Privacy protection method, device and system based on cross relinearization

Abstract

The invention discloses a privacy protection method, device and system based on cross relinearization, and belongs to the technical field of privacy protection. The method comprises the following steps: a calculation executor negotiates homomorphic encryption parameters with a data holder; the calculation executor obtains a ciphertext ct1, a ciphertext ct2, a cross relinearization key and a rank descent key sent by the data holder; the calculation executor calculates a Kronecker product between the ciphertext ct1 and the ciphertext ct2; the calculation executor combines the cross relinearization key and the rank descent key to execute cross relinearization operation, rank descent operation and homomorphic addition operation on the Kronecker product; and after the calculation execution party executes a re-scaling operation on the homomorphic addition result ct ', transmitting a re-scaling result ct' 'to the data holding party, so that the data holding party obtains the Hadamard product of the complex vector # imgabs0 # and the complex vector # imgabs1 # based on the re-scaling result ct ''. According to the method, the calculation executor cannot obtain the Hadamard product between the complex vectors, and the calculation efficiency of the Hadamard product is also improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of privacy protection, and in particular relates to a privacy protection method, device and system based on cross-relinearization. Background Art

[0002] With the introduction of the National Data Security Law, cloud computing service providers will face an increasing demand for privacy protection when processing user sensitive data. Fully homomorphic encryption is one of the powerful tools to solve this problem. It allows service providers to perform calculations on users' encrypted data, thereby protecting users' privacy security throughout the entire chain of data transmission. However, current fully homomorphic encryption algorithms often consume a lot of computing resources and time, which greatly limits the practicality of homomorphic encryption. At present, fully homomorphic encryption is mainly divided into two technical routes: fully homomorphic encryption based on arithmetic circuits (such as BGV, CKKS) and fully homomorphic encryption based on Boolean circuits (such as TFHE, FHEW). The former has powerful SIMD features that can greatly improve the throughput of calculations, while the latter can support more flexible function evaluation and faster bootstrapping operations. For tasks with high parallel requirements such as privacy-preserving machine learning, homomorphic encryption based on arithmetic circuits is a more common choice.

[0003] In order to address the performance issues of fully homomorphic encryption, many implementations have begun to use special hardware such as GPUs, FPGAs, etc. As a hardware device widely used for AI acceleration, GPUs provide significant acceleration effects for traditional cryptographic algorithms such as RSA and ECC, with performance that is more than 1,000 times that of CPU platforms. However, in the field of fully homomorphic encryption, this performance improvement is not obvious, and in some recent works, there is only about a 200-fold performance improvement. GPUs provide considerable on-chip memory, and each stream processor typically contains 64,000 32-bit registers and 48-228kB of shared memory, but fully homomorphic encryption algorithms often find it difficult to fully utilize the parallel capabilities of GPUs. For example, the CKKS algorithm based on the RLWE difficulty problem requires the use of large-scale polynomial operations, and the degree of these polynomials is often as high as 2 15 or 2 16 Such large-scale calculations need to rely on low-speed global memory, which is mainly due to the large amount of cross-thread collaboration in the calculation.

[0004] Although most current homomorphic encryption algorithms rely on the RLWE problem, more and more research is turning to fully homomorphic encryption algorithms built using the MLWE problem. Compared with RLWE, the MLWE-based homomorphic encryption algorithm has better hardware-friendly features while improving security. It allows us to adjust security by rank without changing the degree of polynomials in the difficult problem to adapt the homomorphic encryption parameters required for the current task. However, MLWE-based fully homomorphic encryption has an unacceptable computational complexity. Taking homomorphic multiplication as an example, when the rank used by MLWE is 2, the MLWE-based scheme has a 1.7-fold performance loss compared to the RLWE-based scheme at the same circuit depth, and this performance loss will be further exacerbated as the rank increases. In addition, the MLWE-based scheme also has a larger key size. Summary of the invention

[0005] In view of the above problems, the present invention provides a privacy protection method, device and system based on cross-relinearization. This method not only prevents the calculation executor from obtaining the Hadamard product between complex vectors, but also improves the calculation efficiency of the Hadamard product.

[0006] To achieve the above-mentioned object of the invention, the technical solution of the present invention includes the following contents.

