Calculation method of plaintext matrix and ciphertext tensor multiplication based on homomorphic encryption

Abstract

The invention relates to a homomorphic encryption-based plaintext matrix and ciphertext tensor multiplication calculation method, and belongs to the field of information security. Aiming at the situation that a client has plaintext tensor X data, a server has a plaintext matrix W and a plaintext vector b, and ciphertext tensor operation is carried out on the server, the method comprises the following steps: S1, setting a homomorphic encryption scheme and parameters; s2, the client generates a public and private key pair and an operation key; s3, the client encodes the tensor, encrypts the tensor through a public key and then sends a ciphertext vector, the public key and an operation key to the server; s4, the server calculates a model ciphertext result according to the weight matrix and the offset vector of the deep learning model; s5, the client decrypts through the private key to obtain a plaintext; s6, the client decodes the plaintext to obtain a plaintext tensor. According to the method, the tensor is directly coded, the multiplication of the plaintext matrix and the ciphertext tensor can be completed without ciphertext rotation, the linear transformation calculation efficiency in the model is greatly improved, and the generalization ability is very high.

Description

Technical Field

[0001] The present invention relates to a calculation method of plaintext matrix and ciphertext tensor multiplication based on homomorphic encryption, belongs to the field of information security, and is particularly suitable for plaintext matrix and ciphertext tensor multiplication calculation based on homomorphic encryption. Background Art

[0002] In the context of the widespread application of large language models (such as GPT and BERT) today, they play a vital role in promoting social productivity and technological progress. However, the large amount of data used in the training and reasoning process of these models often contains sensitive information, emphasizing the importance of data privacy protection. By introducing homomorphic encryption technology, effective data processing and analysis can be performed while ensuring data privacy, improving the security and robustness of the model. At the same time, when homomorphic encryption is combined with large model reasoning, the operation of ciphertext matrices and tensors is a core component, especially in large models where two parties participate in the calculation, such as the attention mechanism and linear transformation γ=X·W+b under the Transformer architecture, which involves a large number of multiplications of plaintext matrices W and ciphertext tensors X. Therefore, optimizing the computational efficiency of the multiplication of plaintext matrices and ciphertext tensors can effectively improve the overall performance of the model and lay the foundation for homomorphic encryption technology to better serve various fields.

[0003] Homomorphic encryption allows calculations to be performed directly on encrypted data, and the data remains encrypted throughout the entire calculation cycle, thereby minimizing the risk of data leakage during transmission and processing. The decrypted result matches the result of the corresponding plaintext operation and can provide quantum security, allowing effective data analysis and processing while protecting data privacy. At present, homomorphic encryption technology has become an important way to solve privacy security in fields such as outsourced computing, bioinformatics, Internet of Vehicles, and machine learning. In large model reasoning based on homomorphic encryption, references [1] to [6] simplify tensor calculations into matrix calculations to increase the speed of ciphertext matrix multiplication calculations and speed up model reasoning. However, in homomorphic schemes based on SIMD technology (BGV, BFV, CKKS), even the latest ciphertext matrix multiplication methods still cannot avoid a large number of high-cost ciphertext rotation operations. In actual situations, large model reasoning mainly performs a large number of matrix operations on batch data, and tensor operations can effectively improve the speed of batch data reasoning. Therefore, in order to improve the practicality of ciphertext large model reasoning, batch ciphertext data reasoning is imperative. Therefore, it is urgent to design an encoding method suitable for ciphertext tensor calculations, which can efficiently complete the calculation of plaintext matrix and tensor multiplication when two parties participate in the calculation, and optimize the computational delay and memory requirements of large model inference of batch ciphertext data.

[0004] [1] Meng Hao, Hongwei Li, Hanxiao Chen, Pengzhi Xing, Guowen Xu, and Tianwei Zhang. Iron: Private inference on transformers. In NeurIPS, 2022.

[0005] [2] Zheng, Mengxin, Qian Lou, and Lei Jiang. "Primer: Fast privatetransformer inference on encrypted data." 2023 60th ACM / IEEE Design Automation Conference (DAC). IEEE, 2023.

