Lightweight privacy-preserving verifiable outsourcing computing method, system, and program product

Abstract

The invention discloses a lightweight privacy-protected verifiable outsourcing computing method, system and program product. The method comprises the steps that when a task entrusting party cooperates with a task executing party for the first time, a public parameter PP and a private key SK are generated, and the public parameter PP is sent to the task executing party; the task entrusting party encrypts to-be-calculated data by using the private key SK and adopting a message authentication code mode, and sends a ciphertext C obtained after encryption to a task executing party; the task executor receives the calculation task sent by the task entrusting party, converts the function evaluation operation of the ciphertext C into polynomial operation, and obtains the ciphertext of the authentication code of the polynomial operation result by using FHE; and the task entrusting party verifies and decrypts the ciphertext of the authentication code of the polynomial operation result by using the FHE. According to the method, verifiable calculation for privacy protection of any function can be realized, and meanwhile, the calculation overhead is greatly reduced.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to a lightweight privacy-protected verifiable outsourced computing method, system, and program product. Background Art

[0002] The emergence of cloud computing has opened up a new computing model: users with limited computing power and storage resources are more willing to outsource data and computing to cloud service providers with more computing power and storage resources. However, since the operators of cloud service providers are usually not in the same trust domain as cloud users, this has brought many security and privacy issues to the cloud computing model.

[0003] Therefore, in the context of outsourced computing, in order to prevent malicious or abnormal cloud service providers, it is necessary to consider both the confidentiality of user data and the verifiability of computing results. In order to ensure the effective use of data while taking into account the privacy of data, fully homomorphic encryption (FHE) of user data is one of the main technical means. In order to ensure the correctness of the calculation, that is, verifiable computing (VC), existing technologies include interactive proofs, probabilistic proofs (PCP), concise arguments, homomorphic message authenticators, homomorphic signatures, etc. Among the existing solutions, some only support data confidentiality, some only support result verifiability, and only a few solutions meet both confidentiality and verifiability. The following will introduce some related solutions for verifiable encrypted computing.

[0004] The paper "Verifiable computation on outsourced encrypted data" proposes a new component of homomorphic encryption authenticator and formally defines semantic security and unforgeability. Subsequently, a homomorphic encryption authenticator supporting linear functions is constructed by using the characteristics of elliptic curve bilinear groups, and the security and strong unforgeability of the authenticator are formally proved. On this basis, a verifiable homomorphic encryption (VHE) scheme is further proposed in combination with homomorphic encryption. Unfortunately, this scheme only supports linear functions. The paper "Efficient Verifiable Computation of Linearand Quadratic Functions over Encrypted Data" proposes a verifiable encrypted computation scheme supporting linear functions based on the idea of ​​message authentication codes, and further implements a verifiable encrypted computation scheme supporting quadratic functions in combination with Paillier encryption, and formally proves that the scheme satisfies encryption correctness, evaluation correctness and semantic security. The paper "Efficiently verifiable computation on encrypted data" combines homomorphic encryption technology and verifiable computation technology to propose a verifiable encrypted computation scheme that allows attackers to initiate verification queries arbitrarily, that is, strong unforgeability. Since the computation is performed on FHE ciphertext, which is larger and more complex than the plaintext representation, the scheme faces the problem of low efficiency. And due to inherent technical limitations, the scheme only supports quadratic functions with a multiplication depth of 1. The paper "Boosting Verifiable Computation on Encrypted Data" proposes a concise non-interactive proof component for polynomial rings, and combines polynomial commitments and homomorphic encryption to construct a verifiable computation scheme that supports multiplication depth greater than 1, is publicly verifiable, and has zero knowledge. However, the scheme requires verification of the entire circuit evaluation after using fully homomorphic encryption, and the verifier only knows the correctness of the result and knows nothing about the input, which makes the proof generation process quite complicated and time-consuming, resulting in the scheme being of only theoretical significance.

[0005] The patent "A method for publicly verifying the correctness of matrix multiplication based on privacy protection" proposes a method for publicly verifying the correctness of matrix multiplication based on privacy protection. In the scheme, the task entrusting party ensures the confidentiality of its data by adding random matrices to the function matrix and input matrix respectively, and generates a public verification key; after the task executor obtains the ciphertext of the calculation result, it generates a calculation proof based on the public verification key, and then the third-party verifier performs the verification process. However, this scheme is only for matrix operations, and the task entrusting party needs to store the input matrix and function matrix in advance, which has certain application limitations.

[0006] Existing privacy-preserving verifiable computing has the following problems:

[0007] 1. Some solutions only support a very limited class of functions, such as linear functions, quadratic functions, and functions that only support one-bit output. Although they can guarantee confidentiality and verifiability, their application scenarios are very limited.

[0008] 2. Although some schemes support verifiable computation of arbitrary functions, they require homomorphic evaluation of the entire arithmetic circuit and the use of concise non-interactive proof technology to generate evidence for the computational results. This process will incur very high computational overhead. Summary of the invention

[0009] The present application provides a lightweight privacy-preserving verifiable outsourced computing method, system, and program product, aiming to solve the technical problem of high computational overhead of existing privacy-preserving verifiable computing methods.

