate the required Boolean operations and arithmetic additions, thus achieving higher efficiency. This invention employs a parallel prefix comparator, whose asymptotic computational complexity is reduced by a logarithmic factor compared to commonly used linear comparators, thus supporting homomorphic sorting tasks for larger arrays. This invention uses the Frobenius map to ensure that the input and output ciphertexts have completely identical encoding formats, making it easy to combine with other homomorphic algorithms, resulting in better flexibility and scalability.

[0113] Based on the above embodiments, the plaintext array is The length is Each integer Bit, satisfying and ,in, This refers to the number of plaintext slots. This is the plaintext slot dimension;

[0114] The process of encoding and encrypting the plaintext array into several ciphertexts includes:

[0115] Perform binary decomposition on each integer in the plaintext array: ;

[0116] Packaging and encryption are performed vertically, and the following calculations are made. To output ciphertext .

[0117] The specific breakdown is based on the following:

[0118] Assumption The multiplication order is ,So In the plain domain The above can be broken down into An irreducible factor, in the form of... And their exponents all satisfy Given an integral domain ideal Define the ideal for generating irreducible factors So there are According to the CRT (Chinese Remainder Theorem), the following cyclic homomorphism exists:

[0119]

[0120] because It is unrepeatable, therefore , they are the same finite field in the sense of isomorphism. Denote this structure as , then we get the ring isomorphism , which allows us to express independent messages as a vector in , and then map it to a polynomial in the ring . Because this encoding process is ring isomorphism, the polynomial addition and multiplication in are equivalent to the independent addition and multiplication of the components of the vector in . Denote as the plaintext slot, and this encoding process as the SIMD packing technique (as shown in Figure 3 ). The present application sets and , and the plaintext space is the polynomial ring , where is the times extension field of the binary field .

[0121] Specifically, the input plaintext array is , the length is , each integer is bits, satisfying .

[0122] Binary decompose each integer, ;

[0123] Pack encrypt in the vertical way, and calculate

[0124] ;

[0125] Output the ciphertext .

[0126] The decryption operation is the inverse process of the encryption process. First, decrypt the bits in each position, and then combine these bits into the corresponding integer.

[0127] On the basis of the above embodiment, the method further comprises:

[0128] performing the comparison matrix construction method, specifically comprising:

[0129] inputting the ciphertext of the encrypted array , and calculating the ciphertext by using the masking technique and the plaintext slot rotation technique:

[0130]

[0131] wherein, cyclic rotation of the array is encrypted respectively ;

[0132] By using the masking technique and the plaintext slot rotation technique, the ciphertexts are packed into a single ciphertext, and the broadcast copy times;

[0133] By using the parallel prefix homomorphic comparison algorithm, the comparison results of the packed and are calculated , the ciphertext of is obtained, and the comparison results are composed into half elements of the comparison matrix in a diagonal line manner;

[0134] By using the plaintext slot rotation technique, the ciphertexts of the remaining half elements are copied, and the packed ciphertext of the comparison matrix is output.

[0135] In the present application, after the above-mentioned packed encryption is performed, an array composed of bit integer numbers is encrypted into the form of , wherein the ciphertext encrypts the th bit of all the integer numbers, and the th plaintext slot thereof encrypts the corresponding bit of the th integer number . By using the SIMD parallel computing paradigm, the homomorphic addition and the homomorphic multiplication between the ciphertexts are performed by parallelly adding and multiplying the data in the same position plaintext slots. In particular, because each bit is stored in the base ring of the plaintext slot , the homomorphic addition and the homomorphic multiplication are actually XOR and AND operations performed on the encrypted bits.

[0136] The present application uses a parallel prefix comparator to construct the comparison matrix of the plaintext array. The signal is defined as a binary tuple , and the merging operation is defined as:

[0137]

[0138] wherein, the symbol “ ” and the symbol “ ” are OR logic and AND logic respectively. is the merging operation of the final signal. Using to represent the calculation of The comparison circuit is as follows: The initial signal is set as: , , and . Then the following equation exists:

[0139] .

[0140] It can be proved that the operator satisfies the associative law, and Figure 5 The schematic diagram of the parallel prefix comparator provided by the present application is shown in Figure 5 , so the signals can be merged in parallel in the form of a binary tree.