[0007] A privacy protection method based on cross-relinearization is applied to a computing execution method, the method comprising:

[0008] Negotiate homomorphic encryption parameters with the data holder, including: polynomial degree n, rank r, approximate scaling factor Δ, maximum number of multiplication layers L and corresponding ciphertext modulus Q L ;

[0009] Obtain the ciphertext ct1, ciphertext ct2, cross-relinearization key and rank reduction key sent by the data holder; wherein the ciphertext ct1 and the ciphertext ct2 are respectively based on the complex vector and complex vector generate;

[0010] Calculate the Kronecker product between the ciphertext ct1 and the ciphertext ct2 where c0 is the first polynomial in the Kronecker product ct, is a polynomial vector consisting of r polynomials following the polynomial c0, It is composed of vector The following polynomial vector consists of r(r+1) / 2 polynomials;

[0011] The polynomial vector is obtained based on the cross-relinearization key and the rank reduction key. Perform the cross relinearization operation and rank reduction operation in sequence to obtain the cross relinearization result Sum rank reduction results And for polynomial vector pairs Cross-relinearization results Sum rank reduction results Perform homomorphic addition;

[0012] After performing a rescaling operation on the homomorphic addition result ct′, the rescaling result ct″ is transmitted to the data holder, so that the data holder obtains the complex vector that cannot be obtained by the calculation execution method based on the rescaling result ct″. and complex vector The Hadamard product.

[0013] Furthermore, the ciphertext ct1 and the ciphertext ct2 are respectively based on the complex vector and complex vector Generate, including:

[0014] The data holder generates a public-private key pair

[0015] The complex vector and the complex vector Encoded as polynomial m1(X) and polynomial m2(X) respectively, so that Among them, the encoding map Ecd: Mapping function τ: Mapping maps the polynomial m(X) to a complex vector represents the complex domain, represents the field of real numbers;

[0016] Use the public key pk to encrypt the polynomial m1(X) and the polynomial m2(X) respectively to obtain the ciphertext ct1 and the ciphertext ct2.

[0017] Furthermore, the process of generating the cross-relinearization key includes:

[0018] Introducing a temporary special modulus Defines the gadget vector used by the cross-relinearization key Among them, K is a positive integer constant, p i is a relatively prime small modulus, a special modulus k is a positive integer constant, μ is a small constant, and and For 0≤j<μ,q i is the RNS basis that constitutes the ciphertext modulus;

[0019] Introducing temporary order And generate a temporary private key vector in, is a polynomial ring with integer coefficients On the Cyclotomic Polynomial X n +1 quotient ring;

[0020] From the matrix space Sampling from a uniform distribution in Sample a noise vector from the noise distribution For 0≤j<μ;

[0021] Output cross relinearization key crlk = {crlk j} 0≤j<μ ; Among them, the jth component

[0022] Furthermore, the process of generating the rank-down key includes:

[0023] Define the gadget vector used by the rank reduction key in α is a small constant, and and For 0≤j′ <d;

[0024] From the matrix space Sampling from a uniform distribution in Sample a noise vector from a noise distribution For 0≤j′ <d;

[0025] Output rank reduction key rdk = {rdk j′} 0≤j′<d ; Among them, the j′th component

[0026] Further, based on the cross-relinearization key and the rank reduction key, the polynomial vector Perform the cross relinearization operation and rank reduction operation in sequence to obtain the cross relinearization result Sum rank reduction results include:

[0027] For polynomial vectors Perform the inverse transformation of the number theory transformation to obtain the polynomial vector

[0028] For polynomial vectors Perform gadget decomposition to obtain a polynomial in 0≤i<μ;

[0029] For polynomial C μ Perform number theory transformation to obtain the polynomial

[0030] Compute the cross-relinearization key with the polynomial The inner product of the form

[0031] Inner product of form Perform the inverse transformation of the number theory transformation to obtain the polynomial

[0032] For polynomial Calculate the modulus reduction to get the polynomial vector in, is a polynomial vector The first polynomial in , is the polynomial vector After A polynomial vector consisting of polynomials;

[0033] Evaluate polynomial vectors The NTT transformation from the 0th polynomial to the rth polynomial in the cross-relinearization result is obtained.

