Data sorting method based on homomorphic encryption

Abstract

The invention discloses a data sorting method based on homomorphic encryption. The method comprises the following steps: acquiring an initial ciphertext sequence; comparing each ciphertext element in the ciphertext sequence through a sign function to obtain an encryption comparison level vector; wherein the encryption comparison level vector is composed of encryption comparison levels corresponding to all ciphertext elements; performing nonlinear mapping on the encrypted comparison-level vector, taking comparison-level sequences before and after mapping as coefficients respectively, constructing a polynomial combination in combination with corresponding ciphertext elements, and calculating the value of each polynomial to obtain a comparison-level representation vector; setting a target comparison level vector, and calculating a ciphertext sequence under the target comparison level vector according to the comparison level representation vector to obtain a target ciphertext sequence; according to the method, the comparison-level representation vector is constructed by using the polynomial to represent the incidence relation, the node and the matrix operation of the ciphertext and the ciphertext sequence, so that the sorting result can be accurately obtained, the error caused by approximate calculation is avoided, and meanwhile, the calculation complexity is greatly reduced.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and more specifically to a data sorting method based on homomorphic encryption. Background Art

[0002] Currently, homomorphic encryption is a special encryption technology that allows arithmetic operations to be performed on encrypted data. It can calculate the encrypted data without access to the key, and decrypt it to get the same result as the same operation on the original data.

[0003] In recent years, in order to realize the comparison operation on homomorphic ciphertext data, an efficient homomorphic comparison scheme based on learning error (LWE) has been proposed, and homomorphic encryption technology that supports floating point comparison has also been developed. However, these methods still have obvious disadvantages, such as low computational efficiency, high communication overhead, ciphertext expansion or precision loss after multiple comparisons.

[0004] Therefore, how to improve computing efficiency, reduce data transmission volume and improve accuracy is an urgent problem to be solved by those skilled in the art. Summary of the invention

[0005] In view of this, the present invention provides a data sorting method based on homomorphic encryption, which can achieve efficient and secure data comparison and sorting.

[0006] In order to achieve the above object, the present invention adopts the following technical solution:

[0007] A data sorting method based on homomorphic encryption includes the following steps:

[0008] S1: Get the initial ciphertext sequence under fully homomorphic encryption;

[0009] S2: Compare each ciphertext element in the ciphertext sequence by a preset sign function to obtain an encryption comparison level vector of each ciphertext element; wherein the encryption comparison level vector is composed of encryption comparison levels corresponding to each ciphertext element;

[0010] S3: Setting different mapping functions to map the encrypted comparative vector, taking the comparative sequences before and after the mapping as coefficients, respectively, constructing a polynomial combination in combination with the corresponding ciphertext elements, and calculating the values ​​of each polynomial to obtain a comparative representation vector;

[0011] S4: Setting a target comparative level vector, and calculating a ciphertext sequence under the target comparative level vector according to the comparative level representation vector to obtain a target ciphertext sequence.

[0012] Preferably, the encrypted comparative level vector is obtained by batch processing, which specifically includes:

[0013] Obtain the number x of elements in the initial ciphertext sequence;

[0014] Shifting and padding the initial ciphertext sequence according to the number of elements x to construct a reference sequence pair, wherein any two elements in the reference sequence pair have a corresponding relationship;

[0015] Input the reference sequence pairs into the pre-built symbolic function to obtain the comparison results of each corresponding relationship;

[0016] Accumulation is performed according to the comparison results to obtain the comparison level corresponding to each element.

[0017] Preferably, the mapping function is a nonlinear function.

[0018] Preferably, according to the number x of the ciphertext elements, x-1 mapping functions are set accordingly to perform x-1 mappings, and corresponding x polynomials are constructed.

[0019] Preferably, the step of constructing the comparative characterization vector includes:

[0020] Get the encrypted comparison vector [a1, a2, a3, a4, ... a n ], where a1, a2, a3, a4, a n are the comparative ciphertexts of the corresponding ciphertext elements, indicating the data size of the ciphertext elements, and n is the number of ciphertext elements;

[0021] The encrypted comparative level vector is nonlinearly mapped by a power function to obtain a mapped comparative level vector.