[0141] On the basis of the above embodiment, the parallel prefix homomorphic comparison algorithm comprises:

[0142] Input the ciphertext of the first operand , the ciphertext of the second operand , and the ciphertext of the initial signal , , and ;

[0143] Define the signal as a binary tuple , and the corresponding merging operation is:

[0144]

[0145] It can be proved that the operation satisfies the associative law;

[0146] The merging operation of the signal is performed based on the binary tree algorithm, and the homomorphic calculation obtains ;

[0147] Calculate , and output the ciphertext , and the corresponding plaintext is and .

[0148] In the homomorphic sorting algorithm, when the comparison matrix is constructed, the homomorphic comparison needs to be calculated times, and they are independent of each other. In order to obtain a lower calculation delay, the present application fully utilizes the SIMD parallel calculation paradigm of the BGV scheme, and packs the operations required by the comparison matrix in a single homomorphic comparison. In addition, by utilizing the anti-symmetry property of the comparison matrix, the present application only calculates comparison tasks, and the remaining comparison results can be easily recovered.

[0149] The comparison matrix construction method provided by the present application is as follows:

[0150] Input the ciphertext of the encrypted array .

[0151] Using masking techniques and plaintext slot rotation techniques, the following ciphertext was calculated:

[0152]

[0153] Brief Notes Circular rotation of the encryption arrays respectively ;

[0154] Continue to utilize masking technology and plaintext slot rotation technology to... A ciphertext Pack it into a single ciphertext and put Broadcast copy Second-rate;

[0155] Using the proposed parallel prefix homomorphic comparison algorithm, the above-mentioned packet is calculated. and Comparison results ,get The ciphertext, in which the comparison results form half of the elements of the comparison matrix in a diagonal arrangement;

[0156] Using plaintext slot rotation technology, the ciphertext of the remaining half of the elements is copied;

[0157] Output: Comparison matrix The encrypted package.

[0158] Based on the above embodiments, the method further includes:

[0159] Sorting based on exponential encoding, specifically including:

[0160] Input encrypted array ciphertext Using the aforementioned comparison matrix construction method, the comparison matrix is ​​calculated. Ciphertext on each diagonal , corresponding plaintext ;

[0161] The elements of the comparison matrix are encoded onto the exponent, as shown in the formula:

[0162] ;

[0163] Using the SIMD paradigm to calculate the product of products, we obtain the ciphertext:

[0164] ;

[0165] in, It is an integer The sorting order;

[0166] cipher texts and cipher texts are multiplied, specifically:

[0167] ;

[0168] Based on the plaintext slot rotation technique, the content of each plaintext slot is combined using the halving accumulation algorithm to obtain the cipher text:

[0169] ;

[0170] The output cipher text array corresponding to the plaintext slot encrypts the binary decomposition of the polynomial The coefficients of the polynomial under the standard basis are the ordered arrangement of the original plaintext array.

[0171] It should be noted that since the BGV scheme is a hierarchical full homomorphism encryption, the size of the cryptographic parameters increases in direct proportion to the increase in the multiplication depth. In order to improve the calculation efficiency, the design principle of the present application is to reduce the multiplication depth of the homomorphic sorting algorithm as much as possible. The present application adopts a direct sorting algorithm, which first calculates a reusable comparison matrix, and then places the data in the correct order according to the row / column hamming weight of the comparison matrix.

[0172] For bit unsigned integer , its comparison matrix is defined as:

[0173] ;

[0174] The elements in it are the results of two-by-two comparison of integer, .

[0175] By observing the comparison matrix, it can be found that the hamming weight of the first row of the matrix is exactly equal to the number of elements in the input array that are larger; and the hamming weight of the first column of the matrix is also exactly equal to the number of elements in the input array that are smaller. Therefore, as long as the hamming weight of the first row of the matrix is calculated homomorphically, the correct order of when sorted from large to small is obtained. According to , the integer is placed in the correct position in the output cipher text, and the sorting task is completed.​

[0176] This invention employs an exponential encoding method, utilizing polynomial multiplication to quickly calculate arithmetic addition of multi-bit integers. Under the set parameters, the plaintext slots of the BGV scheme are... ,in It is Irreducible polynomials. For Boolean operations, data is stored in plaintext slots. base ring Internally, homomorphic addition is equivalent to XOR logic, and homomorphic multiplication is equivalent to AND logic. For arithmetic addition, data is stored in an exponentially encoded format; more precisely, for integers... They are encoded as follows: Then, arithmetic addition of integers. It was transformed into a finite field Polynomial multiplication on Therefore, only one homomorphic multiplication is needed to complete arithmetic addition on integers.

[0177] Figure 6 This is a schematic diagram of the polynomial sorting algorithm provided by the present invention, as shown below. Figure 6 As shown, the calculation steps are as follows:

[0178] Input: Encrypted array ciphertext .