[0034] Evaluating Polynomials From r+1 to r The gadget decomposition of the polynomial is obtained Among them, the polynomial C d The i-th polynomial in For 0≤i <d;

[0035] For polynomial C d Perform number theory transformation to obtain the polynomial

[0036] Compute the rank-reduction key with the polynomial The inner product of the form

[0037] Inner product of form The inverse of the number-theoretic transformation yields the polynomial

[0038] For polynomials Calculate the modulus drop and get the polynomial

[0039] For polynomial Perform number theory transformation to obtain the rank reduction result

[0040] Further, the data holder obtains the complex vector based on the rescaling result ct″ and complex vector The Hadamard product includes:

[0041] Utilizing private keys Decrypt the rescaled result ct″ to obtain the plaintext m′(X);

[0042] The plaintext m′(X) is decoded based on the approximate scaling factor Δ and the mapping function τ to obtain the complex vector and complex vector The Hadamard product.

[0043] Furthermore, after negotiating homomorphic encryption parameters with the data holder, it also includes:

[0044] Get the security strength λ corresponding to the homomorphic encryption parameter;

[0045] Determine whether the security strength λ is greater than a set threshold;

[0046] When the security strength λ is less than the set threshold, returning to the step of negotiating homomorphic encryption parameters with the data holder to negotiate new homomorphic encryption parameters;

[0047] When the security strength λ is greater than a set threshold, the process jumps to obtaining the ciphertext ct1, ciphertext ct2, cross-relinearization key and rank reduction key sent by the data holder.

[0048] A privacy protection device based on cross-reproducibility, the device comprising:

[0049] Negotiation module, used to negotiate homomorphic encryption parameters with the data holder, the homomorphic encryption parameters include: polynomial degree n, rank r, approximate scaling factor Δ and maximum number of multiplication layers L and corresponding ciphertext modulus Q L ;

[0050] The acquisition module is used to obtain the ciphertext ct1, ciphertext ct2, cross-relinearization key and rank reduction key sent by the data holder; wherein the ciphertext ct1 and the ciphertext ct2 are respectively based on the complex vector and complex vector generate;

[0051] The first calculation module is used to calculate the Kronecker product between the ciphertext ct1 and the ciphertext ct2 where c0 is the first polynomial in the Kronecker product ct, is a polynomial vector consisting of r polynomials following the polynomial c0, It is composed of vector The following polynomial vector consists of r(r+1) / 2 polynomials;

[0052] The second computing module is used to calculate the polynomial vector based on the cross relinearization key and the rank reduction key. Perform the cross relinearization operation and rank reduction operation in sequence to obtain the cross relinearization result Sum rank reduction results And for polynomial vector pairs Cross-relinearization results Sum rank reduction results Perform homomorphic addition;

[0053] The third computing module is used to perform a rescaling operation on the homomorphic addition result ct′ and transmit the rescaling result ct″ to the data holder, so that the data holder can obtain the complex vector that the computing execution party cannot obtain based on the rescaling result ct″. and complex vector The Hadamard product.

[0054] A privacy protection system based on cross-reproducibility, the system comprising a computing execution party and at least one data holder;

[0055] The calculation execution party is used to:

[0056] Negotiate homomorphic encryption parameters with the data holder, including: polynomial degree n, rank r, approximate scaling factor Δ, maximum number of multiplication layers L and corresponding ciphertext modulus Q L ;

[0057] Obtain the ciphertext ct1, ciphertext ct2, cross-relinearization key and rank reduction key sent by the data holder; wherein the ciphertext ct1 and the ciphertext ct2 are respectively based on the complex vector and complex vector generate;

[0058] Calculate the Kronecker product between the ciphertext ct1 and the ciphertext ct2 where c0 is the first polynomial in the Kronecker product ct, is a polynomial vector consisting of r polynomials following the polynomial c0, It is composed of vector The following polynomial vector consists of r(r+1) / 2 polynomials;

[0059] The polynomial vector is obtained based on the cross-relinearization key and the rank reduction key. Perform the cross relinearization operation and rank reduction operation in sequence to obtain the cross relinearization result Sum rank reduction results And for the polynomial c0, polynomial vector Cross-relinearization results Sum rank reduction results Perform homomorphic addition; after performing a rescaling operation on the homomorphic addition result ct′, transmit the rescaling result ct″ to the data holder;