[0010] In a first aspect, a lightweight privacy-preserving verifiable outsourced computing method is applied to a privacy-preserving outsourced computing scenario including a task entrusting party and a task executor, the method comprising:

[0011] S1, when the task entrusting party cooperates with the task executor for the first time, it generates a public parameter PP and a private key SK, and sends the public parameter PP to the task executor;

[0012] S2, the task entrusting party uses the private key SK to encrypt the data to be calculated by means of a message authentication code, and sends the encrypted ciphertext C to the task executor;

[0013] S3, the task executor receives the computing task sent by the task entruster, converts the function evaluation operation on the ciphertext C into a polynomial operation, and uses FHE to obtain the ciphertext of the authentication code of the polynomial operation result;

[0014] S4, the task entrusting party uses FHE to verify and decrypt the ciphertext of the authentication code of the polynomial operation result.

[0015] In the above solution, optionally, in step S1, generating the public parameter PP and the private key SK specifically includes:

[0016] S1.1, the task entrusting party selects the security parameter λ and a prime number p, the length of which is λ bits; all values ​​in the subsequent calculation process are limited to a finite field In, select a pseudo-random function Select a random seed for the pseudo-random function And pick a random value

[0017] S1.2, the task entrusting party selects the fully homomorphic encryption scheme FHE = (FHE.KeyGen, FHE.Enc, FHE.Eval, FHE.Dec), where FHE.KeyGen represents the key generation step, FHE.Enc represents the encryption step, FHE.Eval represents the evaluation step, and FHE.Dec represents the decryption step; execute (pk FHE ,evk FHE ,sk FHE )←FHE.KeyGen(1 λ );

[0018] S1.3, the task entrusting party generates a public parameter PP and a private key SK, where the public parameter PP = (p, pk FHE ,evk FHE ), private key SK=(k,x,sk FHE ).

[0019] In the above solution, further optionally, step S2 specifically includes:

[0020] S2.1, the task entrusting party calculates the tag data τ∈{0,1} carried in the message m * The two intermediate private variables k are related τ =F k (x||τ) and r τ =F k (τ);

[0021] S2.2, for each data to be calculated, construct a first-order polynomial y(z)=y0+y1·k τ z, the first-order polynomial y(z) satisfies: for a public point z=1, the calculation result is m; for a private random point z=x, the calculation result is r τ ;

[0022] S2.3, solving the coefficients of the first-order polynomial y(z) by using the coordinates of the public point z=1 and the coordinates of the private random point z=x to obtain y0 and y1;

[0023] S2.4, using FHE to k τ Encrypt and obtain the ciphertext C of each data to be calculated FHE , C FHE ←FHE.Enc(pk FHE ,k τ );

[0024] S2.5, the task entrusting party obtains the ciphertext of each data C=(C MAC ,C FHE ), where C MAC is the message authentication code for a single data, CMAC =(y0,y1·k τ ), and send the ciphertext C of each data to the task executor.

[0025] In the above scheme, further optionally, the calculation formula of y0 is The calculation formula of y1 is

[0026] In the above scheme, further optionally, in step S3, converting the function evaluation operation on the ciphertext C into a polynomial operation, and using FHE to obtain the ciphertext of the authentication code of the polynomial operation result specifically includes:

[0027] S3.1, the task executor takes the public parameter PP and the circuit to be calculated in the task and the ciphertext vector C c =(C1,C2,…,C n ) as the input of the FHE.Eval algorithm, where

[0028] S3.2, FHE.Eval algorithm treats each gate in the operation circuit f as given two ciphertext Or given a ciphertext and a constant, and runs the GateEval subroutine; the GateEval subroutine returns a new ciphertext for each gate and uses the new ciphertext as the input of the next gate in the operation circuit f; when the FHE.Eval algorithm reaches the last gate of the operation circuit f, the FHE.Eval algorithm outputs the authentication code C of the polynomial operation result obtained by running the GateEval subroutine on the last gate MAC* ;

[0029] The GateEval subroutine is represented as:

[0030] make And d i ≥1;

[0031] If GATE = +, let d = max(d1, d2), calculate the polynomial y(z) = y (1) (z)+y (2) The d+1 coefficients y0,…,y of (z) d ;

[0032] If GATE = ×, let d = d1 + d2, and calculate the polynomial y(z) = y (1) (z)*y (2) The d+1 coefficients y0,…,y of (z) d ;

[0033] If GATE=× c , indicating that one of the inputs of y(z) is a constant a, and calculating y(z) = a·y (1) (z) or calculate y(z) = a·y (2) The d+1 coefficients y0,…,y of (z) d ;

[0034] S3.3, the task executor obtains the authentication code C of the polynomial operation result MAC* =(y0,…,y d ), except y0, C MAC* The other coefficients of are all unknown polynomials composed of multiple variables; calculate the authentication code C of the polynomial operation result MAC* The FHE ciphertext of each polynomial in

[0035] S3.4, output the FHE ciphertext of the authentication code of the polynomial operation result And the ciphertext C * Sent to the task entrustor.