[0179] Step 1: Calculate the comparison matrix using the aforementioned comparison matrix construction method. Ciphertext on each diagonal Its explicit text is ;

[0180] Step 2: Encode the elements of the comparison matrix onto the exponent using the following formula:

[0181] ;

[0182] Step 3: Calculate the product using the SIMD paradigm to obtain the ciphertext:

[0183] ;

[0184] in, It is an integer The sorting order;

[0185] Step 4, encrypt the text and ciphertext Multiplication, specifically:

[0186] ;

[0187] Step 5, based on the plaintext slot rotation technique, the content of each plaintext slot is combined using the halving accumulation algorithm to obtain the ciphertext as follows:

[0188] ;

[0189] Final output: ciphertext , which corresponds to the plaintext slot encrypted polynomial The binary decomposition of the polynomial is the ordered arrangement of the original plaintext array in the standard basis.

[0190] On the basis of the above embodiment,

[0191] The method further comprises:

[0192] Performing polynomial coefficient extraction, wherein the algorithm of polynomial coefficient extraction comprises:

[0193] Input ciphertext , and the corresponding plaintext is polynomial ;

[0194] Calculate each projection function Corresponding linear combination coefficient ;

[0195] Calculate the ciphertext Result under different Frobenius mappings ;

[0196] According to the coefficient of each projection function , the ciphertext of the projection result is linearly combined;

[0197] Using the plaintext slot rotation technique, the ciphertext is packed into ;

[0198] Output the ciphertext , and the corresponding plaintext is an ordered array.

[0199] The polynomial coefficient homomorphic extraction algorithm proposed by the application is to extract an ordered ciphertext from the polynomial The trace function is constructed using the Frobenius mapping, and the linear function on the finite field is executed using the trace function. The algebraic structure of the plaintext slot is , and the base ring is a prime field with characteristic . is regarded as on If the linear space is finite, then the coefficient extraction needs the projection functions as follows:

[0200]

[0201] ;

[0202] They are linear maps of According to the knowledge of number theory, Any linear function on can be expressed by the trace function, where is a constant ring element related to The trace function is defined as where All automorphisms in are of the form

[0203] , which is called the Frobenius map. The present invention adopts the "lifting" technique. Specifically, it is observed that all projection functions act on the same

[0204] Now make the following transformation:

[0205] Since is a constant related to the linear function , is some certain automorphism mapping, which can regard as a constant, then is a linear combination of , and is the result of automorphism operation independent of The specific steps are as follows:

[0206] Input: ciphertext , whose plaintext is a polynomial .

[0207] Calculate the linear combination coefficients corresponding to each projection function ;

[0208] Calculate the results of the ciphertext under different Frobenius maps ;

[0209] According to the coefficients of each projection function , linearly combine the ciphertext of the projection result ;

[0210] Using plaintext slot rotation technology, the ciphertext is... Packaged as ;

[0211] Output: Ciphertext Its explicit text It is an ordered array.

[0212] In summary, the method further includes:

[0213] Using BGV hierarchical fully homomorphic encryption, define The second subdivision of the integer ring The plaintext space in the BGV hierarchical fully homomorphic encryption method is a quotient ring. ,in, for Cyclic polynomial of degree. It is a prime number;

[0214] Based on the Ring-LWE hypothesis, the symmetric version of the BGV ciphertext is: ,in, It is the ciphertext modulus. They are secret and noise, respectively. It is plaintext, and the decryption algorithm is: The upper bound of the noise norm is ,definition It is the L2 norm. It is an infinite norm.

[0215] In more general cases, the plaintext modulus is no longer a prime number. Instead, it is a prime power. ,in It is the Hensel boosting factor. In this invention, it is set... as well as Therefore, the ciphertext in the general case and its effect on homomorphic operations are not considered.

[0216] The parallel sorting system for dense data based on fully homomorphic encryption provided by this invention is described below. The parallel sorting system for dense data based on fully homomorphic encryption described below can be referred to in correspondence with the parallel sorting method for dense data based on fully homomorphic encryption described above.