[0006] [3] Meng Tong, Kejiang Chen, Jie Zhang, Yuang Qi, Weiming Zhang, Nenghai Yu, Tianwei Zhang, Zhikun Zhang. InferDPT: Privacy-preserving Inference for Black-box Large Language Models.

[0007] [4] Xiaoyang Hou, Jian Liu, Jingyu Li, Yuhan Li, Wen-jie Lu, Cheng Hong, and Kui Ren. 2023. Ciphergpt: Secure two-party gpt inference. Cryptology ePrint Archive (2023).

[0008] [5]Pang, Q., et al. BOLT: Privacy-Preserving, Accurate and EfficientInference for Transformers. IEEE S&P, 2024.

[0009] [6]HUANG Z,HONG C,WENG C,et al.More Efficient Secure MatrixMultiplication for Unbalanced Recommender Systems[J].2023,20(01):551-62.

[0010] [7]Brakerski, Z., Gentry, C., Vaikuntanathan, V.: (Leveled) fullyhomomorphic encryption without bootstrapping. ACM Transactions on ComputationTheory 6(3),13:1–13:36(2014).

[0011] [8]Junfeng Fan and Frederik Vercauteren.Somewhat Practical FullyHomomorphic Encryption.Cryptology ePrint Archive,Report 2012 / 144,2012.

[0012] [9]CHEON JH,KIM A,KIM M,et al.Homomorphic encryption for arithmeticof approximate numbers;proceedings of the Advances in Cryptology–ASIACRYPT2017:23rd International Conference on the Theory and Applications ofCryptology and Information Security,Hong Kong,China,December 3-7,2017,Proceedings,Part I 23,F,2017[C].Springer. Summary of the invention

[0013] In view of this, Figure 1 The model reasoning framework based on two-party privacy protection is shown in Figure 1. The client has a plaintext data tensor of The server has a plaintext matrix and the plaintext vector After the client encrypts the tensor X, the server calculates the ciphertext tensor to obtain Y = X·W + b, and outputs the tensor The ciphertext is given to the client, such as Figure 2 As shown, Denote the n-dimensional real vector space, where l, n, m, t, and p are positive integers. The present invention provides a method for calculating the multiplication of a plaintext matrix and a ciphertext tensor based on homomorphic encryption, which is applied to a system composed of two computer devices, namely a server and a client, connected through a network. The ciphertext is encoded into m ciphertexts, and the multiplication of the ciphertext tensor and the plaintext matrix can be completed without rotation operations, efficiently realizing the multiplication calculation of batch ciphertexts. Combining with the bias vector in linear transformation can greatly improve the calculation efficiency of linear transformation in large model architectures.

[0014] To achieve the above object, in combination with the attached Figure 3 As shown, first, the symbols involved in the present invention are defined as follows:

[0015] (1) Let the plaintext space be The ciphertext space is Use Enc to represent the encryption algorithm operation, and Dec to represent the decryption algorithm operation; use Encode to represent the tensor encoding operation, and Encode to represent the tensor decoding operation, where represents the element at the (k, i, j) position in the tensor X, and use x j,i-1 to represent the vector x j the i-th element in, and use [] k to represent the non-negative residue obtained by taking the modulus k of the calculated value, represents the largest integer not exceeding the calculated value, ⊙ represents the Hadamard Product of vectors, and ← represents assignment.

[0016] (2) The encoding operation of the tensor is Input the tensor Output m vector groups {x j} 0≤j<m ; where, for any x j =[x j,s 0≤s<l·n , the assignment process of x j,s is: traverse 0 ≤ k < l and 0 ≤ i < n in sequence, select the element where k·n + i = s from the tensor X and assign it to x j,s , to obtain

[0017] (3) The decoding operation of the vector group is Input the vector group {x j} 0≤j<m with length m, and the output tensor is Among them, for any j-th vector x j =[x j,s 0≤s<l·n , the corresponding element in the tensor X can be constructed​​

[0018] (4) The addition operation of ciphertext c and real number r is Input a ciphertext c=(c0,…,c n-1 ); Output a ciphertext c′ such that c′=(c0+r,…,c n-1 +r).