[0060] The data holder is used to:

[0061] Negotiate homomorphic encryption parameters with the data holder, including: polynomial degree n (power of 2), rank r, approximate scaling factor Δ, maximum number of multiplication layers L and corresponding ciphertext modulus Q L ;

[0062] Generate cross-relinearization keys and rank reduction keys;

[0063] Based on complex vector and complex vector Generate ciphertext ct1 and ciphertext ct2;

[0064] Send the ciphertext ct1, ciphertext ct2, cross-relinearization key and rank reduction key to the calculation executor;

[0065] Based on the rescaling result ct″ returned by the calculation execution party, the complex vector that the calculation execution party cannot obtain is obtained and complex vector The Hadamard product.

[0066] An electronic device comprises: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, the privacy protection method based on cross-reproducibility as described above is implemented.

[0067] Compared with the prior art, the present invention introduces homomorphic rank transformation in MLWE-based fully homomorphic encryption for the first time, providing better performance for hardware-based fully homomorphic encryption, thereby making it impossible for the calculation executor to obtain the Hadamard product between complex vectors. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 This is a flow chart of the privacy protection method based on cross-relinearization of the present invention.

[0069] Figure 2 A block diagram of the homomorphic multiplication operation using cross-relinearization of the present invention. DETAILED DESCRIPTION

[0070] Next, in combination with the accompanying drawings in the embodiments of the present invention, a more comprehensive and complete analysis and expression of the technical solutions in the embodiments of the present invention will be carried out. Obviously, the described embodiments are only a part of the embodiments of the present invention. For further explanation of the present invention, so that those skilled in the art can clearly and thoroughly understand the present invention, it is not used to limit the present invention.

[0071] The privacy protection method based on cross-linearization of the present invention is implemented in fully homomorphic encryption based on MLWE. The generalized MLWE key conversion technology aims to convert a polynomial vector encrypted with a private key into an MLWE ciphertext ct encrypted with a private key where r1 and r2 are positive integers. This technology relies on a pre-generated evaluation key swk. First, define the gadget vector as g=(g0,…,g d-1 ), where and q i is the RNS basis that makes up the ciphertext modulus. For 0≤j<d, d is called the decomposition size. This key is generated as follows: Given the private keys and sample a matrix A′ from the uniform distribution of the matrix space and sample a vector from the noise distribution. Output swk={swk j}, where the j-th component is 0≤j<d , where the j-th component is

[0072]

[0073] On the premise of publicly disclosing the above evaluation key, given an encrypted vector This key conversion algorithm performs the following steps:

[0074] · Calculate the gadget decomposition: where

[0075] · Calculate the inner product:

[0076] · Modulus reduction: ct=[P -1 ·ct up .

[0077] The ciphertext output by this algorithm satisfies For the convenience of the following description, denote this key conversion algorithm as

[0078] The above related definitions also include: For positive integer powers n of 2, define the polynomial ring Modular quotient ring definition The module with upper rank r is No. Ciphertext modulus of the layer where q j Two by two, is the number of layers of the current homomorphic ciphertext, L is the maximum number of evaluable layers, 0≤l≤L. Special modulus where p i are mutually prime, and with any q j are mutually prime, k is a positive integer constant. A MLWE ciphertext of rank r has the form

[0079] In one embodiment, two complex vectors are calculated with privacy Approximate value of the Hadamard product is the calculation target, where Represents the set of all complex vectors of length n / 2. The data holder does not want the computation executor to know the input and output of the computation. Figure 1 This is a flow chart of the privacy protection method based on cross-relinearization of this embodiment, including the following steps 1 to 5.

[0080] Step 1: The computation executor and the data holder negotiate homomorphic encryption parameters.

[0081] The data holder and the computation executor negotiate a set of homomorphic encryption parameters, including the polynomial number n, rank r, maximum number of multiplication layers L, and maximum ciphertext modulus Q. L =∏ 0≤j≤L q j , approximate scaling factor Δ. Where q j is the RNS basis that constitutes the ciphertext modulus.

