Privacy protection method, device and system based on homomorphic rank transformation

Abstract

The invention discloses a privacy protection method, device and system based on homomorphic rank transformation, and belongs to the technical field of privacy protection. The method comprises the following steps: a calculation executor negotiates homomorphic encryption parameters with a data holder; the calculation executor obtains a ciphertext ct, a rotation key and a rank descent key sent by the data holder; the calculation executor combines the rotation key and the rank descent key to sequentially execute rank lifting, rotation and rank reduction operations on the ciphertext ct to obtain a ciphertext ct '; and the calculation execution party transmits the reduced-rank ciphertext ct'to a data holding party, so that the data holding party obtains a homomorphic rotation result of the complex vector # imgabs0 #, which cannot be obtained by the calculation execution method, based on the reduced-rank ciphertext ct '. According to the method, a calculation execution party cannot obtain the rotation result of the complex vector, and the calculation efficiency is improved.

Description

Technical Field

[0001] The present invention belongs to the field of computing technology, and in particular relates to a privacy protection method, device and system based on homomorphic rank transformation. Background Art

[0002] Cloud computing service providers face an increasing demand for privacy protection when processing user sensitive data. Fully homomorphic encryption is one of the powerful tools to solve this problem. It allows service providers to perform calculations on users' encrypted data, thereby protecting users' privacy and security throughout the entire chain of data transmission. However, current fully homomorphic encryption algorithms often consume a lot of computing resources and time, which greatly limits the practicality of homomorphic encryption. Currently, fully homomorphic encryption is mainly divided into two technical routes: fully homomorphic encryption based on arithmetic circuits (such as BGV, CKKS) and fully homomorphic encryption based on Boolean circuits (such as TFHE, FHEW). The former has powerful SIMD features that can greatly improve the throughput of calculations, while the latter can support more flexible function evaluation and faster bootstrapping operations. For tasks with high parallel requirements such as privacy-preserving machine learning, homomorphic encryption based on arithmetic circuits is a more common choice.

[0003] In order to address the performance issues of fully homomorphic encryption, many implementations have begun to use special hardware such as GPUs, FPGAs, etc. As a hardware device widely used for AI acceleration, GPUs provide significant acceleration effects for traditional cryptographic algorithms such as RSA and ECC, with performance that is more than 1,000 times that of CPU platforms. However, in the field of fully homomorphic encryption, this performance improvement is not obvious, and in some recent works, there is only about a 200-fold performance improvement. GPUs provide considerable on-chip memory, and each stream processor typically contains 64,000 32-bit registers and 48-228kB of shared memory, but fully homomorphic encryption algorithms often find it difficult to fully utilize the parallel capabilities of GPUs. For example, the CKKS algorithm based on the RLWE difficulty problem requires the use of large-scale polynomial operations, and the degree of these polynomials is often as high as 2 15 or 2 16 Such large-scale calculations need to rely on low-speed global memory, which is mainly due to the large amount of cross-thread collaboration in the calculation.

[0004] Although most current homomorphic encryption algorithms rely on the RLWE problem, more and more research is turning to fully homomorphic encryption algorithms built using the MLWE problem. Compared with RLWE, the MLWE-based homomorphic encryption algorithm has better hardware-friendly features while improving security. It allows us to adjust security by rank without changing the degree of polynomials in the difficult problem to adapt the homomorphic encryption parameters required for the current task. However, MLWE-based fully homomorphic encryption has an unacceptable computational complexity. Taking homomorphic multiplication as an example, when the rank used by MLWE is 2, the MLWE-based scheme has a 1.7-fold performance loss compared to the RLWE-based scheme at the same circuit depth, and this performance loss will be further exacerbated as the rank increases. In addition, the MLWE-based scheme also has a larger key size. Summary of the invention

[0005] In response to the above problems, the present invention provides a privacy protection method, device and system based on homomorphic rank transformation, which not only prevents the calculation executor from obtaining the rotation result of the complex vector, but also improves the calculation efficiency.

[0006] To achieve the above-mentioned object of the invention, the technical solution of the present invention includes the following contents.