[0019] (5) The multiplication operation of ciphertext c and real number r is Input a ciphertext c=(c0,…,c n-1 ); Output a ciphertext c′ such that c′=(r·c0,…,r·c n-1 ).

[0020] (6) The addition operation of k ciphertexts is Input k ciphertexts c with i=0,…,k-1 i , output ciphertext

[0021] The present invention provides the following technical solutions:

[0022] The calculation method of the multiplication of the plaintext matrix and the ciphertext tensor based on homomorphic encryption includes the following steps:

[0023] S1: Set the security parameter λ of the homomorphic encryption scheme ε=(Enc,Dec), and generate the relevant encryption and decryption parameters of the homomorphic encryption scheme according to the security parameter λ;

[0024] S2: The client generates a private key sk, a public key pk and an operation key ek based on the encryption and decryption parameters;

[0025] S3: The client encodes the tensor X into m vector groups {x j} 0≤j<m , and encrypt the vector group into a ciphertext vector {c x,j} 0≤j<m , and finally package the ciphertext vector, public key pk and operation key ek and send them to the server;

[0026] S4: The server calculates the weight matrix W of the deep learning model based on the weight matrix W = [w j,i ] 0≤j<m,0≤i<t and the bias vector b = [b i ] 0≤i<t , calculate c y,i =CAdd(Add_all(CMult(c x,j ,w j,i )),b i ) Get the ciphertext c y,i , traverse i to get the ciphertext vector {c y,i}0≤i<t ;

[0027] S5: The server sends the ciphertext vector group {c y,i} 0≤i<t Sent to the client, the client decrypts with the private key sk to obtain the plaintext vector group {y i} 0≤i<t ;

[0028] S6: The client processes the plaintext vector {y i} 0≤i<t Decode and calculate the plaintext tensor Y = Decode({y i} 0≤i<t );

[0029] Further, step S1 is specifically as follows:

[0030] S101: Determine the security parameter λ, which can at least defend against 2 λ Adversaries with sub-bit computing power;

[0031] S102: The client selects an integer p based on the sample data, and the value will not exceed p / 2 during the ciphertext calculation process;

[0032] S103: The user uses the security parameter λ and the Homomorphic Encryption Security Standard ( http: / / homomorphicencryption.org / ), select the parameters m and q, and determine the plaintext space of the homomorphic encryption scheme as The ring of polynomials with integer coefficients Modulo the m-th degree cyclotomic polynomial φ m (X) and the integer p generate the ideal to obtain the residual class ring, the ciphertext space is

[0033] Further, step S2 is specifically as follows:

[0034] S201: The client generates a coefficient and randomly selects an undetermined element X from the set {-1, 0, 1} with a probability no greater than A random polynomial f, where represents the number of elements in the set {1,2,...,m} that are relatively prime to m, then the private key sk=(1,f);

[0035] S202: Client from R q A polynomial a with an indeterminate variable X is randomly selected from a uniform distribution. A noise polynomial e about the indeterminate variable X is randomly selected from the error distribution χ, then the public key pk=(-[(a·f+e)] q,a), where [·] q It represents the polynomial obtained by applying the coefficients of the polynomial in square brackets to q;

[0036] S203: The client generates the operation key ek required for noise control during the ciphertext operation according to the selected homomorphic encryption scheme.

[0037] Further, step S3 is specifically as follows:

[0038] S301: Client The tensor is encoded to obtain m plaintext vector groups {x j} 0≤j<m =Encode(X), where each vector length is l·n;

[0039] S302: The client uses the public key pk to perform a check on the plaintext vector x one by one j Encrypt to get the corresponding ciphertext c x,j =Enc pk (x j ), where j = 0,…,m-1;

[0040] S303: The client sends the ciphertext vector {c x,j} 0≤j<m , public key pk and operation key ek are packaged and sent to the server.