[0022] Construct a polynomial based on the comparison vectors before and after the mapping:

[0023] a1X1+a2X2+a3X3+a4X4+...+a n X n =Y1

[0024]

[0025] Among them, X1, X2, X3, X4, X n is the corresponding ciphertext element in the initial ciphertext sequence.

[0026] The comparative standard vector is obtained as [Y1, Y2].

[0027] Preferably, the S4 specifically includes:

[0028] When the sorting target is to sort from small to large, set the target comparison vector to [1,2,3,4,...n];

[0029] According to the mapping function adopted by the nonlinear mapping, a target matrix is ​​constructed; the target matrix is ​​composed of the target comparative level vector and the target comparative level vector under the mapping function;

[0030] The target ciphertext sequence is the product of the inverse matrix of the target matrix and the comparative standard vector.

[0031] Preferably, the step further includes: decrypting the target ciphertext sequence using a private key.

[0032] Preferably, the S1 specifically includes:

[0033] Get the plaintext to be compared, call the key generation algorithm, and generate the private key and public key;

[0034] The encryption algorithm is called and the plaintext sequence is fully homomorphically encrypted using the public key to obtain a ciphertext sequence.

[0035] Preferably, the sign function is:

[0036]

[0037] Among them, X i and X j represents the two ciphertext elements to be compared in the initial ciphertext sequence, and a is the comparison result

[0038] It can be seen from the above technical solutions that, compared with the prior art, the present invention discloses a data sorting method based on homomorphic encryption, in which the entire comparison and sorting process is performed in the encrypted domain, thereby protecting the privacy of the original data; a comparison-level representation vector is constructed using polynomials to represent the association between ciphertext and the ciphertext sequence, and matrix operations are combined to accurately obtain the sorting result, thereby avoiding the errors caused by approximate calculations and greatly reducing the complexity of the calculations; symbolic functions and batch processing technology are used to efficiently process multiple comparison operations. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0040] Figure 1 A schematic diagram of a data sorting method based on homomorphic encryption provided by the present invention. DETAILED DESCRIPTION

[0041] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0042] like Figure 1 , an embodiment of the present invention discloses a data sorting method based on homomorphic encryption, comprising the following steps:

[0043] S1: Get the initial ciphertext sequence under fully homomorphic encryption.

[0044] S2: Compare each ciphertext element in the ciphertext sequence by a preset sign function to obtain an encryption comparison level vector of each ciphertext element; wherein the encryption comparison level vector is composed of encryption comparison levels corresponding to each ciphertext element.

[0045] S3: Setting different mapping functions to map the encrypted comparative level vector, taking the comparative level sequences before and after the mapping as coefficients, respectively, constructing a polynomial combination in combination with the corresponding ciphertext elements, and calculating the values ​​of each polynomial to obtain a comparative level representation vector.

[0046] S4: Set a target comparative level vector, and calculate the ciphertext sequence under the target comparative level vector according to the comparative level eigenvector to obtain the target ciphertext sequence.

[0047] The present invention constructs a comparative level representation vector that represents the corresponding combination relationship between the comparative level and the ciphertext element by extracting the comparative level information of the initial ciphertext sequence and each ciphertext element; and based on the comparative level representation vector, the corresponding ciphertext element sorting result under any target sorting is realized, thereby completing the sorting under homomorphic encryption.

[0048] Next, we will introduce each of the above steps in detail:

[0049] For S1, the user performs homomorphic encryption on the plaintext sequence to obtain the corresponding ciphertext sequence. Specifically, the user gives the plaintext sequence to be compared and needs to sort them; the encryption operation is performed directly on the above plaintext sequence; the user calls the key generation algorithm to generate the private key sk and the public key pk; the Enc method is called, and the user uses the public key pk to perform fully homomorphic encryption on the plaintext sequence that needs to be compared and calculated homomorphically, and the obtained ciphertext sequence C{X1,X2,……,X n}.