[0007] A privacy protection method based on homomorphic rank transformation is applied to a computing execution method, the method comprising:

[0008] Negotiate homomorphic encryption parameters with the data holder, including: polynomial degree n, rank r, approximate scaling factor Δ, maximum number of multiplication layers L and corresponding ciphertext modulus Q L ;

[0009] Obtain the ciphertext ct, rotation key and rank reduction key sent by the data holder; wherein the ciphertext ct is based on the complex vector generate;

[0010] Improve the rank of the ciphertext ct and obtain the ciphertext

[0011] Combine the rank r and the rotation key to complete the ciphertext Homomorphic rotation of

[0012] Combine the rank reduction key with the rotated polynomial The rank reduction is performed, and the ciphertext ct′ after the rank reduction is transmitted to the data holder, so that the data holder obtains the complex vector that cannot be obtained by the calculation execution method based on the ciphertext ct′ after the rank reduction The homomorphic rotation result of .

[0013] Furthermore, the ciphertext ct is based on the complex vector Generate, including:

[0014] The data holder generates a public-private key pair

[0015] The complex vector The encoding is a polynomial m(X); where the encoding mapping Ecd is: Canonical embedding mapping τ: Map the polynomial m(X) to a complex vector represents the complex domain, represents the field of real numbers;

[0016] Use the public key pk to encrypt the polynomial m(X) and obtain the ciphertext ct.

[0017] Furthermore, the process of generating the rotating key includes:

[0018] Defines the gadget vector used to rotate the key μ is a small constant, 0≤j<μ;

[0019] Introducing a temporary special modulus Temporary Order And generate a temporary private key vector Among them, K is a positive integer constant, p i is a relatively prime small modulus, a special modulus k is a positive integer constant, is a polynomial ring with integer coefficients On the Cyclotomic Polynomial X n +1 quotient ring;

[0020] From the matrix space Sampling polynomial matrices from a uniform distribution in Sample noise from a noise distribution For 0≤j<μ;

[0021] For a certain number of steps to be rotated w, output the rotation key rotk of the w-th rotation step w ={rotk w,j} 0≤j<μ , where the jth component

[0022] Furthermore, the process of generating the rank-down key includes:

[0023] Define the gadget vector used by the rank descent key in α is a small constant, and and For 0≤j′ <d;

[0024] From the matrix space Sampling polynomial matrices from a uniform distribution in Sample a noise vector from the noise distribution For 0≤j′ <d;

[0025] Output rank reduction key rdk = {rdk j′} 0≤j′<d ; Among them, the j′th component

[0026] Further, the ciphertext is completed by combining the rank r and the rotation key Homomorphic rotation of include:

[0027] Calculate the NAF representation of γ Let the Hamming weight represented by NAF be h, and the number of steps to be rotated after decomposition is {w0,w1,…,w i ,…,w h-1};

[0028] The number of steps to be rotated each time is w i , loop calculation in, Represents ciphertext The first polynomial in , Represents ciphertext A polynomial vector composed of several polynomials in the middle. φ w Represents automorphism KeySwitch algorithm μ represents the rotation key with a combined decomposition size of μ A private key The encrypted polynomial vector is converted into a vector encrypted with the private key Encrypted MLWE ciphertext;

[0029] Restore the rank of the ciphertext: Among them, the KeySwitch d It means combining the rank reduction key rdk with the decomposition size of d, and converting a private key The encrypted polynomial vector is converted into a vector encrypted with the private key Encrypted MLWE ciphertext.

[0030] Furthermore, the data holder obtains the complex vector based on the reduced-rank ciphertext ct′ The homomorphic rotation results include:

[0031] Utilizing private keys Decrypt the reduced-rank ciphertext ct′ to obtain the plaintext m′(X);

[0032] The plaintext m′(X) is decoded based on the approximate scaling factor Δ and the mapping function τ to obtain the complex vector The homomorphic rotation result of .

[0033] Furthermore, after negotiating homomorphic encryption parameters with the data holder, it also includes:

[0034] Get the security strength λ corresponding to the homomorphic encryption parameter;

[0035] Determine whether the security strength λ is greater than a set threshold;

[0036] When the security strength λ is less than the set threshold, returning to the step of negotiating homomorphic encryption parameters with the data holder to negotiate new homomorphic encryption parameters;

[0037] When the security strength λ is greater than a set threshold, the process jumps to obtaining the ciphertext ct1, ciphertext ct2, cross-relinearization key and rank reduction key sent by the data holder.