[0041] Further, step S4 is specifically as follows:

[0042] S401: The server uses formula c xw,i =Add_all(CMult(c x,j ,w j,i )), where w j,i is the element of the weight matrix W; traverse i=0,…,t-1 to calculate the ciphertext vector {c xw,i} 0≤i<t ;

[0043] S402: The server calculates the value of the formula c y,i =CAdd(c xw,i ,b i ), where b i is the element of the bias vector b; traverse i=0,…,t-1 to calculate the ciphertext vector {c y,i} 0≤i<t .

[0044] Further, step S5 is specifically as follows:

[0045] S501: The server sends the ciphertext vector {c y,i} 0≤i<t Send to the client;

[0046] S502: The client uses the private key sk to encrypt the ciphertext c one by one y,i Decrypt to get the corresponding plaintext vector y i =Dec sk (c y,i ), where i=0,…,t-1.

[0047] Preferably, the homomorphic encryption scheme described in step S1 can be one of all schemes using SIMD technology, such as the BGV scheme, the B / FV scheme and the CKKS scheme, wherein the reference of the BGV scheme is as follows: Brakerski, Z., Gentry, C., Vaikuntanathan, V.: (L veled) fully homomorphic encryption without bootstrapping. ACM Transactions on Computation Theory 6(3), 13:1–13:36(2014). https: / / doi.org / 10.1145 / 2633600 ; References for the B / FV scheme are as follows: Junfeng Fan and Frederik Vercauteren.Somewhat Practical Fully Homomorphic Encryption. Cryptology ePrint Archive, Report 2012 / 144, 2012. https: / / eprint.iacr.org / 2012 / 144 ; CKKS scheme references are as follows: CHEON JH, KIM A, KIM M, etal. Homom orphic encryption for arithmetic of approximate numbers; proceedings of the Advances in Cryptology–ASI ACRYPT 2017:23rd International Conference on the Theory and Applications of Cryptology and Information Security, HongKong, China, December 3-7, 2017, Proceedings, Part I 23,F,2017[C].Springer. ht tps: / / doi.org / 10.1007 / 978-3-319-70694-8_15 .

[0048] Preferably, the safety parameter λ is taken as λ=128 or 256; and the error distribution χ is taken as a discrete Gaussian distribution.

[0049] Preferably, the CAdd and CMult calculation operations described in step S4 can be calculated using a parallel computing system with vectorized operations, which can improve the calculation efficiency.

[0050] Preferably, the plaintext data tensor and the weight matrix When m>n, the tensor X and weight matrix W are transposed as preprocessing, that is, And adjust the corresponding index to calculate At this time, the corresponding number of ciphertexts is n, which achieves the function of reducing the number of ciphertexts.

[0051] The beneficial effects of the present invention are as follows: the present invention provides a calculation method for the multiplication of plaintext matrices and ciphertext tensors based on homomorphic encryption. Under the model reasoning framework based on two-party participation in privacy protection, the client only encrypts the tensor data, and the server only processes the ciphertext data and cannot access any customer data, thereby ensuring the security of the server and client data at the same time; compared with other schemes that treat tensors as multiple matrices and perform matrix multiplication separately, the present invention directly encodes the tensors, and can complete the multiplication of the plaintext matrix and the ciphertext tensor without ciphertext rotation, thereby greatly improving the calculation efficiency of linear transformation in large model reasoning; secondly, the encoding method of the present invention supports calculation of arbitrary dimensions, effectively solves the dimensional transformation of the tensor after linear transformation, and the encoding method of the result is consistent with the input, and the result can be directly used as input for the next calculation, with strong generalization ability. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to make the purpose and technical solution of the present invention, the present invention provides the following drawings for explanation:

[0053] Figure 1 This is a diagram of the model reasoning framework based on two-party privacy protection;

[0054] Figure 2 This is a framework diagram of linear transformation of ciphertext tensor based on homomorphic encryption;

[0055] Figure 3 It is a schematic diagram of tensor encoding of the present invention;

[0056] Figure 4 This is a flow chart of Embodiment 1 of the present invention;

[0057] Figure 5 This is a comparison chart of the experimental results of Example 2 of the present invention. DETAILED DESCRIPTION