[0082] In a preferred embodiment, the present invention also obtains the security strength λ corresponding to the above-mentioned homomorphic encryption parameters, and determines whether the security strength λ is greater than a set threshold: when the security strength λ is less than the set threshold, returns to the step of negotiating the homomorphic encryption parameters with the data holder to negotiate new homomorphic encryption parameters; when the security strength λ is greater than the set threshold, jumps to the step of obtaining the ciphertext ct1, ciphertext ct2, cross-relinearization key and rank reduction key sent by the data holder.

[0083] Step 2: The computation executor obtains the ciphertext ct1, ciphertext ct2, cross-relinearization key, and rank reduction key sent by the data holder.

[0084] (1) Generation of ciphertext ct1 and ciphertext ct2.

[0085] The ciphertext ct1 and ciphertext ct2 of the present invention are based on the complex vector and complex vector The main steps include:

[0086] Step 2.1.1: Generate encryption keys.

[0087] The data holder generates an encrypted private key And use this to calculate the public key for encryption and decryption

[0088]

[0089] in, Indicates r in the business ring The vector set consisting of the elements on , Represents modulo Q L The business ring, Indicates r×r in the business ring The polynomial matrix A is uniformly sampled on the quotient ring. Noise Vector Sampled from a noise distribution.

[0090] Step 2.1.2: Convert the complex vector and complex vector The encoding is respectively encoded as a polynomial and polynomial

[0091] The present invention encodes two complex vectors into polynomials respectively, so that

[0092]

[0093] Here the encoding is mapped to Ecd: Where τ: Mapping maps the polynomial m(X) to By evaluating m(X) in The values ​​of these points, ξ, are primitive roots of order 2n. Here, two vectors are encoded as m1(X) and m2(X).

[0094] Step 2.1.3: Use the encryption key to polynomial and polynomial Encryption is performed.

[0095] The data holder calculates the public key encryption of two plaintext polynomials. With the noise vector Calculate the encryption of plaintext m(X): noise vector Sampled self-noise distribution

[0096]

[0097] Here, two plaintexts are encrypted into ciphertexts respectively. and ciphertext Among them, b is the first polynomial in the ciphertext ct, is the polynomial vector composed of the last r polynomials in the ciphertext ct.

[0098] (2) Generation of cross-relinearization keys and rank reduction keys.

[0099] The present invention uses two key conversion techniques to implement the relinearization algorithm. In the first key conversion algorithm, a low-cost key conversion algorithm is used to increase the rank of the ciphertext, and the rank is restored in the second key conversion algorithm. For this purpose, the algorithm needs to generate two evaluation keys in advance: a cross relinearization key crlk and a rank reduction key rdk.

[0100] For the cross-reproducibility key, the key is designed to relinearize the ciphertext while obtaining a ciphertext with a higher rank. The gadget vector used by the key is defined as where μ is a small constant. In addition, a temporary special modulus is introduced Where K is a positive integer constant, p i is a small modulus that is relatively prime. In order to keep the key within the modulus Under the security, use a temporary order At the same time, the private key generation function generates a temporary private key vector Given the original private key With temporary private key vector The cross-relinearization key is generated as follows: Sampling from a uniform distribution in Sampling from a noise distribution Output crlk = {crlk j} 0≤j<μ , where the jth component is

[0101]

[0102] For the rank-reduced key, the key uses the original gadget vector and a special modulus P, generated by: Sampling from a uniform distribution in Sampling from a noise distribution Output rdk = {rdk j} 0≤j<d ,in

[0103]

[0104] Given the two keys above, we can use the following steps to implement the MLWE ciphertext The relinearization operation is:

[0105] ·calculate:

[0106] ·calculate:

[0107] Output:

[0108] The ciphertext output by the algorithm satisfy

[0109] Step 3: The calculation execution party calculates the Kronecker product between the ciphertext ct1 and the ciphertext ct2.

[0110] Kronecker product between ciphertext ct1 and ciphertext ct2 It consists of three parts. c0 is the first polynomial in the Kronecker product ct, is a polynomial vector consisting of r polynomials following the polynomial c0, It is composed of vector The following polynomial vector consists of r(r+1) / 2 polynomials.

[0111] Step 4: The computation executor combines the cross-relinearization key with the rank reduction key, and performs a cross-relinearization operation, a rank reduction operation, and a homomorphic addition operation on the ciphertext obtained by the Kronecker product to achieve relinearization of the ciphertext.