[0038] A privacy protection device based on homomorphic rank transformation, the device comprising:

[0039] Negotiation module, used to negotiate homomorphic encryption parameters with the data holder, the homomorphic encryption parameters include: polynomial degree n, rank r, approximate scaling factor Δ and maximum number of multiplication layers L and corresponding ciphertext modulus Q L ;

[0040] The acquisition module is used to obtain the ciphertext ct, the rotation key and the rank reduction key sent by the data holder; wherein the ciphertext ct is based on the complex vector generate;

[0041] The rank-up module is used to increase the rank of the ciphertext ct to obtain the ciphertext

[0042] A rotation module is used to combine the rank r and the rotation key to complete the ciphertext Homomorphic rotation of

[0043] A rank reduction module for combining the rank reduction key with the rotated polynomial The rank reduction is performed, and the ciphertext ct′ after the rank reduction is transmitted to the data holder, so that the data holder obtains the complex vector that cannot be obtained by the calculation execution method based on the ciphertext ct′ after the rank reduction The homomorphic rotation result of .

[0044] A privacy protection system based on homomorphic rank transformation, the system comprising:

[0045] Compute execution methods to:

[0046] Negotiate homomorphic encryption parameters with the data holder, including: polynomial degree n, rank r, approximate scaling factor Δ, maximum number of multiplication layers L and corresponding ciphertext modulus Q L ;

[0047] Obtain the ciphertext ct, rotation key and rank reduction key sent by the data holder; wherein the ciphertext ct is based on the complex vector generate;

[0048] Improve the rank of the ciphertext ct and obtain the ciphertext

[0049] Combine the rank r and the rotation key to complete the ciphertext Homomorphic rotation of

[0050] Combine the rank reduction key with the rotated polynomial Perform rank reduction and transmit the reduced ciphertext ct′ to the data holder;

[0051] Data holders, for:

[0052] Negotiate homomorphic encryption parameters with the computation executor, including: polynomial degree n, rank r, approximate scaling factor Δ, maximum number of multiplication layers L, and corresponding ciphertext modulus Q L ;

[0053] Based on complex vector Generate ciphertext ct;

[0054] Generate rotation keys and rank reduction keys;

[0055] Send the ciphertext ct, the rotation key and the rank reduction key to the calculation execution method;

[0056] The complex vector that cannot be obtained by the calculation execution method is obtained based on the reduced-rank ciphertext ct′ The homomorphic rotation result of .

[0057] An electronic device comprises: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, the privacy protection method based on homomorphic rank transformation described in any one of the above items is implemented.

[0058] Compared with the prior art, the present invention uses homomorphic rank transformation to accelerate the calculation method and device of the existing MLWE-based fully homomorphic encryption evaluation algorithm. In addition to preventing the calculation executor from obtaining the rotation result of the complex vector, this method also provides improvements in time complexity and space complexity, and can achieve better expected performance on hardware architectures such as GPUs. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 It is a block diagram of the homomorphic multiplication operation of the MLWE-CKKS algorithm calculated by using homomorphic rank transformation according to the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0060] Next, the technical solutions in the embodiments of the present invention will be analyzed and expressed more comprehensively and completely in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention. In order to further explain the present invention and enable those skilled in the art to clearly and thoroughly understand the present invention, it is not used to limit the present invention.

[0061] The privacy protection method based on cross re-linearization of the present invention is implemented in the MLWE-based fully homomorphic encryption. The generalized MLWE key conversion technology aims to convert a polynomial vector encrypted with a private key into an MLWE ciphertext ct encrypted with a private key where r1 and r2 are positive integers. This technology relies on a pre-generated evaluation key swk. First, define the gadget vector as g=(g0,…,g d-1 )), where and and q i is the RNS basis that makes up the ciphertext modulus. For 0≤j<d, d is called the decomposition size. This key is generated as follows: Given the private keys and sample a matrix A′ from the uniform distribution of the matrix space and sample a vector from the noise distribution, and output swk={swk j} 0≤j<d , where the j-th component is

[0062]

[0063] On the premise of publicly disclosing the above evaluation key, given an encrypted vector This key conversion algorithm performs the following steps:

[0064] · Calculate the gadget decomposition: where

[0065] Calculate the inner product:

[0066] Modulus reduction:

[0067] The ciphertext output by the algorithm satisfy For the convenience of the following description, the key conversion algorithm is recorded as

[0068] The above related definitions also include: For a positive integer power N of 2, define the polynomial ring Modular quotient ring definition The module with upper rank r is Ciphertext modulus where q j Two by two, is the number of layers of the current homomorphic ciphertext, L is the maximum number of evaluable layers, Special module where p i are mutually prime, and with any q j are mutually prime, k is a positive integer constant. A MLWE ciphertext of rank r has the form

[0069] In one embodiment, a complex vector is calculated with privacy The cyclic left-handed γ position For computing purposes, the data holder does not want the computing executor to know the input and output of the computing. Figure 1 A complete implementation process is shown below.