[0217] Figure 7 A schematic diagram of the structure of the parallel sorting system for dense data based on fully homomorphic encryption provided by the present invention is shown below. Figure 7As shown, the application provides a ciphertext data parallel sorting system based on full homomorphic encryption, comprising a parameter generation module 701, a homomorphic comparison module 702, a homomorphic sorting module 703 and a result output module 704, wherein the parameter generation module 701 is used to generate public parameters, a public key and a private key through a security parameter, and publish the public parameters and the public key; the homomorphic comparison module 702 is used to encode and package the plaintext array into several ciphertexts based on the private key, and publish the ciphertexts, so that the server performs homomorphic comparison on the ciphertexts of the plaintext array based on the public parameters and the public key, and obtains the ciphertext of the comparison matrix of the plaintext array; the homomorphic sorting module 703 is used to perform homomorphic sorting on the plaintext array according to the comparison matrix based on the public parameters and the public key, and obtain the ciphertext of the ordered array; and the result output module 704 is used to decrypt and decode the ciphertext of the ordered array based on the private key to obtain the plaintext calculation result.

[0218] The ciphertext data parallel sorting system based on full homomorphic encryption provided by the application fully utilizes the algebraic structure and SIMD parallel computing capability of the BGV scheme, uses appropriate basic homomorphic operations to simulate the required Boolean operations and arithmetic addition, and therefore has higher implementation efficiency. The application designs a homomorphic comparison algorithm based on a parallel prefix comparator, and reduces the progressive computing complexity by a logarithmic factor. Based on the algebraic structure of the BGV scheme, the application realizes a parallel homomorphic sorting algorithm with better compatibility and scalability by using Frobenius automorphism. By using the SIMD encoding technology and the multi-thread acceleration technology, the application accelerates the homomorphic sorting algorithm, improves the throughput and reduces the operation delay.

[0219] The ciphertext data parallel sorting system based on full homomorphic encryption provided by the embodiment of the application is used to execute the above-mentioned method embodiments, and the specific process and detailed content are referred to the above-mentioned embodiments, which will not be described here.

[0220] Figure 8 The structural schematic diagram of the electronic device provided by the application is as follows, Figure 8As shown, the electronic device can include a processor 801, a communications interface 802, a memory 803, and a communications bus 804, wherein the processor 801, the communications interface 802, and the memory 803 complete mutual communication through the communications bus 804. The processor 801 can invoke a logic instruction in the memory 803 to execute a parallel sorting method for ciphertext data based on homomorphic encryption, which includes generating public parameters, a public key, and a private key through a security parameter, and publishing the public parameters and the public key; encoding and packing the plaintext array into a plurality of ciphertexts based on the private key, and publishing the ciphertexts for a server to perform homomorphic comparison on the ciphertexts of the plaintext array based on the public parameters and the public key to obtain ciphertext of a comparison matrix of the plaintext array; performing homomorphic sorting on the plaintext array according to the comparison matrix based on the public parameters and the public key to obtain ciphertext of an ordered array; and decrypting and decoding the ciphertext of the ordered array based on the private key to obtain a plaintext calculation result.

[0221] In addition, the logic instruction in the memory 803 described above can be implemented in the form of a software functional unit and sold or used as an independent product, and can be stored in a computer-readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or part of the technical solutions can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a plurality of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in various embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various program code storage media.

[0222] In another aspect, the present application also provides a computer program product, which comprises a computer program stored on a non-transitory computer readable storage medium, the computer program comprising program instructions which, when executed by a computer, enable the computer to perform the homomorphic encryption based secret data parallel sorting method provided by the above method, the method comprising: generating public parameters, a public key and a private key through a security parameter, and publishing the public parameters and the public key; based on the private key, encoding and packing a plaintext array into a plurality of ciphertexts, and publishing the ciphertexts, so that a server performs homomorphic comparison on the ciphertexts of the plaintext array based on the public parameters and the public key, to obtain ciphertexts of a comparison matrix of the plaintext array; based on the public parameters and the public key, performing homomorphic sorting on the plaintext array according to the comparison matrix, to obtain ciphertexts of an ordered array; and based on the private key, decrypting and decoding the ciphertexts of the ordered array to obtain a plaintext calculation result.

[0223] In yet another aspect, the present application also provides a non-transitory computer readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the homomorphic encryption based secret data parallel sorting method provided by the above embodiments, the method comprising: generating public parameters, a public key and a private key through a security parameter, and publishing the public parameters and the public key; based on the private key, encoding and packing a plaintext array into a plurality of ciphertexts, and publishing the ciphertexts, so that a server performs homomorphic comparison on the ciphertexts of the plaintext array based on the public parameters and the public key, to obtain ciphertexts of a comparison matrix of the plaintext array; based on the public parameters and the public key, performing homomorphic sorting on the plaintext array according to the comparison matrix, to obtain ciphertexts of an ordered array; and based on the private key, decrypting and decoding the ciphertexts of the ordered array to obtain a plaintext calculation result.