[0112] The present invention is based on the cross relinearization key and the rank reduction key pair polynomial vector Perform the cross relinearization operation and rank reduction operation in sequence to obtain the cross relinearization result Sum rank reduction results And for polynomial vector pairs Cross-relinearization results Sum rank reduction results Perform homomorphic addition.

[0113] like Figure 2 As shown, the overall homomorphic addition process of the present invention includes the following steps 4.1 to 4.3.

[0114] Step 4.1: Compute the cross-relinearization.

[0115] The calculation process of cross-relinearization mainly includes the following steps 4.1.1 to 4.1.7.

[0116] Step 4.1.1: For the polynomial vector Perform the inverse transformation of the number theory transformation to obtain the polynomial vector

[0117] Step 4.1.2: For the polynomial vector Perform gadget decomposition to obtain a polynomial in For 0≤i<μ.

[0118] Step 4.1.3: For the polynomial C μ Perform number theory transformation to obtain the polynomial

[0119] Step 4.1.4: Calculate the cross-relinearization key with the polynomial The inner product of the form

[0120] Step 4.1.5: Inner product of the form Perform the inverse transformation of the number theory transformation to obtain the polynomial

[0121] Step 4.1.6: For the polynomial Calculate the modulus reduction to get the polynomial vector in, is a polynomial vector The first polynomial in , is the polynomial vector After A polynomial vector consisting of polynomials.

[0122] Step 4.1.7: Calculate the polynomial vector The NTT transformation from the 0th polynomial to the rth polynomial in the cross-relinearization result is obtained.

[0123] Step 4.2: Compute rank descent.

[0124] The calculation process of rank reduction mainly includes the following steps 4.2.1 to 4.2.6.

[0125] Step 4.2.1: Evaluate the polynomial From r+1 to r The gadget decomposition of the polynomial is obtained Among them, the polynomial C d The i-th polynomial in For 0≤i <d。

[0126] Step 4.2.2: For the polynomial C d Perform number theory transformation to obtain the polynomial

[0127] Step 4.2.3: Compute the rank reduction key with the polynomial The inner product of the form

[0128] Step 4.2.4: Inner product of the form The inverse transformation of the number theoretic transformation gives the polynomial

[0129] Step 4.2.5: For the polynomial Calculate the modulus drop and get the polynomial

[0130] Step 4.2.6: For the polynomial Perform number theory transformation to obtain rank reduction results

[0131] Step 4.3: The computation executor performs homomorphic addition and returns the ciphertext.

[0132] The computation execution side first computes homomorphic addition and outputs

[0133] Step 5: After the computation execution party performs a rescaling operation on the homomorphic addition result ct′, the rescaling result ct″ is transmitted to the data holder, so that the data holder obtains the complex vector based on the rescaling result ct″ and complex vector The Hadamard product.

[0134] The calculation execution side first calculates the ct′ rescaling result Finally, the ciphertext ct″ is transmitted to the data holder.

[0135] The data holder first calculates the decryption of the ciphertext ct″ and obtains the plaintext Then calculate the decoding of plaintext m′(X) is the desired result, that is, the complex vector and complex vector An approximation of the Hadamard product.

[0136] To verify the present invention, an experimental verification of homomorphic ciphertext multiplication was conducted on NVIDIA RTX4090. 14, rank is 4. The traditional CKKS algorithm based on MLWE takes 31.36ms to calculate, while the algorithm provided by the present invention takes 8.686ms, which has a performance advantage of 3.61 times compared with the traditional operation. This advantage will be further expanded as the rank increases.

[0137] In summary, homomorphic multiplication and its related relinearization algorithm are the performance bottlenecks of the homomorphic encryption algorithm based on MLWE. Using the technology proposed in this invention, the computational time of the relinearization algorithm can be effectively reduced.

[0138] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the present disclosure. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary technical means in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the present disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes may be made without departing from the scope thereof.