[0036] In the above solution, further optionally, in step S3.3, the authentication code C of the polynomial operation result is calculated MAC* The FHE ciphertext of each polynomial in include:

[0037] C MAC* Each polynomial in is labeled Each term in a polynomial is a function of the variable The coefficient of each term has been calculated by the task executor;

[0038] The FHE ciphertext of each polynomial is calculated as follows:

[0039]

[0040] in, is a variable The corresponding ciphertext vector.

[0041] In the above solution, further optionally, step S4 specifically includes:

[0042] S4.1, the task entrusting party sends the private key SK and the tag program The FHE ciphertext of the authentication code of the polynomial operation result As input;

[0043] S4.2, for ciphertext C * Decrypt and recover the coefficient y i :

[0044]

[0045] The authentication code C'=(y0,…,y d );

[0046] S4.3, for each label data τ i ∈{0,1} * ,i=1,…,n, calculate the relevant intermediate private variables

[0047] S4.4, with As input, the operation circuit f is evaluated and the result is obtained And verify the polynomial y(z)=y0+y1z+…+y d z d Is the value at z=x equal to R?

[0048] If the verification is equal to R, it means that the calculation result of the task executor is correct, and the task entruster accepts the calculation result of the task executor;

[0049] S4.5, after receiving the calculation result from the task executor, the task entruster decrypts the calculation result, and the decrypted result M = f(m0,…,m n ):

[0050] M=(y0+y1z+…+y d z d )| z＝1 .

[0051] In a second aspect, a lightweight privacy-preserving verifiable outsourced computing system is provided in a privacy-preserving outsourced computing scenario including a task entrusting party and a task executor, the system comprising:

[0052] The initialization module is used to enable the task entrusting party to generate a public parameter PP and a private key SK when cooperating with the task executor for the first time, and send the public parameter PP to the task executor;

[0053] The encryption module is used to enable the task entrusting party to use the private key SK to encrypt the calculation data in the form of a message authentication code, and send the encrypted ciphertext C to the task executor;

[0054] The operation module is used to enable the task executor to receive the computing task issued by the task entruster, convert the function evaluation operation on the ciphertext C into a polynomial operation, and use FHE to obtain the ciphertext of the authentication code of the polynomial operation result;

[0055] The decryption module is used to enable the task entrusting party to verify and decrypt the ciphertext of the authentication code of the polynomial operation result by using FHE.

[0056] In a third aspect, a computer program product comprises a computer program / instruction, wherein the computer program / instruction implements the steps of the method described in the first aspect when executed by a processor.

[0057] Compared with the prior art, this application has at least the following beneficial effects:

[0058] The embodiment of the present application discloses a lightweight privacy-protected verifiable outsourced computing scheme to ensure a trusted cloud computing service. For confidentiality reasons, the task entrusting party outsources the encrypted data to the task executor and authorizes the task executor to perform the specified operation in a confidential state. The task executor returns the confidential calculation result, which the task entrusting party can decrypt and verify the correctness of the result. In general, the scheme not only ensures data confidentiality, but also provides verifiability of the result. In the method provided in the embodiment of the present application, in order to realize privacy-protected verifiable computing for arbitrary functions, message authentication code technology is used to encrypt data, and the ciphertext is expressed as a linear polynomial, which converts function evaluation into polynomial operation, and FHE can be used to realize the evaluation of arbitrary functions. The final calculation result is also a polynomial, which realizes verification and decryption of the calculation result respectively. In order to minimize the performance degradation caused by FHE, the full homomorphic encryption evaluation of the entire circuit is avoided, and the coefficients of the FHE encryption result authentication code are used. The correctness of the final result is lightweight verified through the characteristics of the message authentication code, without the need to use expensive concise non-interactive proof components like the existing scheme, which greatly reduces the computational overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 A schematic diagram of an application scenario of a lightweight privacy-preserving verifiable outsourced computing method provided by an embodiment of the present application;

[0060] Figure 2 A flowchart of a lightweight privacy-preserving verifiable outsourced computing method provided for one embodiment of the present application;

[0061] Figure 3 An overall application diagram of a lightweight privacy-preserving verifiable outsourced computing method provided by an embodiment of the present application;

[0062] Figure 4 Another flowchart of a lightweight privacy-preserving verifiable outsourced computing method provided by an embodiment of the present application;

[0063] Figure 5A block diagram of the module architecture of a lightweight privacy-protected verifiable outsourced computing device provided for one embodiment of the present application. DETAILED DESCRIPTION

[0064] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0065] In the description of the present application: unless otherwise specified, expressions such as “include”, “comprising”, “having”, etc. also mean “not limited to” (certain units, components, materials, steps, etc.).

[0066] This application provides a lightweight privacy-preserving verifiable outsourced computing method that can be applied to Figure 1 The privacy protection outsourced computing scenario shown includes a task entrusting party 101 and a task executor 102. The task entrusting party 101 communicates with the task executor 102 through a network, and the task executor 102 can be implemented with an independent server or a server cluster composed of multiple servers.