[0224] The above-described device embodiments are merely illustrative, wherein the units described as separate components can or can not be physically separate, and the components displayed as units can or can not be physical units, i.e., can be located in one place, or can be distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the present embodiment scheme according to actual needs. Those skilled in the art can understand and implement it without creative labor.

[0225] Those skilled in the art can clearly understand the technical solutions of the various embodiments from the above description of the embodiments, and the various embodiments can be implemented by means of software with the necessary general hardware platforms, and of course, can also be implemented by hardware. Based on such understanding, the above technical solutions, essentially or in other words, the part of the prior art that makes a contribution, can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, and the like, and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0226] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, rather than limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for some technical features therein; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A parallel sorting method for dense-state data based on fully homomorphic encryption, characterized in that, include: Generate public parameters, a public key, and a private key using security parameters, and then publish the public parameters and the public key. Based on the private key, the plaintext array is encoded and packaged into several ciphertexts, and the ciphertexts are published so that the server can perform a homomorphic comparison on the ciphertexts of the plaintext array based on the public parameters and the public key to obtain the ciphertext of the comparison matrix of the plaintext array. Based on the public parameters and the public key, the plaintext array is homomorphically sorted according to the comparison matrix to obtain the ciphertext of the ordered array; Based on the private key, the ciphertext of the ordered array is decrypted and decoded to obtain the plaintext calculation result; The method further includes: The comparison matrix construction methods specifically include: Input encrypted array [a0,…,a N-1 The ciphertext (N,C:={C]) j } j＝0,…,n-1 Using masking and plaintext slot rotation techniques, the ciphertext is calculated: in, Circular rotation of the encrypted arrays [a i ,…,a i-1 ]; Using masking and plaintext slot rotation techniques, l / N ciphertext C (k+1) ,…,C (k+l / N) Pack it into a single ciphertext and broadcast C 1 / N times; Using a parallel prefix homomorphic comparison algorithm, the packaged C and C are calculated. (i) Comparison results Obtain [a0] i ],[a1 i+1 ],…,[a N-1 i+N-1 The ciphertext of the comparison matrix is ​​obtained, and the comparison results are arranged diagonally to form half of the elements of the comparison matrix;​​​ Using the plaintext slot rotation technique, the ciphertext of the remaining half of the elements is copied, and the comparison matrix M = [a i j ] i,j∈[1,N] Encrypted package;​ The parallel prefix homomorphic comparison algorithm includes: The ciphertext of the first operand The ciphertext of the second operand Calculate the ciphertext of the initial signal And G0 = 0; The signal is defined as a pair (P, G) ∈ {0, 1} 2 The corresponding merge operation is: The signal merging operation is performed based on the binary tree algorithm, and homomorphic computation is obtained. Calculate C * =P n-1～0 +G n-1～0 The output yields the ciphertext C. * The corresponding plaintext is the comparison result of C1 and C2.

2. The parallel sorting method for dense-state data based on fully homomorphic encryption according to claim 1, characterized in that, The plaintext array is A = [a0, ..., a...]. N-1 The length is N, each integer is n bits, satisfying N≤l and N≤d, where l is the number of plaintext slots and d is the dimension of plaintext slots; The process of encoding and encrypting the plaintext array into several ciphertexts includes: Perform binary decomposition on each integer in the plaintext array: Packaging and encryption are performed vertically, and C is calculated. j =Enc([a 0,j ,a 1,j ,…,a N-1,j ,0,…,0]),j=0,1,…,n-1, to output ciphertext(N,C:={C j } j＝0,…,n-1 ).

3. The parallel sorting method for dense-state data based on fully homomorphic encryption according to claim 1, characterized in that, The method further includes: Sorting based on exponential encoding, specifically including: Input encrypted array [a0,…,a N-1 The ciphertext (N,C:={C]) j } j＝0,…,n-1 Using the aforementioned comparison matrix construction method, the ciphertext LT on each diagonal of the comparison matrix M is calculated. (i) =LT(C,C (i) ), the corresponding plaintext is [m 0,i ,m 1,i+1 ,…,m N-1,i-1 ]; Encode the elements of the comparison matrix onto the exponent. Using the SIMD paradigm to calculate the product of products, we obtain the ciphertext: in, It is an integer a j The sorting order; The ciphertext C:={C j } j＝0,…,n-1 Multiplying it by the ciphertext R is as follows: Based on the plaintext slot rotation technique, and using the binary accumulation algorithm, the contents of each plaintext slot are merged to obtain the ciphertext: Output ciphertext array P:={P j } j The corresponding plaintext slot is encrypted with a polynomial. Binary factorization, polynomial The coefficients under the standard basis are the ordered arrangement of the original plaintext array.