Claims

1. A privacy protection method based on cross-relinearization, characterized in that: Applied to a calculation execution method, the method comprising: Negotiate homomorphic encryption parameters with the data holder, including: polynomial degree n, rank r, approximate scaling factor Δ, maximum number of multiplication layers L and corresponding ciphertext modulus Q L ; Obtain the ciphertext ct1, ciphertext ct2, cross-relinearization key and rank reduction key sent by the data holder; wherein the ciphertext ct1 and the ciphertext ct2 are respectively based on the complex vector and complex vector generate; Calculate the Kronecker product between the ciphertext ct1 and the ciphertext ct2 where c0 is the first polynomial in the Kronecker product ct, is a polynomial vector consisting of r polynomials following the polynomial c0, It is composed of vector The following polynomial vector consists of r(r+1) / 2 polynomials; The polynomial vector is obtained based on the cross-relinearization key and the rank reduction key. Perform the cross relinearization operation and rank reduction operation in sequence to obtain the cross relinearization result Sum rank reduction results And for polynomial vector pairs Cross-relinearization results Sum rank reduction results Perform homomorphic addition; After performing a rescaling operation on the homomorphic addition result ct′, the rescaling result ct″ is transmitted to the data holder, so that the data holder obtains the complex vector that cannot be obtained by the calculation execution method based on the rescaling result ct″. and complex vector The Hadamard product.

2. The method according to claim 1, characterized in that The ciphertext ct1 and the ciphertext ct2 are respectively based on complex vectors and complex vector Generate, including: The data holder generates a public-private key pair The complex vector and the complex vector Encoded as polynomial m1(X) and polynomial m2(X) respectively, so that Among them, the encoding mapping Where the specification embeds the mapping Map the polynomial m(X) to a complex vector represents the complex domain, represents the field of real numbers; Use the public key pk to encrypt the polynomial m1(X) and the polynomial m2(X) respectively to obtain the ciphertext ct1 and the ciphertext ct2.

3. The method according to claim 1, characterized in that The process of generating the cross-relinearization key includes: Introducing a temporary special modulus Defines the gadget vector used by the cross-relinearization key Among them, K is a positive integer constant, p i is a relatively prime small modulus, a special modulus k is a positive integer constant, μ is a small constant, and and For 0≤j<μ,q i is the RNS basis that constitutes the ciphertext modulus; Introducing temporary order And generate a temporary private key vector in, is a polynomial ring with integer coefficients On the Cyclotomic Polynomial X n +1 quotient ring; From the matrix space Sampling from a uniform distribution in Sample a noise vector from a noise distribution For 0≤j<μ; Output cross relinearization key crlk = {crlk j } 0≤j<μ ; Among them, the jth component 4. The method according to claim 3, characterized in that The process of generating the rank-down key comprises: Define the gadget vector used by the rank descent key in α is a small constant, and and For 0≤j′ <d; From the matrix space Sampling from a uniform distribution in Sample a noise vector from a noise distribution For 0≤j′ <d; Output rank reduction key rdk = {rdk j′ } 0≤j′<d ; Among them, the j′th component 5. The method according to claim 3, characterized in that: The polynomial vector is obtained based on the cross-relinearization key and the rank reduction key. Perform the cross relinearization operation and rank reduction operation in sequence to obtain the cross relinearization result Sum rank reduction results include: For polynomial vectors Perform the inverse transformation of the number theory transformation to obtain the polynomial vector For polynomial vectors Perform gadget decomposition to obtain a polynomial in For polynomial C μ Perform number theory transformation to obtain the polynomial Compute the cross-relinearization key with the polynomial The inner product of the form Inner product of form Perform the inverse transformation of the number theory transformation to obtain the polynomial For polynomial Calculate the modulus reduction to get the polynomial vector in, is a polynomial vector The first polynomial in , is the polynomial vector After A polynomial vector consisting of polynomials; Evaluate polynomial vectors The NTT transformation from the 0th polynomial to the rth polynomial in the cross-relinearization result is obtained. Evaluating Polynomials From r+1 to r The gadget decomposition of the polynomial is obtained Among them, the polynomial C d The i-th polynomial in For 0≤i <d; For polynomial C d Perform number theory transformation to obtain the polynomial Compute the rank-reduction key with the polynomial The inner product of the form Inner product of form The inverse of the number-theoretic transformation yields the polynomial For polynomial Calculate the modulus drop and get the polynomial For polynomial Perform number theory transformation to obtain the rank reduction result 6. The method according to claim 1, characterized in that The data holder obtains the complex vector based on the rescaling result ct″ and complex vector The Hadamard product includes: Utilizing private keys Decrypt the rescaled result ct″ to obtain the plaintext m′(X); The plaintext m′(X) is decoded based on the approximate scaling factor Δ and the mapping function τ to obtain the complex vector and complex vector An approximation of the Hadamard product.

