Privacy protection verifiable matrix multiplication method and system with lower critical dimension

Abstract

The invention provides a privacy protection verifiable matrix multiplication method and system with a lower critical dimension, and relates to the technical field of privacy protection. The method comprises the following steps: a user generates public parameters and a key; generating a decoding key, an evaluation key and a verification key according to the public parameters, the key and the function family; generating a ciphertext, a decoding key and a verification key of the matrix according to the key and the matrix; the service provider obtains an encrypted calculation result according to the evaluation key and the ciphertext; the user verifies the correctness of the encrypted calculation result according to the evaluation key and the evaluation key; and if the verification result is correct, the user inputs a decoding key, the decoding key and the encrypted calculation result, and decodes the encrypted calculation result to obtain a final calculation result. The improved private LHE provided by the invention has the advantages that the decryption realization is simpler, the reduction of critical dimensions is facilitated, and meanwhile, the ProbGen time is reduced due to the shorter ciphertext, and the initialization burden is relieved.

Description

Technical Field

[0001] This invention relates to the field of privacy protection technology, and in particular to a privacy-protected verifiable matrix multiplication method and system with a low critical dimension. Background Technology

[0002] Matrix multiplication is a fundamental operation in various computer algorithms and data structures, including graphics processing and machine learning algorithms. When limited resources cannot support the computation, it can be outsourced to cloud computing or edge computing platforms. However, there is a risk that malicious service providers may return incorrect results to accelerate the task or even steal confidential data during the process. Therefore, there is an urgent need to develop a method that supports result verification without recompiling the task. To this end, the concept of verifiable computation has been introduced, whereby a service provider receives a user's computational commission while ensuring minimal verification time. Verifiable computation based on interactive proof systems is one of the main technical approaches. After completing the computation, the service provider must participate in an interactive proof process to convince the user of the correctness of the result. However, these efforts have primarily focused on theoretical research, and practical results have been unsatisfactory. One reason is that interactive proof systems involve multiple rounds of communication, leading to significant communication overhead and actual verification time.

[0003] Gennaro et al. proposed a verifiable computation scheme that eliminated the need for an interactive proof system. Subsequently, several related works emerged, with Parno et al. introducing the Multifunctional Verifiable Computation Model (MFVC). This model provides greater flexibility by implementing multiple functions using the same input. This means users can delegate multiple tasks to a server, requiring only one preprocessing step. The MFVC verification algorithm has two versions: private and public. The main difference lies in their respective application scenarios. In the private version, both input and output come from the same user. On the other hand, the public version involves inputs and outputs from different users. Most early works, including the MFVC model, did not consider data privacy. Using unencrypted input / output could lead to the leakage of user information. To address this issue, researchers have extended the MFVC model by introducing additional decoding algorithms.

[0004] From a computational perspective, verifiable computation can be categorized into two types: verifiable computation for general operations and verifiable computation for specific operations, such as polynomials and matrices. Matrix multiplication computation (MMC) is widely used in machine learning and artificial intelligence, image processing and computer vision, quantum computing and quantum information, path planning and optimization, and many works focus on verifiable computation of MMC. However, many of these methods rely on bilinear pairing, which is considered unsecured in the upcoming quantum era. Verifiable computation schemes based on linear homomorphic encryption (LHE) can strike a balance between efficiency and resistance to quantum attacks.

[0005] The critical dimension for verifiable computation in MMC is the number of dimensions at which the user's matrix multiplication computation cost equals the verification (and decoding) cost. In other words, verifiable computation in MMC becomes outsourceable at this point. Researchers have successfully reduced the critical dimension to 7000. However, their scheme is based on the public LHE, where the ciphertext length is twice the message length. This design choice results in the encrypted message matrix having columns twice its row size. Since matrix multiplication with the encrypted message matrix is ​​involved in both computation and verification phases, the larger the dimension of the encrypted message matrix, the higher the overhead incurred in computation and verification.

[0006] Current privacy-preserving verifiable matrix multiplication schemes can address the problems mentioned above. However, they are only practically applicable when verification and decoding times are less than local computation. Summary of the Invention

[0007] To address the technical problem of excessively long verification and decoding times caused by the high critical dimension of existing privacy-preserving verifiable matrix multiplication schemes, this invention provides a privacy-preserving verifiable matrix multiplication method and system with a lower critical dimension. The technical solution is as follows:

[0008] On the one hand, a privacy-preserving verifiable matrix multiplication method with low critical dimension is provided, which is implemented by a privacy-preserving verifiable matrix multiplication device, and includes:

[0009] S1. The user generates public parameters based on the security parameters. and keys .