4. The parallel sorting method for dense-state data based on fully homomorphic encryption according to claim 1, characterized in that, The method further includes: Polynomial coefficient extraction is performed, and the algorithm for polynomial coefficient extraction includes: Input ciphertext P:={P j } j The corresponding plaintext is a polynomial. Calculate each projection function L i The corresponding linear combination coefficients σ(α) i ); Calculate ciphertext P j The results σ(P(x) under different Frobenius mappings j ); According to each projection function L i The coefficient σ(α) i The linear combination yields the projection result L. i (P(x) j )=b ij ciphertext B ij =Enc([b ij ,0,…,0]); Using plaintext slot rotation technology, the ciphertext B is... ij Packaged as B j =Enc([b0,b1,…,b N-1 ,0,…,0]); The output yields the ciphertext B = {B} j } j The corresponding plaintext is [b0, b1, ..., b N-1 ] is an ordered array.

5. The parallel sorting method for dense-state data based on fully homomorphic encryption according to any one of claims 1 to 4, characterized in that, The method further includes: Using BGV hierarchical fully homomorphic encryption, an m-fold circular integer ring is defined. The plaintext space in the BGV hierarchical fully homomorphic encryption method is the quotient ring R. p =R / pR, where, Let p be a cyclotomic polynomial of degree m, where p ≥ 2 is a prime number; Based on the Ring-LWE hypothesis, the symmetric version of the BGV ciphertext is: Where q is the ciphertext modulus, and s,e∈R q These are secret and noise, respectively, m∈R p It is plaintext, the decryption algorithm is [c0 + c1s(mod q)](mod p), and the upper bound of the noise norm is...

6. A parallel sorting system for dense-state data based on fully homomorphic encryption, characterized in that, include: The parameter generation module is used to generate public parameters, a public key, and a private key through security parameters, and to publish the public parameters and the public key; The homomorphic comparison module is used to encode and package the plaintext array into several ciphertexts based on the private key, and publish the ciphertexts so that the server can perform a homomorphic comparison on the ciphertexts of the plaintext array based on the public parameters and the public key to obtain the ciphertext of the comparison matrix of the plaintext array. The homomorphic sorting module is used to perform homomorphic sorting on the plaintext array based on the public parameters and the public key, according to the comparison matrix, to obtain the ciphertext of the ordered array; The result output module is used to decrypt and decode the ciphertext of the ordered array based on the private key to obtain the plaintext calculation result; The system is also used for: The comparison matrix construction methods specifically include: Input encrypted array [a0,…,a N-1 The ciphertext (N,C:={C]) j } j＝0,…,n-1 Using masking and plaintext slot rotation techniques, the ciphertext is calculated: in, Circular rotation of the encrypted arrays [a i ,…,a i-1 ]; Using masking and plaintext slot rotation techniques, l / N ciphertext C (k+1) ,…,C (k+l / N) Pack it into a single ciphertext and broadcast C 1 / N times; Using a parallel prefix homomorphic comparison algorithm, the packaged C and C are calculated. (i) Comparison results Obtain [a0] i ],[a1 i+1 ],…,[a N-1 i+N-1 The ciphertext of the comparison matrix is ​​obtained, and the comparison results are arranged diagonally to form half of the elements of the comparison matrix;​​​ Using the plaintext slot rotation technique, the ciphertext of the remaining half of the elements is copied, and the comparison matrix M = [a i j ] i,j∈[1,N] Encrypted package;​ The parallel prefix homomorphic comparison algorithm includes: The ciphertext of the first operand The ciphertext of the second operand Calculate the ciphertext of the initial signal And G0 = 0; The signal is defined as a pair (P, G) ∈ {0, 1} 2 The corresponding merge operation is: The signal merging operation is performed based on the binary tree algorithm, and homomorphic computation is obtained. Calculate C * =P n-1～0 +G n-1～0 The output yields the ciphertext C. * The corresponding plaintext is the comparison result of C1 and C2.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the parallel sorting method for encrypted data based on fully homomorphic encryption as described in any one of claims 1 to 5.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the parallel sorting method for encrypted data based on fully homomorphic encryption as described in any one of claims 1 to 5.

Images