[0050] For S2, with the help of the sign function, the size of each ciphertext element in the ciphertext state is compared and the final comparison level is confirmed. In the process of comparison, the initial ciphertext sequence can be shifted or filled to construct the input data; since the essence of the sign function is to compare the size of two elements, two vectors can be constructed as inputs in the sign function to achieve the size comparison of the corresponding elements; by adjusting the order of the elements in the two vectors to construct all the corresponding relationships, the comparison results are obtained; finally, in order to output the comparison level, the comparison results are accumulated and summarized to obtain the comparison level of each ciphertext element.

[0051] For ease of understanding, an example is given with an initial ciphertext sequence of 4 elements:

[0052] The four elements of the ciphertext sequence C are {X1,X2,X3,X4}.

[0053] Set the symbolic function:

[0054]

[0055] Among them, X i and X j represents the two ciphertext elements to be compared in the initial ciphertext sequence, a is the comparison result of the sign function, and the result obtained in this patent is the encrypted result.

[0056] First, perform two right shifts based on the initial ciphertext sequence. Considering that the ciphertext length is 4 elements, each shift length is 4 bits, and the result of two shifts is obtained:

[0057] First shift: {0,0,0,0,X1,X2,X3,X4}

[0058] Second shift: {0,0,0,0,0,0,0,0,X1,X2,X3,X4}

[0059] Then, the initial ciphertext sequence and the results of the two shifts are added to obtain the first reference sequence P1:

[0060] P1={X1,X2,X3,X4,X1,X2,X3,X4,X1,X2,X3,X4}

[0061] Next, create a second reference sequence:

[0062] Perform three left cyclic shifts based on the initial ciphertext sequence to obtain the result of three shifts;

[0063] The first shift gives H1: {X2,X3,X4,X1}

[0064] The second shift gives H2: {X3,X4,X1,X2}

[0065] The third shift gives H3: {X4,X1,X2,X3}

[0066] Then, by shift splicing, the second reference sequence P2 is run:

[0067] P2={X2,X3,X4,X1X3,X4,X1,X2X4,X1,X2,X3}

[0068] The first reference sequence and the second reference sequence constitute a reference sequence pair, which is input into the sign function to achieve element-by-element comparison and obtain a comparison result.

[0069] Exemplarily, the comparison result is {0, 1, 0, 1, 1, 0, 0, 1, 0, 1, 0, 1}, which can reflect the size comparison of any two ciphertext elements. In order to further obtain the comparison level of each element, the result sequence is shifted left 4 times twice, and added to the two shift results to obtain the final sequence {1, 2, 0, 3, 1, 2, 0, 3, 1, 2, 0, 3}, and the first 4 bits are taken to obtain the comparison level result. For the convenience of calculation, the comparison level result can be added by 1 element by element to remove the 0 element, and the final comparison level result is {2, 3, 1, 4}, which means that the 4th element of the sequence is the largest and the 3rd element is the smallest. However, it should be noted that the comparison level is in the ciphertext state and cannot be directly used for sorting.

[0070] In this embodiment, the complex size relationship is simplified into an integer value by using comparison levels, which greatly simplifies the subsequent processing steps while retaining the relative size between elements and the relative position in the entire sequence; in the context of homomorphic encryption, frequent operations may cause ciphertext expansion, and the use of comparison levels can compress a large amount of comparison information into smaller integers, controlling the growth of numerical values. This method ensures the accuracy of the results.