[0010] S2, Users based on publicly available parameters Key and function families Generate decoding key Evaluation Key and verification key .

[0011] S3, the user uses the key and matrix Generate matrix ciphertext Decoding key and verification key .

[0012] S4. The service provider uses the evaluation key. and ciphertext The encrypted calculation result is obtained. .

[0013] S5, the user uses the evaluation key The encrypted calculation result The correctness of the result was verified.

[0014] S6. If the verification result is correct, the user enters the decoding key. Decoding key and the encrypted calculation results and the encrypted calculation results Decode the result to obtain the final calculation result.

[0015] Optionally, the user in S1 generates public parameters based on security parameters. and keys ,include:

[0016] S11. The user calls the initialization module in the improved symmetric linear homomorphic encryption scheme to generate public parameters. .

[0017] S12, Based on publicly available parameters The key is generated by calling the key generation module in the improved symmetric linear homomorphic encryption scheme. .

[0018] Optionally, in S11, the user invokes the initialization module in the improved symmetric linear homomorphic encryption scheme to generate public parameters. ,include:

[0019] Users and service providers generate security parameters And select two prime numbers. , And in the ring noise distribution on Generate public parameters .

[0020] S12 based on public parameters The key is generated by calling the key generation module in the improved symmetric linear homomorphic encryption scheme. ,include:

[0021] From public parameters Randomly and uniformly sampled to obtain the sampling results. And record the key as .

[0022] Optionally, users in S2 can determine the parameters based on the public parameters. Key and function families Generate decoding key Evaluation Key and verification key ,include:

[0023] Users from the function family Get a function , will function Divided into row vectors Generate decoding key based on row vectors Evaluation Key and verification key .

[0024] in, Indicates from public parameters The sampling results of random uniform sampling in the middle, This represents the sum of all vectors in the input row vector.

[0025] Optionally, the user in S3 uses a key. and matrix Generate matrix ciphertext Decoding key and verification key ,include:

[0026] S31, The user will use the matrix Decomposed into block matrix ,in, , To represent the transpose of a matrix, , Represents the integer field. The modulus representing the contents of the matrix. , This represents the dimension of the matrix.

[0027] S32, to Encryption is performed using the encoding module in the improved symmetric linear homomorphic encryption scheme to obtain the ciphertext. .

[0028] S33, According to the ciphertext , to obtain the matrix ciphertext Decoding key and verification key .

[0029] Optionally, the encoding process of the encoding module in the improved symmetric linear homomorphic encryption scheme includes:

[0030] Get Key and message sequence ;in, The order is The cyclic group constitutes 1-order matrix.

[0031] From order of Cyclic group Parameters obtained by random sampling From the noise distribution Mid-sampling yields noise sequence .

[0032] make , , The ciphertext was calculated. ;in, This indicates the sampling result.

[0033] Optionally, the encrypted computation result in S6 Decoding is performed to obtain the final calculation result, including:

[0034] The encrypted calculation result , will the row and number Column representation Based on the decoding module in the improved symmetric linear homomorphic encryption scheme... Decode the code to obtain the decoding result. This leads to the final calculation result. As shown in equation (1):

[0035] (1)

[0036] In the formula, This represents the final calculation result. This means converting the input elements into a coefficient vector. express Decoding result, express row vectors. express piece.

[0037] On the other hand, a privacy-preserving verifiable matrix multiplication system with low critical dimension is provided. This system is applied to a privacy-preserving verifiable matrix multiplication method with low critical dimension. The system includes users and service providers, wherein:

[0038] Users are used to generate public parameters based on security parameters. and keys According to publicly available parameters Key and function families Generate decoding key Evaluation Key and verification key According to the key and matrix Generate matrix ciphertext Decoding key and verification key According to the evaluation key The encrypted calculation result The correctness is verified to obtain the verification result; if the verification result is correct, the decoding key is entered. Decoding key and the encrypted calculation results and the encrypted calculation results Decode the result to obtain the final calculation result.

[0039] Service providers, used based on evaluation keys and ciphertext The encrypted calculation result is obtained. .

[0040] Optionally, the user generates public parameters based on security parameters. and keys ,include:

[0041] S11. The user calls the initialization module in the improved symmetric linear homomorphic encryption scheme to generate public parameters. .

[0042] S12, Based on publicly available parameters The key is generated by calling the key generation module in the improved symmetric linear homomorphic encryption scheme. .