[0067] In one embodiment, Figure 2 As shown, a lightweight privacy-preserving verifiable outsourced computing method is provided, which includes the following steps:

[0068] S1, when the task entrusting party cooperates with the task executor for the first time, it generates a public parameter PP and a private key SK, and sends the public parameter PP to the task executor.

[0069] Furthermore, in step S1, generating a public parameter PP and a private key SK specifically includes:

[0070] S1.1, the task entrusting party selects the security parameter λ and a prime number p, the length of which is λ bits; all values ​​in the subsequent calculation process are limited to a finite field In, select a pseudo-random function Selecting a random seed for a pseudorandom function And pick a random value

[0071] S1.2, the task entrusting party selects the fully homomorphic encryption scheme FHE = (FHE.KeyGen, FHE.Enc, FHE.Eval, FHE.Dec), where FHE.KeyGen represents the key generation step, FHE.Enc represents the encryption step, FHE.Eval represents the evaluation step, and FHE.Dec represents the decryption step; execute (pk FHE ,evkFHE ,sk FHE )←FHE.KeyGen(1 λ );

[0072] S1.3, the task entrusting party generates a public parameter PP and a private key SK, where the public parameter PP = (p, pk FHE ,evk FHE ), private key SK=(k,x,sk FHE ).

[0073] In other words, step 1: system initialization, that is, the client executes the program KeyGen(1 λ )→(PP,SK). Specifically, the entrusting party and the executor generate public parameters (also called public parameters) and private keys when they cooperate for the first time. The public parameters need to be provided to the executor, and the private key is kept secret by the entrusting party.

[0074] Step 1 specifically includes the following sub-steps:

[0075] Step 1.1: The client selects the security parameter λ of the system and a prime number p of length λ bits. All values ​​in the subsequent calculation process are in the finite field Choose a pseudo-random function Then choose a random seed for it And pick a random value

[0076] Step 1.2: Select the fully homomorphic encryption scheme FHE = (FHE.KeyGen, FHE.Enc, FHE.Eval, FHE.Dec), which represent the four steps of key generation, encryption, evaluation and decryption respectively, and execute (pk FHE ,evk FHE ,sk FHE )←FHE.KeyGen(1 λ ).

[0077] Step 1.3: Output private key SK = (k, x, sk FHE ), public parameter PP = (p, pk FHE ,evk FHE ), the executor will receive the public parameters PP.

[0078] S2: The task entrusting party uses the private key SK to encrypt the calculation data using a message authentication code, and sends the encrypted ciphertext C to the task executor.

[0079] The data to be calculated is the data to be outsourced.

[0080] Further,

[0081] Step S2 specifically includes:

[0082] S2.1, the task entrusting party calculates the tag data τ∈{0,1} carried in the message m * The two intermediate private variables k are related τ =F k (x||τ) and r τ =F k (τ);

[0083] Among them, message m is the plain text of the data that the client intends to outsource, which comes from the client, and the tag data τ is the public supplementary information of the message (which can uniquely represent the message, such as the ID number of each person in a salary table)

[0084] S2.2, for each data to be calculated, construct a first-order polynomial y(z)=y0+y1·k τ z, the polynomial y(z) satisfies: for the public point z=1, the calculation result is m; for the private random point z=x, the calculation result is r τ ;

[0085] S2.3, solving the coefficients of the first-order polynomial y(z) by using the coordinates of the public point z=1 and the coordinates of the private random point z=x to obtain y0 and y1;

[0086] The calculation formula of y0 is The calculation formula of y1 is

[0087] S2.4, using FHE to k τ Encrypt and obtain the ciphertext C of each data to be calculated FHE , C FHE ←FHE.Enc(pk FHE ,k τ );

[0088] S2.5, the task entrusting party obtains the ciphertext of each data C=(C MAC ,C FHE ), where C MAC is the message authentication code for a single data, C MAC =(y0,y1·k τ ), and send the ciphertext C of each data to the task executor.

[0089] In other words, step 2: the client runs the algorithm Enc(SK,τ,m)→C, encrypts the data and outsources it to the executor.

[0090] Step 2 specifically includes the following sub-steps:

[0091] Step 2.1: In order to carry the label τ∈{0,1} * News Perform authentication and calculate two intermediate private variables k related to the tag τ =F k (x||τ) and r τ =F k (τ).

[0092] Step 2.2: Construct a first-degree polynomial y(z)=y0+y1·k τ z, and the polynomial satisfies the following special properties: for the public point z = 1, the calculation result is m (i.e., y(1) = m); for the private random point z = x, the calculation result is r τ .

[0093] Step 2.3: Solve the coefficients of the polynomial y(z) using the coordinates of the above two points to obtain y0 and y1, that is:

[0094]

[0095] Step 2.4: Use FHE to find k τ Encrypt and get the ciphertext C FHE :

[0096] C FHE ←FHE.enc(pk FHE ,k τ )

[0097] Finally, the client obtains the ciphertext of all individual data C=(C MAC ,C FHE ) and sends it to the executor, where the message authentication code C of a single data MAC =(y0,y1·k τ ), and k τ It is an unknown variable to the executor, who only knows its FHE ciphertext.