7. The method according to any one of claims 1 to 6, characterized in that: After negotiating homomorphic encryption parameters with the data holder, it also includes: Get the security strength λ corresponding to the homomorphic encryption parameter; Determine whether the security strength λ is greater than a set threshold; When the security strength λ is less than the set threshold, returning to the step of negotiating homomorphic encryption parameters with the data holder to negotiate new homomorphic encryption parameters; When the security strength λ is greater than the set threshold, the process jumps to obtaining the ciphertext ct1, ciphertext ct2, cross-relinearization key and rank reduction key sent by the data holder.

8. A privacy protection device based on cross-reproducibility, characterized in that: The device comprises: Negotiation module, used to negotiate homomorphic encryption parameters with the data holder, the homomorphic encryption parameters include: polynomial degree n, rank r, approximate scaling factor Δ and maximum number of multiplication layers L and corresponding ciphertext modulus Q L ; The acquisition module is used to obtain the ciphertext ct1, ciphertext ct2, cross-relinearization key and rank reduction key sent by the data holder; wherein the ciphertext ct1 and the ciphertext ct2 are respectively based on the complex vector and complex vector generate; The first calculation module is used to calculate the Kronecker product between the ciphertext v1 and the ciphertext ct2 where c0 is the first polynomial in the Kronecker product ct, is a polynomial vector consisting of r polynomials following the polynomial c0, It is composed of vector The following polynomial vector consists of r(r+1) / 2 polynomials; The second computing module is used to calculate the polynomial vector based on the cross relinearization key and the rank reduction key. Perform the cross relinearization operation and rank reduction operation in sequence to obtain the cross relinearization result Sum rank reduction results And for polynomial vector pairs Cross-relinearization results Sum rank reduction results Perform homomorphic addition; The third computing module is used to perform a rescaling operation on the homomorphic addition result ct′ and transmit the rescaling result ct″ to the data holder, so that the data holder can obtain the complex vector that the computing execution party cannot obtain based on the rescaling result ct″. and complex vector The Hadamard product.

9. A privacy protection system based on cross-reproducibility, characterized in that: The system includes a computing execution party and at least one data holder; The calculation execution party is used to: Negotiate homomorphic encryption parameters with the data holder, including: polynomial degree n, rank r, approximate scaling factor Δ, maximum number of multiplication layers L and corresponding ciphertext modulus Q L ; Obtain the ciphertext ct1, ciphertext ct2, cross-relinearization key and rank reduction key sent by the data holder; wherein the ciphertext ct1 and the ciphertext ct2 are respectively based on the complex vector and complex vector generate; Calculate the Kronecker product between the ciphertext ct1 and the ciphertext ct2 where c0 is the first polynomial in the Kronecker product ct, is a polynomial vector consisting of r polynomials following the polynomial c0, It is composed of vector The following polynomial vector consists of r(r+1) / 2 polynomials; The polynomial vector is obtained based on the cross-relinearization key and the rank reduction key. Perform the cross relinearization operation and rank reduction operation in sequence to obtain the cross relinearization result Sum rank reduction results And for the polynomial c0, polynomial vector Cross-relinearization results Sum rank reduction results Perform homomorphic addition; after performing a rescaling operation on the homomorphic addition result ct′, transmit the rescaling result ct″ to the data holder; The data holder is used to: Negotiate homomorphic encryption parameters with the data holder, including: polynomial degree n (power of 2), rank r, approximate scaling factor Δ, maximum number of multiplication layers L and corresponding ciphertext modulus Q L ; Generate cross-relinearization keys and rank reduction keys; Based on complex vector and complex vector Generate ciphertext ct1 and ciphertext ct2; Send the ciphertext ct1, ciphertext ct2, cross-relinearization key and rank reduction key to the calculation executor; Based on the rescaling result ct″ returned by the calculation execution party, the complex vector that the calculation execution party cannot obtain is obtained and complex vector The Hadamard product.

10. An electronic device, characterized in that: The electronic device comprises: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, the privacy protection method based on cross-reproducibility described in any one of claims 1 to 7 is implemented.

Images