[0058] Example 1: Figure 1As shown in the figure, in the model reasoning framework based on two-party privacy protection, in order to achieve the purpose of privacy protection, the client encrypts the tensor data it has and sends the ciphertext to the server; the server performs calculations based on the model data and sends it back to the client after the calculation is completed; the client decrypts the ciphertext to obtain the prediction result, as shown in Figure 2 In the privacy-preserving large model reasoning based on homomorphic encryption, linear transformation is one of the most basic operations, and its efficiency is mainly affected by matrix and tensor multiplication. Therefore, the present invention provides a "computation method of plaintext matrix and ciphertext tensor multiplication based on homomorphic encryption".

[0059] In this embodiment, it is assumed that the server holds the plaintext matrix W 3×2 and the plaintext vector b 2 ; Assume the client has a tensor X 2×2×3 ; It is necessary to complete a linear transformation Y on the server side under the premise of protecting the plaintext data 2×2×2 =X·W+b, the specific values ​​are as follows:

[0060] b 2 =[0.1 0.2];

[0061]

[0062] The preferred application examples of the present invention will be described in detail below with reference to the accompanying drawings.

[0063] like Figure 4 As shown, the specific steps include:

[0064] Step 1: The client sets the parameters of the CKKS homomorphic encryption scheme.

[0065] (1) The client sets the security parameter λ = 128 according to the selected homomorphic encryption scheme;

[0066] (2) Select a prime number p = 40;

[0067] (3) According to the homomorphic encryption standard, the parameter q is the product of four randomly selected odd prime numbers with a bit length between 40 and 60, and the bit length of q is about 200;

[0068] Step 2: The client generates a key based on security parameters.

[0069] (1) From coefficients {-1,0,1} and times not exceeding A polynomial f is uniformly randomly selected from the set of univariate polynomials, and the private key sk = (1, f);

[0070] (2) A polynomial a is uniformly randomly selected from the set of univariate polynomials with coefficients {0, 1, 2, …, q-1} and degree not exceeding 8192, and a noise polynomial e is selected from a discrete Gaussian distribution with a standard deviation of 3.2 on the set of polynomials with integer coefficients and degree not exceeding 8192. Let the public key pk = (-[(a·f+e)] q ,a);

[0071] (3) Generate the operation key ek for ciphertext operation noise control based on the private key sk and the public key ps.

[0072] Step 3: The client encodes the tensor X into three plaintext vector groups {x j} 0≤j<3 , and encrypt the vector group into a ciphertext vector using the public key pk to obtain {c x,j} 0≤j<3 , and finally send the ciphertext vector, public key pk and operation key ek to the server.

[0073] (1) Client to X 2×2×3 The tensor is encoded to obtain three plaintext vector groups {x j} 0≤j<3 =Encode(X), the length of each vector is 4; the three vectors are x0=(0.1, 0.7, 0.4, 1.0), x1=(0.2, 0.8, 0.5, 1.1) and x2=(0.3, 0.9, 0.6, 1.2);

[0074] (2) The client uses each public key pk to perform a check on the plaintext vector x j Encrypt to get the corresponding ciphertext c x,j =Enc pk (x j ); the three ciphertexts are c x,0 =Enc(0.1,0.7,0.4,1.0),c x,1 =Enc(0.2,0.8,0.5,1.1) and c x,2 =Enc(0.3,0.9,0.6,1.2);

[0075] (3) The client will encrypt the data {c x,j} 0≤j<3 , the public key pk and the operation key ek are packaged and sent to the server.

[0076] Step 4: The server uses the weight matrix W = [w j,i ] 0≤j<3,0≤i<2 and the bias vector b = [b i ] 0≤i<2 , calculate c y,i =CAdd(Add_all(CMult(cx,j ,w j,i )),b i ) Get the ciphertext c y,i , traverse i to get the ciphertext vector {c y,i} 0≤i<2 .