[0098] S3, the task executor receives the computing task issued by the task entruster, converts the function evaluation operation on the ciphertext C into a polynomial operation, and uses FHE to obtain the ciphertext of the authentication code of the polynomial operation result.

[0099] Fully homomorphic encryption allows specific operations on ciphertext, such as addition and multiplication, which are performed on encrypted data. Computational tasks refer to what outsourced operations are performed on what outsourced data, and usually include mathematical operations on encrypted data, such as addition, multiplication, or even more complex function operations (depending on the support of the encryption scheme); in other words, the computational task can specifically include the operation function (circuit) and the corresponding labels of the related outsourced data.

[0100] In step S3, the function evaluation operation on the ciphertext C is converted into a polynomial operation, and the ciphertext of the authentication code of the polynomial operation result is obtained by using FHE, which specifically includes:

[0101] S3.1, the task executor takes the public parameter PP and the circuit to be calculated in the task and the ciphertext vector C c =(C1,C2,…,C n ) as the input of the FHE.Eval algorithm, where

[0102] Among them, the ciphertext vector C c That is, the ciphertext C of all the individual data in the data to be calculated i The vector composed of

[0103] S3.2, FHE.Eval algorithm treats each gate in the operation circuit f as given two ciphertext Or given a ciphertext and a constant, and runs the GateEval subroutine; the GateEval subroutine returns a new ciphertext for each gate and uses the new ciphertext as the input of the next gate in the operation circuit f; when the FHE.Eval algorithm reaches the last gate of the operation circuit f, the FHE.Eval algorithm outputs the authentication code C of the polynomial operation result obtained by running the GateEval subroutine on the last gate MAC* ;

[0104] Among them, the function f can be represented by a circuit, It is a general term, indicating that the function f corresponds to the 2 inputs of a gate in the circuit, not specifically the ciphertext vector C c The message authentication code of C1 and C2 can be understood as C c Two random and uncertain message authentication codes

[0105] The GateEval subroutine is represented as:

[0106] make And d i ≥1;

[0107] If GATE = +, let d = max(d1, d2), calculate the polynomial y(z) = y (1) (z)+y (2) The d+1 coefficients y0,…,y of (z) d ;

[0108] If GATE = ×, let d = d1 + d2, and calculate the polynomial y(z) = y(1) (z)*y (2) The d+1 coefficients y0,…,y of (z) d ;

[0109] If GATE=× c , indicating that one of the inputs of y(z) is a constant a, and calculating y(z) = a·y (1) (z) or calculate y(z) = a·y (2) The d+1 coefficients y0,…,y of (z) d ;

[0110] S3.3, the task executor obtains the authentication code C of the polynomial operation result MAC* =(y0,…,y d ), except y0, C MAC* The other coefficients of are all unknown polynomials composed of multiple variables; calculate the authentication code C of the polynomial operation result MAC* The FHE ciphertext of each polynomial in

[0111] Among them, the authentication code C of the polynomial operation result is calculated MAC* The FHE ciphertext of each polynomial in include:

[0112] C MAC* Each polynomial in is labeled Each term in a polynomial is a function of the variable The coefficient of each term has been calculated by the task executor;

[0113] The FHE ciphertext of each polynomial is calculated as follows:

[0114]

[0115] in, is a variable The vector of corresponding ciphertext;

[0116] S3.4, output the FHE ciphertext of the authentication code of the polynomial operation result And the ciphertext C * Sent to the task entrustor.

[0117] In other words, step 3: the executor receives the computing task issued by the client and executes the evaluation program Eval(PP,f,C)→C * .

[0118] Step 3 specifically includes the following sub-steps:

[0119] Step 3.1: Receive the public parameters PP and the circuit to be calculated from the client and the ciphertext vector C c =(C1,C2,…,C n ) as input, where Intuitively speaking, the Eval algorithm is in the ciphertext The circuit f is evaluated on , rather than on the corresponding plaintext message.

[0120] In other words, this algorithm is based on a completely new arithmetic circuit. This circuit is performed on a series of gates in * It has the same structure as f, except that each input becomes the ciphertext C corresponding to the previous input MAC =(y0,y1), the evaluation operation can be regarded as a polynomial operation.

[0121] Step 3.2: The Eval algorithm performs the following operations on each gate one by one.

[0122] For each internal door, given two ciphertexts (or a ciphertext and a constant ), running the GateEval subroutine described below.

[0123] This subroutine returns a new ciphertext And use it as the input of the next gate in the circuit. When the calculation reaches the last gate of circuit f, the Eval algorithm outputs the ciphertext C obtained by running the GateEval subroutine on the last gate MAC* .

[0124] Among them, the subroutine GateEval can be expressed as: make And d i ≥1(d i =1 corresponds to one of the following two inputs being a constant situation).

[0125] Step 3.2.1: If GATE = +, let d = max(d1, d2).