[0070] Step 1: The computation executor and the data holder negotiate homomorphic encryption parameters.

[0071] The data holder and the computation executor negotiate a set of homomorphic encryption parameters, including the polynomial number n, rank r, maximum number of multiplication layers L, and maximum ciphertext modulus Q. L =∏ 0≤j≤L q j , approximate scaling factor Δ. Where q j is the RNS basis that constitutes the ciphertext modulus.

[0072] In a preferred embodiment, the present invention also obtains the security strength λ corresponding to the above-mentioned homomorphic encryption parameters, and determines whether the security strength λ is greater than a set threshold: when the security strength λ is less than the set threshold, returns to the step of negotiating the homomorphic encryption parameters with the data holder to negotiate new homomorphic encryption parameters; when the security strength λ is greater than the set threshold, jumps to the step of obtaining the ciphertext ct1, ciphertext ct2, cross-relinearization key and rank reduction key sent by the data holder.

[0073] Step 2: The computation executor obtains the ciphertext ct, rotation key, and rank reduction key sent by the data holder.

[0074] (1) Generation of ciphertext ct.

[0075] The ciphertext ct1 and ciphertext ct2 of the present invention are based on the complex vector The main steps include:

[0076] Step 2.1.1: Generate encryption keys.

[0077] The data holder generates an encrypted private key And use this to calculate the public key for encryption and decryption

[0078]

[0079] in, Indicates r in the business ring The vector set consisting of the elements on , Represents modulo Q L The business ring, Indicates r×r in the business ring The polynomial matrix A is uniformly sampled on the quotient ring. Noise Vector Sampled from a noise distribution.

[0080] Step 2.1.2: Convert the complex vector Encoded as a polynomial

[0081] Encode the complex vector into a polynomial. Here the encoding is mapped to Ecd: Where τ: Mapping maps the polynomial m(X) to By evaluating m(X) in The values ​​of these points, ξ, are primitive roots of order 2n. Here, the vectors are encoded as m(X).

[0082] Step 2.1.3: Use the encryption key to polynomial and polynomial Encryption is performed.

[0083] The data holder calculates the public key encryption of the plaintext polynomial. With the noise vector This is used to calculate the encryption of the plaintext m(X):

[0084]

[0085] Here the plaintext is encrypted Among them, b is the first polynomial in the ciphertext ct, is the polynomial vector composed of the last r polynomials in the ciphertext ct.

[0086] (2) Generation of rank-reduction keys.

[0087] Define the gadget vector used by the rank descent key where μ is a small constant. In addition, a temporary special modulus is introduced Where K is a positive integer constant, p i is a small modulus that is relatively prime. In order to keep the key within the modulus Under the security, use a temporary order At the same time, the private key generation function generates a temporary private key vector

[0088] The rank-descent key is generated as follows: Sampling from a uniform distribution in Sampling from a noise distribution Output rdk = {rdk j} 0≤j<d ,in

[0089]

[0090] (3) Generation of rotation keys.

[0091] This embodiment uses the technology of homomorphic rank transformation to perform efficient continuous homomorphic rotation, and the application scenario of this technology is the BFV / CKKS type of solution. When performing homomorphic rotation, it is necessary to generate an evaluation key for each possible rotation step, which greatly increases the size of the key. One feasible way is to decompose the number of steps to be rotated into a NAF representation, so that only an evaluation key with a step number that is a power of 2 needs to be generated, and then the required number of steps is achieved through multiple rotations. For this situation, the algorithm is characterized in that the rank of the MLWE ciphertext is first homomorphically improved, and after several low-cost homomorphic rotations, the rank of the ciphertext is restored. The algorithm is described as follows.

[0092] Given a MLWE ciphertext Several rotation keys rotk for rotations of powers of 2 i , rank reduction key rdk, number of steps to be rotated γ, where the rotation key rotk i Generate using: Sampling from a uniform distribution in Sampling from a noise distribution Output rotk i ={rotk i,j} 0≤j<μ , where the jth component is

[0093]

[0094] Use the following steps to output the rotated ciphertext ct′:

[0095] Improve the rank of ciphertext:

[0096] For each i∈NAF(γ), calculate:

[0097] Restore the rank of the ciphertext and output:

[0098] where φ i Represents automorphism The ciphertext output by the algorithm satisfy

[0099] Step 3: The computation executor combines the rotation key with the rank reduction key to sequentially perform rank increase, rotation, and rank reduction operations on the ciphertext ct to obtain the ciphertext ct′.