[0071] For S3, in order to achieve the ciphertext sorting under the target order, it is necessary to construct the relationship characteristics between the comparative degree and the ciphertext, that is, different comparative degrees should have different characteristic values. Therefore, this embodiment needs to construct a comparative degree representation vector to represent the ciphertext characteristics under a specific comparative degree. Similarly, for ease of understanding, the above-mentioned 4-element ciphertext example is used for further explanation. Specifically including:

[0072] From the previous steps, we can get the comparative degree as {2, 3, 1, 4}. First, we use the power function to map the comparative degree vector to obtain multiple mapped comparative degree vectors: {2, 3, 1, 4}, {2 2 , 3 2 , 1 2 , 42},{2 3 , 3 3 , 1 3 , 4 3},{2 4 , 3 4 , 1 4 , 4 4}, taking the obtained comparative vector as the coefficient, and combining the ciphertext elements to construct the polynomial group as follows:

[0073] 2X1+3X2+1X3+4X4=Y1

[0074] 2 2 X1+3 2 X2+1 2 X3+4 2 X4=Y2

[0075] 2 3 X1+3 3 X2+1 3 X3+4 3 X4=Y3

[0076] 2 4 X1+3 4 X2+1 4 X3+4 4 X4=Y4

[0077] The comparative level representation vector is {Y1, Y2, Y3, Y4}. This vector can represent the initial ciphertext sequence when the comparative level is {2, 3, 1, 4}.

[0078] Furthermore, in order to calculate the specific value of the polynomial, a one-dimensional array is used to represent a two-dimensional array. The specific process is as follows:

[0079] Comparison array:

[0080]

[0081]

[0082] Ciphertext array:

[0083] <![CDATA[X1]]> <![CDATA[X2]]> <![CDATA[X3]]> <![CDATA[X4]]> <![CDATA[X1]]> <![CDATA[X2]]> <![CDATA[X3]]> <![CDATA[X4]]> <![CDATA[X1]]> <![CDATA[X2]]> <![CDATA[X3]]> <![CDATA[X4]]> <![CDATA[X1]]> <![CDATA[X2]]> <![CDATA[X3]]> <![CDATA[X4]]> <![CDATA[X1]]> <![CDATA[X2]]> <![CDATA[X3]]> <![CDATA[X4]]> <![CDATA[X1]]> <![CDATA[X2]]> <![CDATA[X3]]> <![CDATA[X4]]> <![CDATA[X1]]> <![CDATA[X2]]> <![CDATA[X3]]> <![CDATA[X4]]> <![CDATA[X1]]> <![CDATA[X2]]> <![CDATA[X3]]> <![CDATA[X4]]>

[0084] Multiply two arrays positionally to get an array:

[0085] <![CDATA[X12]]> <![CDATA[X23]]> <![CDATA[X31]]> <![CDATA[X44]]> <![CDATA[X12]]> <![CDATA[X23]]> <![CDATA[X31]]> <![CDATA[X44]]> <![CDATA[X12 2 ]]> <![CDATA[X23 2 ]]> <![CDATA[X31]]> <![CDATA[X44 2 ]]> <![CDATA[X12 2 ]]> <![CDATA[X23 2 ]]> <![CDATA[X31]]> <![CDATA[X44 2 ]]> <![CDATA[X12 3 ]]> <![CDATA[X23 3 ]]> <![CDATA[X31]]> <![CDATA[X44 3 ]]> <![CDATA[X12 3 ]]> <![CDATA[X23 3 ]]> <![CDATA[X31]]> <![CDATA[X44 3 ]]> <![CDATA[X12 4 ]]> <![CDATA[X23 4 ]]> <![CDATA[X31]]> <![CDATA[X44 4 ]]> <![CDATA[X12 4 ]]> <![CDATA[X23 4 ]]> <![CDATA[X31]]> <![CDATA[X44 4 ]]>

[0086] Calculate Y1, Y2, Y3, Y4:

[0087] First, shift the array right by 1 position:

[0088] <![CDATA[X23]]> <![CDATA[X31]]> <![CDATA[X44]]> <![CDATA[X12]]> <![CDATA[X23]]> <![CDATA[X31]]> <![CDATA[X44]]> <![CDATA[X12 2 ]]> <![CDATA[X23 2 ]]> <![CDATA[X31]]> <![CDATA[X44 2 ]]> <![CDATA[X12 2 ]]> <![CDATA[X23 2 ]]> <![CDATA[X31]]> <![CDATA[X44 2 ]]> <![CDATA[X12 3 ]]> <![CDATA[X23 3 ]]> <![CDATA[X31]]> <![CDATA[X44 3 ]]> <![CDATA[X12 3 ]]> <![CDATA[X23 3 ]]> <![CDATA[X31]]> <![CDATA[X44 3 ]]> <![CDATA[X12 4 ]]> <![CDATA[X23 4 ]]> <![CDATA[X31]]> <![CDATA[X44 4 ]]> <![CDATA[X12 4 ]]> <![CDATA[X23 4 ]]> <![CDATA[X31]]> <![CDATA[X44 4 ]]> 0

[0089] The bitwise addition of the two arrays yields:

[0090]

[0091] After getting the array, shift right two places to get:

[0092]

[0093] Adding the above two arrays together, we get:

[0094]

[0095]

[0096] In this way, we can get the values ​​of Y1, Y2, Y3, and Y4.

[0097] In this embodiment, a method of using a one-dimensional array to represent a two-dimensional array is used to calculate the value of the polynomial. First, because the memory access mode of a one-dimensional array is simpler than that of a two-dimensional array, the memory access efficiency is improved and it is easier to process; secondly, in the context of homomorphic encryption, complex index calculations will bring greater computational overhead, and it is simpler to use a one-dimensional array for indexing. The above method effectively improves performance while keeping the algorithm logic clear, and makes the algorithm easier to implement and optimize in special environments such as homomorphic encryption.

[0098] For S4, the principle adopted by S4 is to take the expected plaintext sorting result as a matrix and multiply it with an unknown number of a column vector. The result of multiplying each row with the unknown number sequence is the value of a polynomial obtained by S3 about the ciphertext sequence and the corresponding comparison level.

[0099] For example, if the desired plaintext sorting result is an ascending order, that is, the target comparison level should be {1, 2, 3, 4}, then the target matrix A can be obtained as:

[0100]

[0101] After obtaining the target matrix and the comparative representation vector in S3, the product of the inverse matrix of the target matrix and the comparative standard vector is calculated to obtain the final target ciphertext sequence C F .

[0102]

[0103] In this embodiment, the sorting problem is transformed into a linear algebra problem by converting it into matrix operations. In the context of homomorphic encryption, linear algebra operations are usually easier to implement and optimize than direct sorting algorithms. Secondly, matrix operations can provide precise mathematical solutions, avoiding errors that may be caused by approximate algorithms and ensuring the accuracy of the sorting.

[0104] In another embodiment, other nonlinear mapping functions, such as exponential functions, may be selected. Similarly, multiple mapping methods may be selected to respectively construct the same comparative representation vector.

[0105] In order to further implement the above technical solution, step S5 is also included: decrypting the sorted ciphertext sequence, and the obtained plaintext is the sorting result. The specific steps are as follows: after obtaining X3, X1, X2, and X4, the user decrypts with the private key sk, and obtains the decrypted plaintext sequence, which is the result of decryption after the ciphertext is sorted.

[0106] The data sorting method of the present invention is suitable for the following scenarios:

[0107] Healthcare: Sort and analyze encrypted medical data while protecting patient privacy, such as disease severity ranking, treatment effect comparison, etc. Cloud computing services: Provide cloud service providers with a secure data processing method, allowing customers to safely store and process sensitive data in the cloud. Big data analysis: Sort and compare large-scale encrypted data without leaking the original data. Electronic voting system: Count and sort encrypted voting data while protecting voter privacy. Genomics research: Compare and sort large amounts of genetic data while protecting the privacy of personal genetic information. Education: Sort and analyze encrypted performance data while protecting student privacy. Internet of Things (IoT): Sort and analyze encrypted data from multiple IoT devices while protecting device and user privacy.