[0043] Optionally, in S11, the user invokes the initialization module in the improved symmetric linear homomorphic encryption scheme to generate public parameters. ,include:

[0044] Users and service providers generate security parameters And select two prime numbers. , And in the ring noise distribution on Generate public parameters .

[0045] S12 based on public parameters The key is generated by calling the key generation module in the improved symmetric linear homomorphic encryption scheme. ,include:

[0046] From public parameters Randomly and uniformly sampled to obtain the sampling results. And record the key as .

[0047] Optionally, the user can determine the parameters based on the publicly available parameters. Key and function families Generate decoding key Evaluation Key and verification key ,include:

[0048] Users from the function family Get a function , will function Divided into row vectors Generate decoding key based on row vectors Evaluation Key and verification key .

[0049] in, Indicates from public parameters The sampling results of random uniform sampling in the middle, This represents the sum of all vectors in the input row vector.

[0050] Optionally, the user uses a key and matrix Generate matrix ciphertext Decoding key and verification key ,include:

[0051] S31, The user will use the matrix Decomposed into block matrix ,in, , To represent the transpose of a matrix, , Represents the integer field. The modulus representing the contents of the matrix. , This represents the dimension of the matrix.

[0052] S32, to Encryption is performed using the encoding module in the improved symmetric linear homomorphic encryption scheme to obtain the ciphertext. .

[0053] S33, According to the ciphertext , to obtain the matrix ciphertext Decoding key and verification key .

[0054] Optionally, the encoding process of the encoding module in the improved symmetric linear homomorphic encryption scheme includes:

[0055] Get Key and message sequence ;in, The order is The cyclic group constitutes 1-order matrix.

[0056] From order of Cyclic group Parameters obtained by random sampling From the noise distribution Mid-sampling yields noise sequence .

[0057] make , , The ciphertext was calculated. ;in, This indicates the sampling result.

[0058] Optionally, the encrypted calculation result Decoding is performed to obtain the final calculation result, including:

[0059] The encrypted calculation result , will the row and number Column representation Based on the decoding module in the improved symmetric linear homomorphic encryption scheme... Decode the code to obtain the decoding result. This leads to the final calculation result. As shown in equation (1):

[0060] (1)

[0061] In the formula, This represents the final calculation result. This means converting the input elements into a coefficient vector. express Decoding result, express row vectors. express piece.

[0062] On the other hand, a privacy-preserving verifiable matrix multiplication device is provided, the privacy-preserving verifiable matrix multiplication device comprising: a processor; and a memory storing computer-readable instructions, which, when executed by the processor, implement any of the above-described privacy-preserving verifiable matrix multiplication methods with lower critical dimensions.

[0063] On the other hand, a computer-readable storage medium is provided, wherein at least one instruction is stored therein, the at least one instruction being loaded and executed by a processor to implement any of the above-described privacy-preserving verifiable matrix multiplication methods with low critical dimension.

[0064] The beneficial effects of the technical solutions provided by the embodiments of the present invention include at least the following:

[0065] This invention provides a privacy-preserving verifiable matrix multiplication method with a low critical dimension, which reduces the ciphertext length during encryption and simplifies linear homomorphic encryption algorithms, thereby lowering verification and decoding time. The purpose of this invention is to address the problem of excessively long verification and decoding times caused by the high critical dimension of existing privacy-preserving verifiable matrix multiplication schemes. This invention improves the private LHE scheme and, based on this, designs a privacy-preserving verifiable matrix multiplication method with a low critical dimension. Attached Figure Description

[0066] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0067] Figure 1 This is a flowchart of a privacy-preserving verifiable matrix multiplication method with low critical dimension provided by an embodiment of the present invention;

[0068] Figure 2 This is a schematic diagram of the improved symmetric linear homomorphic encryption scheme (SLHE) provided in the embodiments of the present invention;

[0069] Figure 3 This is a flowchart of a privacy-preserving verifiable matrix multiplication method with low critical dimension provided by an embodiment of the present invention;

[0070] Figure 4 This is a block diagram of a privacy-preserving verifiable matrix multiplication system with low critical dimension provided by an embodiment of the present invention;

[0071] Figure 5 This is a schematic diagram of the structure of a privacy-protected verifiable matrix multiplication device provided in an embodiment of the present invention. Detailed Implementation

[0072] The technical solution of the present invention will now be described with reference to the accompanying drawings.