[0100] Step 3.1: Improve the rank of the ciphertext ct to obtain the ciphertext

[0101] The computation execution party improves the ciphertext rank: the ciphertext is obtained

[0102] Step 3.2: Combine the rank r and the rotation key to complete the ciphertext Homomorphic rotation of

[0103] The computation execution side first calculates the NAF representation of γ Let the Hamming weight represented by NAF be h, and the number of steps to be rotated after decomposition is {w0,w1,…,w i ,…,w h-1}.

[0104] After that, for each number of steps w to be rotated i, the calculation execution party calculates Thus, the rotated ciphertext is obtained in, Represents ciphertext The first polynomial in , Represents ciphertext A polynomial vector composed of several polynomials in the middle. φ w Represents automorphism KeySwitch algorithm μ represents the rotation key with a combined decomposition size of μ A private key The encrypted polynomial vector is converted into a vector encrypted with the private key Encrypted MLWE ciphertext.

[0105] Step 3.3: Combine the rank-down key with the rotated ciphertext Perform rank reduction.

[0106] Calculate the rank of the ciphertext restored by the executor: Among them, the KeySwitch d It means combining the rank reduction key rdk with the decomposition size of d, and converting a private key The encrypted polynomial vector is converted into a vector encrypted with the private key Encrypted MLWE ciphertext.

[0107] Step 4: The calculation execution party transmits the reduced-rank ciphertext ct′ to the data holder, so that the data holder obtains the complex vector that cannot be obtained by the calculation execution method based on the reduced-rank ciphertext ct′. The homomorphic rotation result of .

[0108] After the calculation execution party transmits the calculation result ciphertext ct′ to the data holder, the data holder calculates the decryption of the ciphertext cct′ and obtains Finally, the data holder calculates the decoded value of the plaintext m′(X) is the desired result, that is, the complex vector The homomorphic rotation result of .

[0109] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the present disclosure. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary technical means in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the present disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes may be made without departing from the scope thereof.

Claims

1. A privacy protection method based on homomorphic rank transformation, characterized in that: Applied to a calculation execution method, the method comprising: Negotiate homomorphic encryption parameters with the data holder, including: polynomial degree n, rank r, approximate scaling factor Δ, maximum number of multiplication layers L and corresponding ciphertext modulus Q L ; Obtain the ciphertext ct, rotation key and rank reduction key sent by the data holder; wherein the ciphertext ct is based on the complex vector generate; Improve the rank of the ciphertext ct and obtain the ciphertext Combine the rank r and the rotation key to complete the ciphertext Homomorphic rotation of Combined with the rank-down key pair, the rotated ciphertext The rank reduction is performed, and the ciphertext ct′ after the rank reduction is transmitted to the data holder, so that the data holder obtains the complex vector that cannot be obtained by the calculation execution method based on the ciphertext ct′ after the rank reduction The homomorphic rotation result of .

2. The method according to claim 1, characterized in that: The ciphertext ct is based on the complex vector Generate, including: The data holder generates a public-private key pair The complex vector The encoding is a polynomial m(X); where the encoding mapping Canonical Embedding Mapping Map the polynomial m(X) to a complex vector represents the complex domain, represents the field of real numbers; Use the public key pk to encrypt the polynomial m(X) and obtain the ciphertext ct.