[0077] (1) The server uses formula c xw,i =Add_all(CMult(c x,j ,w j,i ) 0≤j<3 ) Calculate the ciphertext vector {c xw,i} 0≤i<2 ; When i = 0, c is calculated xw,0 =Add_all(1×Enc(0.1,0.7,0.4,1.0),3×Enc(0.2,0.8,0.5,1.1),5×Enc(0.3,0.9,0.6,1.2))=Enc(2.2,7.6,4.9,10.3); when i=1, c xw,1 =Add_all(2×Enc(0.1,0.7,0.4,1.0),4×Enc(0.2,0.8,0.5,1.1),6×Enc(0.3,0.9,0.6,1.2))=Enc(2.8,10.0,6.4,13.6);

[0078] (2) The server uses formula c y,i =CAdd(c xw,i ,b i ) Calculate the ciphertext vector {c y,i} 0≤i<2 When i=0, c is calculated according to the formula y,0 =Enc(2.3,7.7,5.0,10.4); when i=1, c is calculated according to the formula y,1 =Enc(3.0,10.2,6.6,13.8).

[0079] Step 5: The server sends the ciphertext vector {c y,i} 0≤i<2 Sent to the client, the client decrypts with the private key sk to obtain the plaintext vector group {y i} 0≤i<2 .

[0080] (1) The server sends the ciphertext vector {c k,i} 0≤i<2 Send to the client;

[0081] (2) The client uses the private key sk to encrypt the ciphertext c one by one y,i Decrypt to get the corresponding plaintext vector yi =Dec sk (c y,i ) quantity; the two plaintext vectors are y0 = (2.3, 7.7, 5.0, 10.4) and y1 = (3.0, 10.2, 6.6, 13.8).

[0082] Step 6: The client processes the plaintext vector group {y i} 0≤i<2 Decode and calculate the tensor Y = Decode ({y i} 0≤i<2 ):

[0083]

[0084] It can be seen that the calculation result of the method of the present invention is consistent with the plain text calculation result.

[0085] Example 2: Considering that the model calculation amount is large in practical applications, for the calculation of a layer in an MLP neural network, it is assumed that the weight matrix W 64×32 and the bias vector b 32 Initialized to random settings, the network is inferred, and the input data dimension used is X 100×32×64 , the neural network is encrypted and calculated. The method of the present invention provides a "computation method of plaintext matrix and ciphertext tensor multiplication based on homomorphic encryption". The specific steps are exactly the same as those in Example 1, and the details are not repeated here. The specific process is:

[0086] Step 1: The client sets the parameters of the CKKS homomorphic encryption scheme.

[0087] Step 2: The client generates a key based on security parameters.

[0088] Step 3: The client encodes the tensor X into a plaintext vector group {x j} 0≤j<3 , and encrypt the vector group into a ciphertext vector using the public key pk to obtain {c x,j} 0≤j<3 , and finally send the ciphertext vector, public key pk and operation key ek to the server.

[0089] Step 4: The server uses the weight matrix W = [w j,i ] 0≤j<64,0≤i<32 and the bias vector b = [b i ] 0≤i<32 , calculate c y,i =CAdd(Add_all(CMult(c x,j ,w j,i )),b i ) Get the ciphertext c y,i, traverse i to get the ciphertext vector {c y,i} 0≤i<64 .

[0090] Step 5: The server sends the ciphertext vector {c y,i} 0≤i<64 Sent to the client, the client decrypts with the private key sk to obtain the plaintext vector group {y i} 0≤i<64 .

[0091] Step 6: The client processes the plaintext vector group {y i} 0≤i<64 Decode and calculate the tensor Y = Decode ({y i} 0≤i<64 ).

[0092] In order to better demonstrate the beneficial effects of the method of the present invention, the invention patent "Matrix multiplication calculation method of plaintext and ciphertext based on homomorphic encryption" (application number: 202311195584.8) is used to conduct a comparative experiment with the method of the present invention for this embodiment, and the average is calculated after 100 repeated experiments. The experimental results are as follows: Figure 5 It can be seen that the method of the present invention is much more efficient than the matrix multiplication calculation method of plaintext and ciphertext based on homomorphic encryption.