[0126] Without loss of generality, assume that d1≥d2, that is, d=d1. Calculate the polynomial y(z)=y (1) (z)+y (2) The d+1 coefficients y0,…,y of (z) d This can be quickly found by adding the two coefficient vectors, i.e. y = y (1) +y (2) (where the vector y (2)Fill with 0 at positions d2…d1).

[0127] Step 3.2.2: If GATE = ×, let d = d1 + d2. Then calculate the polynomial y(z) = y based on the convolution symbol * (1) (z)*y (2) The d+1 coefficients y0,…,y of (z) d Specifically, for calculate

[0128] Step 3.2.3: If GATE = × c , indicating that one of the inputs is a constant. Assuming C2 = a, calculate the polynomial y(z) = a·y (1) (z) is the d+1 coefficients of .

[0129] Step 3.3: Return the authentication code C of the calculation result of the function f calculated according to steps 3.2.1-3.2.3 MAC* =(y0,…,y d ). Note that C MAC* All coefficients of except y0 are polynomials consisting of unknown multiple variables.

[0130] Without loss of generality, the above polynomial is marked as They are all about variables The coefficients of the polynomial have been calculated by the execution party.

[0131] Obviously, with input The corresponding FHE ciphertext The FHE ciphertext of the above polynomial can be obtained by calculation:

[0132]

[0133] in is a variable The corresponding ciphertext vector.

[0134] Step 3.4: The algorithm outputs Send it to the client. It is not difficult to see that after the circuit f is homomorphically evaluated. The size of the ciphertext |C| = d+1, where d is the degree of the circuit f.

[0135] S4, the task entrusting party uses FHE to verify and decrypt the ciphertext of the authentication code of the polynomial operation result.

[0136] Furthermore, step S4 specifically includes:

[0137] S4.1, the task entrusting party sends the private key SK and the tag program The FHE ciphertext of the authentication code of the polynomial operation result As input;

[0138] S4.2, for ciphertext C * Decrypt and recover the coefficient y i :

[0139]

[0140] The authentication code C'=(y0,…,y d );

[0141] S4.3, for each label data τ i ∈{0,1} * ,i=1,…,n, calculate the relevant intermediate private variables

[0142] S4.4, with As input, the operation circuit f is evaluated and the result is obtained And verify the polynomial y(z)=y0+y1z+…+y d z d Is the value at z=x equal to R?

[0143] If the verification is equal to R, it means that the calculation result of the task executor is correct, and the task entruster accepts the calculation result of the task executor;

[0144] S4.5, after receiving the calculation result from the task executor, the task entruster decrypts the calculation result, and the decrypted result M = f(m0,…,m n ):

[0145] M=(y0+y1z+…+y d z d )| z＝1 .

[0146] In other words, step 4: the client receives the calculation result and performs the ciphertext verification and decryption procedure. It includes the following sub-steps:

[0147] Step 4.1: The client uses the FHE private key SK, a label program and ciphertext is the input. In the actual scenario, τ1,…,τ n is a set of consecutive labels.

[0148] The label program indicates the outsourced computing function and the outsourced data on which the calculation is performed.

[0149] Step 4.2: Decrypt the FHE ciphertext and recover the coefficient yi :

[0150]

[0151] Get the authentication code of the calculation result, that is, the result ciphertext C'=(y0,…,y d ).

[0152] Step 4.3: For each input label n∈{0,1} * ,i=1,…,n, calculate the intermediate private variables related to it

[0153] Step 4.4: As input, evaluate the circuit f and get the result Then verify whether the following equation holds, that is, the result polynomial y(z) = y0 + y1z + ... + y d z d Is the value at z=x equal to R:

[0154] R=(y0+y1z+…+y d z d )| z＝x

[0155] =y0+y1x+…+y d x d mod p

[0156] If the above formula is established, it means that the calculation result of the executor is correct and the client accepts this result; otherwise, the client rejects the authenticity of the given result ciphertext and terminates the outsourcing task.

[0157] Step 4.5: Decrypt the result by the following calculation, that is, M = f(m0,…,m n ):

[0158] M=(y0+y1z+…+y d z d )| z＝1 .

[0159] The embodiment of the present application discloses a lightweight privacy-preserving verifiable outsourced computing solution, which can realize verifiable computing of any function of outsourced ciphertext data. The solution includes two subject objects: a task entrustor and a task executor. Among them, the task entrustor is referred to as the entrustor, and the task executor is referred to as the executor.

[0160] In summary, the embodiments of the present application disclose a lightweight privacy-protected verifiable outsourced computing solution to ensure reliable cloud computing services. Figure 3As shown in the figure, the task entrustor (customer with limited computing and storage resources) outsources the encrypted data to the task executor (service provider, volunteer, cloud, etc.) for confidentiality considerations, and authorizes the task executor to perform the specified calculation in a confidential state. The task executor returns the confidential calculation result, and the task entrustor can decrypt and verify the correctness of the result. In general, the scheme not only ensures data confidentiality, but also provides verifiability of the results.