3. The method according to claim 2, characterized in that The process of generating the rotating key includes: Defines the gadget vector used to rotate the key μ is a small constant, 0≤j<μ; Introducing a temporary special modulus Temporary Order And generate a temporary private key vector Among them, K is a positive integer constant, p i is a relatively prime small modulus, a special modulus k is a positive integer constant, is a polynomial ring with integer coefficients On the Cyclotomic Polynomial X n +1 quotient ring; From the matrix space Sampling polynomial matrices from a uniform distribution in Sample noise from a noise distribution For 0≤j<μ; For a certain number of steps to be rotated w, output the rotation key rotk of the w-th rotation step w ={rotk w,j } 0≤j<μ , where the jth component 4. The method according to claim 3, characterized in that: The process of generating the rank-down key comprises: Define the gadget vector used by the rank descent key in α is a small constant, and and For 0≤j′ <d; From the matrix space Sampling polynomial matrices from a uniform distribution in Sample a noise vector from the noise distribution For 0≤j′ <d; Output rank reduction key rdk = {rdk j′ } 0≤j′<d ; Among them, the i′th component 5. The method according to claim 4, characterized in that Combine the rank r and the rotation key to complete the ciphertext Homomorphic rotation of include: Calculate the NAF representation of γ Let the Hamming weight represented by NAF be h, and the number of steps to be rotated after decomposition is {w0,w1,…,w i ,…,w h-1 }; The number of steps to be rotated each time is w i , loop calculation in, Represents ciphertext The first polynomial in , Represents ciphertext A polynomial vector composed of several polynomials in the middle. φ w Represents automorphism KeySwitch algorithm μ represents the rotation key with a combined decomposition size of μ A private key The encrypted polynomial vector is converted into a vector encrypted with the private key Encrypted MLWE ciphertext; Restore the rank of the ciphertext: Among them, the KeySwitch d It means combining the rank reduction key rdk with the decomposition size of d, and converting a private key The encrypted polynomial vector is converted into a vector encrypted with the private key Encrypted MLWE ciphertext.

6. The method according to claim 1, characterized in that The data holder obtains the complex vector based on the reduced rank ciphertext ct′ The homomorphic rotation results include: Utilizing private keys Decrypt the reduced-rank ciphertext ct′ to obtain the plaintext m′(X); The plaintext m′(X) is decoded based on the approximate scaling factor Δ and the mapping function τ to obtain the complex vector The homomorphic rotation result of .

7. The method according to any one of claims 1 to 6, characterized in that: After negotiating homomorphic encryption parameters with the data holder, it also includes: Get the security strength λ corresponding to the homomorphic encryption parameter; Determine whether the security strength λ is greater than a set threshold; When the security strength λ is less than the set threshold, returning to the step of negotiating homomorphic encryption parameters with the data holder to negotiate new homomorphic encryption parameters; When the security strength λ is greater than a set threshold, the process jumps to obtaining the ciphertext ct1, ciphertext ct2, cross-relinearization key and rank reduction key sent by the data holder.

8. A privacy protection device based on homomorphic rank transformation, characterized in that: The device comprises: Negotiation module, used to negotiate homomorphic encryption parameters with the data holder, the homomorphic encryption parameters include: polynomial degree n, rank r, approximate scaling factor Δ and maximum number of multiplication layers L and corresponding ciphertext modulus Q L ; The acquisition module is used to obtain the ciphertext ct, the rotation key and the rank reduction key sent by the data holder; wherein the ciphertext ct is based on the complex vector generate; The rank-up module is used to increase the rank of the ciphertext ct to obtain the ciphertext A rotation module is used to combine the rank r and the rotation key to complete the ciphertext Homomorphic rotation of A rank reduction module for combining the rank reduction key with the rotated polynomial The rank reduction is performed, and the ciphertext ct′ after the rank reduction is transmitted to the data holder, so that the data holder obtains the complex vector that cannot be obtained by the calculation execution method based on the ciphertext ct′ after the rank reduction The homomorphic rotation result of .

9. A privacy protection system based on homomorphic rank transformation, characterized in that: The system comprises: Compute execution methods to: Negotiate homomorphic encryption parameters with the data holder, including: polynomial degree n, rank r, approximate scaling factor Δ, maximum number of multiplication layers L and corresponding ciphertext modulus Q L ; Obtain the ciphertext ct, rotation key and rank reduction key sent by the data holder; wherein the ciphertext ct is based on the complex vector generate; Improve the rank of the ciphertext ct and obtain the ciphertext Combine the rank r and the rotation key to complete the ciphertext Homomorphic rotation of Combine the rank reduction key with the rotated polynomial Perform rank reduction and transmit the reduced ciphertext ct′ to the data holder; Data holders, for: Negotiate homomorphic encryption parameters with the computation executor, including: polynomial degree n, rank r, approximate scaling factor Δ, maximum number of multiplication layers L, and corresponding ciphertext modulus Q L ; Based on complex vector Generate ciphertext ct; Generate rotation keys and rank reduction keys; Send the ciphertext ct, the rotation key, and the rank reduction key to the calculation execution method; The complex vector that cannot be obtained by the calculation execution method is obtained based on the reduced-rank ciphertext ct′ The homomorphic rotation result of .

10. An electronic device, characterized in that: The electronic device includes: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, it implements the privacy protection method based on homomorphic rank transformation as described in any one of claims 1-7.

Images