[0108] In the above scenario, the data provider can encrypt the plaintext data and upload it to the computing system. The computing system can sort the data in an encrypted environment and return the sorting structure to the provider. The provider obtains the plaintext sorting result by decryption. During the whole process, the computing system, as an untrusted party, cannot obtain the specific plaintext data, which protects the privacy of the data.

[0109] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0110] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A data sorting method based on homomorphic encryption, characterized in that: The following steps are involved: Get the initial ciphertext sequence under fully homomorphic encryption; Comparing each ciphertext element in the ciphertext sequence by a preset sign function to obtain an encryption comparison level vector of each ciphertext element, wherein the encryption comparison level vector is composed of encryption comparison levels corresponding to each ciphertext element; Setting different mapping functions to map the encrypted comparative vector, generating a plurality of mapped comparative vectors accordingly, taking the comparative sequences before and after the mapping as coefficients respectively, constructing a polynomial combination in combination with the corresponding ciphertext elements, and calculating the values ​​of each polynomial to obtain a comparative representation vector; A target comparative level vector is set, and a ciphertext sequence under the target comparative level vector is calculated according to the comparative level representation vector to obtain a target ciphertext sequence.

2. According to a data sorting method based on homomorphic encryption according to claim 1, it is characterized in that: The encrypted comparative level vector is obtained by batch processing, including: Obtain the number x of elements in the initial ciphertext sequence; Shifting and padding the initial ciphertext sequence according to the number of elements x to construct a reference sequence pair, wherein any two elements in the reference sequence pair have a corresponding relationship; Input the reference sequence pairs into the pre-built symbolic function to obtain the comparison results of each corresponding relationship; Accumulation is performed according to the comparison results to obtain the comparison level corresponding to each element.

3. According to a data sorting method based on homomorphic encryption according to claim 1, it is characterized in that: The mapping function is a nonlinear function.

4. A data sorting method based on homomorphic encryption according to claim 1 or 3, characterized in that: According to the number x of the ciphertext elements, x-1 mapping functions are set accordingly to perform x-1 mappings, and corresponding x polynomials are constructed. The number of the polynomials is the same as the number of the ciphertext elements.

5. According to a data sorting method based on homomorphic encryption according to claim 1, it is characterized in that: The steps of constructing the comparative representation vector include: Get the encrypted comparison vector [a1, a2, a3, a4, ...a n ], where a1, a2, a3, a4, a n are the comparative ciphertexts of the corresponding ciphertext elements, indicating the data size of the ciphertext elements, and n is the number of ciphertext elements; The encrypted comparative level vector is nonlinearly mapped by a power function to obtain a mapped comparative level vector. Construct a polynomial based on the comparison vectors before and after the mapping: a1X1+a2X2+a3X3+a4X4+...+a n X n =Y1 Among them, X1, X2, X3, X4, X n is the corresponding ciphertext element in the initial ciphertext sequence; The comparative standard vector is obtained as [Y1, Y2].

6. A data sorting method based on homomorphic encryption according to claim 5, characterized in that: The step of calculating the ciphertext sequence under the target comparative level vector according to the comparative level representation vector specifically includes: Mapping the target comparative vector through the mapping function to construct a target matrix; the target matrix is ​​composed of the target comparative vector and the target comparative vector under the mapping function; The target ciphertext sequence is the product of the inverse matrix of the target matrix and the comparative standard vector.

7. A data sorting method based on homomorphic encryption according to claim 1, characterized in that: The step also includes: decrypting the target ciphertext sequence using a private key.

8. A data sorting method based on homomorphic encryption according to claim 1 or 7, characterized in that: The obtaining of the initial ciphertext sequence under fully homomorphic encryption specifically includes: Get the plaintext to be compared, call the key generation algorithm, and generate the private key and public key; The encryption algorithm is called and the plaintext sequence is fully homomorphically encrypted using the public key to obtain a ciphertext sequence.

9. A data sorting method based on homomorphic encryption according to claim 1, characterized in that: The symbolic function is: Among them, X i and X j represents two ciphertext elements to be compared in the initial ciphertext sequence, and a is the comparison result.

Images