[0161] In the cloud scenario set by this solution, the client outsources the encrypted data to the executor one by one after running a one-time key generation and encryption program. Subsequently, the client sends a request to the server to perform a certain type of calculation on a certain data set (by specifying a set of labeled data and a labeling program). Finally, the server returns the ciphertext of the result, and the client can decrypt and verify the correctness of the returned result. The overall process diagram can also be seen Figure 4 .

[0162] In the method provided in the embodiment of the present application, in order to realize verifiable calculation with privacy protection for arbitrary functions, message authentication code technology and pseudo-random function are used to encrypt data, and the ciphertext is expressed as a first-order polynomial, and one of the coefficients is encrypted using FHE. This transforms function evaluation into a polynomial operation, and FHE can be used to evaluate any function, and the final calculation result is also a polynomial. Using the coordinates of the polynomial at a public point and a private point, the calculation result can be verified and decrypted respectively.

[0163] In order to minimize the performance degradation caused by FHE, the full homomorphic encryption evaluation of the entire circuit is avoided, and the coefficients of the result authentication code are encrypted using FHE. Moreover, the correctness of the final result is lightweight verified through the characteristics of the message authentication code, without the need for expensive concise non-interactive proof components like existing schemes.

[0164] It should be understood that although Figure 2 and Figure 4 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 2 and Figure 4 At least part of the steps may include multiple steps or multiple stages. These steps or stages are not necessarily performed at the same time, but can be performed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed in turn or alternately with other steps or at least part of the steps or stages in other steps.

[0165] In one embodiment, Figure 5 As shown, a lightweight privacy-preserving verifiable outsourced computing system is provided, which is set in a privacy-preserving outsourced computing scenario including a task entrusting party and a task executor. The system includes the following program modules:

[0166] Initialization module 501, used to enable the task entrusting party to generate a public parameter PP and a private key SK when cooperating with the task executor for the first time, and send the public parameter PP to the task executor;

[0167] The encryption module 502 is used to enable the task entrusting party to use the private key SK to encrypt the data to be calculated in a message authentication code manner, and send the encrypted ciphertext C to the task executor;

[0168] The operation module 503 is used to enable the task executor to receive the computing task sent by the task entruster, convert the function evaluation operation on the ciphertext C into a polynomial operation, and use FHE to obtain the ciphertext of the authentication code of the polynomial operation result;

[0169] The decryption module 504 is used to enable the task entrusting party to verify and decrypt the ciphertext of the authentication code of the polynomial operation result by using FHE.

[0170] The specific implementation content of each module can be found in the above definition of a lightweight privacy-preserving verifiable outsourced computing method, which will not be repeated here.

[0171] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, which involves all or part of the processes in the above-mentioned embodiment method.

[0172] In one embodiment, a computer program product is also provided, including a computer program / instruction, which implements all or part of the process in the above-mentioned embodiment method when executed by a processor.

[0173] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

Claims

1. A lightweight privacy-preserving verifiable outsourced computing method, characterized in that: Applied to a privacy-preserving outsourced computing scenario involving a task entrustor and a task executor, the method includes: S1, when the task entrusting party cooperates with the task executor for the first time, it generates a public parameter PP and a private key SK, and sends the public parameter PP to the task executor; S2, the task entrusting party uses the private key SK to encrypt the data to be calculated by means of a message authentication code, and sends the encrypted ciphertext C to the task executor; S3, the task executor receives the computing task sent by the task entruster, converts the function evaluation operation on the ciphertext C into a polynomial operation, and uses FHE to obtain the ciphertext of the authentication code of the polynomial operation result; S4, the task entrusting party uses FHE to verify and decrypt the ciphertext of the authentication code of the polynomial operation result.

2. The lightweight privacy-preserving verifiable outsourced computing method according to claim 1 is characterized in that: In step S1, generating the public parameter PP and the private key SK specifically includes: S1.1, the task entrusting party selects the security parameter λ and a prime number p, the length of which is λ bits; all values ​​in the subsequent calculation process are limited to a finite field In, select a pseudo-random function Select a random seed for the pseudo-random function And pick a random value S1.2, the task entrusting party selects the fully homomorphic encryption scheme FHE = (FHE.KeyGen, FHE.Enc, FHE.Eval, FHE.Dec), where FHE.KeyGen represents the key generation step, FHE.Enc represents the encryption step, FHE.Eval represents the evaluation step, and FHE.Dec represents the decryption step; execute (pk FHE ,evk FHE ,sk FHE )←FHE.KeyGen(1 λ ); S1.3, the task entrusting party generates a public parameter PP and a private key SK, where the public parameter PP = (p, pk FHE ,evk FHE ), private key SK=(k,x,sk FHE ).

3. The lightweight privacy-preserving verifiable outsourced computing method according to claim 2 is characterized in that: Step S2 specifically includes: S2.1, the task entrusting party calculates the tag data τ∈{0,1} carried in the message m * The two intermediate private variables k are related τ =F k (x||τ) and r τ =F k (τ); S2.2, for each data to be calculated, construct a first-order polynomial y(z)=y0+y1·k τ z, the first-order polynomial y(z) satisfies: for a public point z=1, the calculation result is m; for a private random point z=x, the calculation result is r τ ; S2.3, solving the coefficients of the first-order polynomial y(z) by using the coordinates of the public point z=1 and the coordinates of the private random point z=x to obtain y0 and y1; S2.4, using FHE to k τ Encrypt and obtain the ciphertext C of each data to be calculated FHE , C FHE ←FHE.Enc(pk FHE , k τ ); S2.5, the task entrusting party obtains the ciphertext of each data C=(C MAC , C FHE ), where C MAC is the message authentication code for a single data, C MAC =(y0,y1·k τ ), and send the ciphertext C of each data to the task executor.