[0093] Furthermore, in terms of computational complexity, the number of ciphertexts in the method of the present invention is m, and the number of plaintext-ciphertext multiplications is m·t 2 , the depth of CMult required in one calculation is 1; while the number of ciphertexts in the matrix multiplication calculation method of plaintext and ciphertext based on homomorphic encryption is l, and the number of plaintext-ciphertext multiplications is l(m+m·t 2 ), the depth of CMult required in one calculation is 2. It can be seen that in theory, as the scale of multiplication increases, the calculation efficiency of the method of the present invention will be better than the matrix multiplication calculation method of plaintext and ciphertext based on homomorphic encryption.

[0094] Finally, it should be noted that the above preferred embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail through the above preferred embodiments, those skilled in the art should understand that various changes can be made in form and details without departing from the scope defined by the claims of the present invention.

Claims

1. The calculation method of the multiplication of plaintext matrix and ciphertext tensor based on homomorphic encryption is used for the client to have a plaintext data tensor of The server has a plaintext matrix and the plaintext vector After the client encrypts the tensor X, the server calculates the ciphertext tensor to obtain Y = X·W + b, and outputs the tensor The ciphertext is given to the client, characterized in that The method is applied to a system consisting of two computer devices, a server and a client, which are connected via a network; the method comprises the following steps: S1: Set the security parameter λ of the homomorphic encryption scheme ε=(Enc, Dec), and generate the relevant encryption and decryption parameters of the homomorphic encryption scheme according to the security parameter λ; S2: The client generates a private key sk, a public key pk and an operation key ek based on the encryption and decryption parameters; S3: The client encodes the tensor X into m vector groups {x j } 0≤j<m , and encrypt the vector group into a ciphertext vector {c x，j } 0≤j<m , and finally package the ciphertext vector, public key pk and operation key ek and send them to the server; S4: The server calculates the weight matrix w=[w j,i ] 0≤j<m，0≤i＜t and the bias vector b = [b i ] 0≤i<t , calculate c y，i =CAdd(Add_aII(CMult(c x，j , w j,i )), b i ) Get the ciphertext c y，i , traverse i to get the ciphertext vector [c y，i } 0≤i＜t ; S5: The server sends the ciphertext vector group {c y，i } 0≤i<t Sent to the client, the client decrypts it with the private key sk to obtain the plaintext vector group [y i } 0≤i<t ; S6: The client processes the plaintext vector [y i }0 ≤i<t Decode and calculate the plaintext tensor Y = Decode([y i }0 ≤i<t ); in, represents an n-dimensional real vector space, l, n, m, t and p are positive integers; let the plaintext space be The ciphertext space is Enc is used to represent the encryption algorithm operation, Dec is used to represent the decryption algorithm operation; Encode is used to represent the tensor encoding operation, and Decode is used to represent the tensor decoding operation. Represents the element at position (k, i, j) in tensor X, represented by x j，i-1 Represents vector x j The i-th element in [] k Indicates that the calculated value needs to be a non-negative remainder modulo k, represents the maximum integer that does not exceed the calculated value, ⊙ represents the Hadamard Product of the vector, and ← represents the assignment; Tensor The encoding operation is Input Tensor Output m vector groups {x j } 0≤j<m ; where, for any x j =[x j，s ] 0≤s<l-n , x j，s The assignment process is: traverse 0≤k<l and 0≤i<n in turn, and select the element k·n+i=s from the tensor X Assign it to x j，s ,get Vector set The decoding operation is Input a vector group of length m {x j } 0≤j<m , the output tensor is Among them, for any j-th vector x j =[x j，s ] 0≤s<l·n , you can construct the corresponding element in the tensor X The addition operation of ciphertext c and real number r is Input a ciphertext c = (c0, ..., c n-1 ); Output a ciphertext c′ such that c′=(c0+r,...,c n-1 +r); The multiplication operation of ciphertext c and real number r is Input a ciphertext c = (c0, ..., c n-1 ); Output a ciphertext c′ such that c′=(r·c0,...,r·c n-1 ); The addition operation of k ciphertexts is Input