4. The lightweight privacy-preserving verifiable outsourced computing method according to claim 3 is characterized in that: The calculation formula of y0 is The calculation formula of y1 is 5. The lightweight privacy-preserving verifiable outsourced computing method according to claim 3 is characterized in that: In step S3, the function evaluation operation on the ciphertext C is converted into a polynomial operation, and the ciphertext of the authentication code of the polynomial operation result is obtained by using FHE, specifically including: S3.1, the task executor takes the public parameter PP and the circuit to be calculated f in the calculation task: and the ciphertext vector C c =(C1, C2, ..., C n ) as the input of the FHE.Eval algorithm, where S3.2, FHE.Eval algorithm treats each gate in the operation circuit f as given two ciphertext Or given a ciphertext and a constant, and runs the GateEval subroutine; the GateEval subroutine returns a new ciphertext for each gate and uses the new ciphertext as the input of the next gate in the operation circuit f; when the FHE.Eval algorithm reaches the last gate of the operation circuit f, the FHE.Eval algorithm outputs the authentication code C of the polynomial operation result obtained by running the GateEval subroutine on the last gate MAC* ; The GateEval subroutine is represented as: make And d i ≥1; If GATE = +, let d = max(d1, d2), calculate the polynomial y(z) = y (1) (z)+y (2) The d+1 coefficients y0,…,y of (z) d ; If GATE = ×, let d = d1 + d2, and calculate the polynomial y(z) = y (1) (z)*y (2) The d+1 coefficients y0,…,y of (z) d ; If GATE = ×c, it means that one of the inputs of y(z) is a constant a. Calculate y(z) = a·y (1) (z) or calculate y(z) = a·y (2) The d+1 coefficients y0,…,y of (z) d ; S3.3, the task executor obtains the authentication code C of the polynomial operation result MAC* =(y0,…,y d ), except y0, C MAC* The other coefficients of are all unknown polynomials composed of multiple variables; calculate the authentication code C of the polynomial operation result MAC* The FHE ciphertext of each polynomial in S3.4, output the FHE ciphertext of the authentication code of the polynomial operation result And the ciphertext C * Sent to the task entrustor.

6. The lightweight privacy-preserving verifiable outsourced computing method according to claim 5, characterized in that: In step S3.3, the authentication code C of the polynomial operation result is calculated MAC* The FHE ciphertext of each polynomial in include: C MAC* Each polynomial in is labeled Each term in the polynomial is a function of the variable The coefficient of each term has been calculated by the task executor; The FHE ciphertext of each polynomial is calculated as follows: in, is a variable The corresponding ciphertext vector.

7. The lightweight privacy-preserving verifiable outsourced computing method according to claim 1, characterized in that: Step S4 specifically includes: S4.1, the task entrusting party sends the private key SK and the tag program The FHE ciphertext of the authentication code of the polynomial operation result As input; S4.2, for ciphertext C * Decrypt and recover the coefficient y i : The authentication code C′=(y0,…,y d ); S4.3, for each label data τ i ∈{0, 1} * , i = 1, ..., n, calculate the relevant intermediate private variables S4.4, with As input, the operation circuit f is evaluated and the result is obtained And verify the polynomial y(z)=y0+y1z+…+y d z d Is the value at z=x equal to R? If the verification is equal to R, it means that the calculation result of the task executor is correct, and the task entruster accepts the calculation result of the task executor; S4.5, after receiving the calculation result from the task executor, the task entruster decrypts the calculation result, and the decrypted result M=f(m0, ..., m n ): M=(y0+y1z+…+y a z d )| z＝1 。 8. A lightweight privacy-preserving verifiable outsourced computing system, characterized in that: Set in a privacy protection outsourced computing scenario including a task entrusting party and a task executor, the system includes: The initialization module is used to enable the task entrusting party to generate a public parameter PP and a private key SK when cooperating with the task executor for the first time, and send the public parameter PP to the task executor; The encryption module is used to enable the task entrusting party to use the private key SK to encrypt the calculation data in the form of a message authentication code, and send the encrypted ciphertext C to the task executor; The operation module is used to enable the task executor to receive the computing task issued by the task entruster, convert the function evaluation operation on the ciphertext C into a polynomial operation, and use FHE to obtain the ciphertext of the authentication code of the polynomial operation result; The decryption module is used to enable the task entrusting party to verify and decrypt the ciphertext of the authentication code of the polynomial operation result by using FHE.

9. A computer program product comprising a computer program / instructions, characterized in that The computer program / instructions implement the steps of the method as claimed in claim 1 when executed by a processor.

Images