k ciphertexts c with i=0,…,k-1 i , output ciphertext Further, step S1 is specifically as follows: S101: Determine the security parameter λ, which can at least defend against 2 λ Adversaries with sub-bit computing power; S102: The client selects an integer p based on the sample data, and the value will not exceed p / 2 during the ciphertext calculation process; S103: The user uses the security parameter λ and the Homomorphic Encryption Security Standard ( http: / / homomor p hicencry p tion.org / ), select the parameters m and q, and determine the plaintext space of the homomorphic encryption scheme as That is, the ring of polynomials with integer coefficients Modulo the m-th degree cyclotomic polynomial φ m (X) and the integer p generate the ideal to obtain the residual class ring, the ciphertext space is Further, step S2 is specifically as follows: S201: The client generates a coefficient and randomly selects an undetermined element X from the set {-1, 0, 1} with a probability no greater than A random polynomial f, where represents the number of elements in the set {1, 2, ..., m} that are relatively prime to m, then the private key sk = (1, f); S202: Client from R q A polynomial a with an indeterminate variable X is randomly selected from a uniform distribution. A noise polynomial e about the indeterminate variable X is randomly selected from the error distribution χ, then the public key pk=(-[(a·f+e)] q , a), where [·] q It represents the polynomial obtained by applying the coefficients of the polynomial in square brackets to q; S203: The client generates a computation key ek required for noise control during the ciphertext computation according to the selected homomorphic encryption scheme; Further, step S3 is specifically as follows: S301: Client The tensor is encoded to obtain m plaintext vector groups [x j } 0≤j<m =Encode(X), where each vector length is l·n; S302: The client uses the public key pk to perform a check on the plaintext vector x one by one j Encrypt to get the corresponding ciphertext c x，j =Enc pk (x j ), wherein j=0, ..., m-1; S303: The client sends the ciphertext vector [c x，j } 0≤j<m , public key pk and operation key ek are packaged and sent to the server; Further, step S4 is specifically as follows: S401: The server uses formula c xw,i =Add_all(CMult(c x，j , w j，i )), where w j，i is the element of the weight matrix w; traverse i=0,...,t-1 to calculate the ciphertext vector {c xw,i } 0≤i＜t ; S402: The server calculates the value of the formula c y，i =CAdd(c xw,i , b i ), where b i is the element of the bias vector b; traverse i=0,...,t-1 to calculate the ciphertext vector {c y，i } 0≤i＜t ; Further, step S5 is specifically as follows: S501: The server sends the ciphertext vector {c y，i } 0≤i＜t Send to the client; S502: The client uses the private key sk to encrypt the ciphertext c one by one y，i Decrypt to get the corresponding plaintext vector y i =Dec sk (c y,i ); wherein, i=0, ..., t-1.

2. The method for calculating homomorphic ciphertext matrix multiplication based on double loop coding according to claim 1, characterized in that: The homomorphic encryption scheme described in step S1 can be any scheme using SIMD technology, including: BGV scheme, B / FV scheme and CKKS scheme.

3. The method for calculating homomorphic ciphertext matrix multiplication based on double loop coding according to claim 1, characterized in that: The security parameter λ in step S101 is λ=128 or 256.

4. The method for calculating homomorphic ciphertext matrix multiplication based on double loop coding according to claim 1, characterized in that: The error distribution χ described in step S202 is taken as a discrete Gaussian distribution.

5. The method for calculating homomorphic ciphertext matrix multiplication based on double loop coding according to claim 1, characterized in that: The CAdd and CMult calculation operations described in step S4 can be calculated using a parallel computing system with vectorized operations, which can improve the calculation efficiency.

6. The method for calculating homomorphic ciphertext matrix multiplication based on double loop coding according to claim 1, characterized in that: The plaintext data tensor and the weight matrix When m>n, the tensor X and weight matrix w are transposed as preprocessing, that is, And adjust the corresponding index to calculate At this time, the corresponding number of ciphertexts is n, which achieves the function of reducing the number of ciphertexts.

Images