[0073] In embodiments of the present invention, words such as "exemplarily," "for example," etc., are used to indicate that something is an example, illustration, or description. Any embodiment or design described as "exemplary" in the present invention should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of the word "exemplary" is intended to present the concept in a concrete manner. Furthermore, in embodiments of the present invention, the meaning expressed by "and / or" can be both, or either one.

[0074] In the embodiments of this invention, the terms "image" and "picture" may sometimes be used interchangeably. It should be noted that, without emphasizing the distinction between them, they convey the same meaning. Similarly, the terms "of," "corresponding (relevant)," and "corresponding" may sometimes be used interchangeably. It should be noted that, without emphasizing the distinction between them, they convey the same meaning.

[0075] In this embodiment of the invention, sometimes a subscript such as W1 may be written in a non-subscript form such as W1. When the difference is not emphasized, the meaning they express is the same.

[0076] To make the technical problems, technical solutions and advantages of the present invention clearer, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments.

[0077] This invention provides a privacy-preserving verifiable matrix multiplication method with a low critical dimension. This method can be implemented by a privacy-preserving verifiable matrix multiplication device, which can be a terminal or a server. Figure 1 The flowchart shown is for a privacy-preserving verifiable matrix multiplication method with low critical dimension. The processing flow of this method may include the following steps:

[0078] S1. The user generates public parameters based on the security parameters. and keys .

[0079] Optionally, step S1 above may include the following steps S11-S12:

[0080] S11. The user calls the initialization module in the improved symmetric linear homomorphic encryption scheme to generate public parameters. .

[0081] Specifically, users and service providers generate security parameters. And select two prime numbers. , And in the ring noise distribution on Generate public parameters .

[0082] S12, Based on publicly available parameters The key is generated by calling the key generation module in the improved symmetric linear homomorphic encryption scheme. .

[0083] Specifically, from the publicly available parameters Randomly and uniformly sampled to obtain the sampling results. And record the key as .

[0084] In one feasible implementation, the present invention proposes an improved symmetric linear homomorphic encryption scheme, consisting of five steps: an initialization module Setup, a key generation module KeyGen, an encoding module Enc, an evaluation module Eval, and a decoding module Dec, as follows: Figure 2 As shown.

[0085] The present invention is based on an extended MFVC model and consists of two entities: a user and a service provider. The user generates the necessary keys and encrypts the data, while the service provider performs the computational task and returns the result.

[0086] Furthermore, based on the optimized symmetric linear homomorphic encryption scheme and the extended MFVC model, a privacy-preserving verifiable matrix multiplication method with low critical dimensionality is proposed, consisting of six algorithmic steps: Setup, KeyGen, ProbGen, Compute, Verify, and Decode. Figure 3 As shown.

[0087] Specifically, step S1 above is the Setup algorithm, which is based on user input of security parameters. and function family Execute and output public parameters and key The algorithm calls SLHE.Setup( To generate parameters Then call SLHE.KeyGen( To obtain the key .

[0088] The Setup module in the improved symmetric linear homomorphic encryption scheme is used to initialize the input data.

[0089] Specifically, this step is denoted as Setup( Security parameters are generated when users and service providers collaborate. And select two suitable prime numbers. ,in Modulo an integer Groups, and in the ring noise distribution on The output of this step is: .

[0090] Furthermore, the improved symmetric linear homomorphic encryption scheme includes a key generation module, KeyGen, for users to generate keys.

[0091] Specifically, this step is denoted as KeyGen( Based on the parameter sequence generated by the previous algorithm, random and uniform sampling is performed to obtain... And record the key as .

[0092] S2, Users based on publicly available parameters Key and function families Generate decoding key Evaluation Key and verification key .

[0093] Specifically, users from the function family Get a function , will function Divided into row vectors Generate decoding key based on row vectors Evaluation Key and verification key .

[0094] in, Indicates from public parameters The sampling results of random uniform sampling in the middle, This represents the sum of all vectors in the input row vector.

[0095] In one feasible implementation, step S2 above is the KeyGen algorithm, which is based on publicly available input parameters. key and a function The user executes it. It will Divided into For example, a row vector. Output decoding key Evaluation key and verification key .in To calculate the sum of all vectors of an input row vector, i.e. .

[0096] S3, the user uses the key and matrix Generate matrix ciphertext Decoding key and verification key .

[0097] Optionally, step S3 above may include the following steps S31-S33:

[0098] S31, The user will use the matrix Decomposed into block matrix ,in, , To represent the transpose of a matrix, , Represents the integer field. , Let be the dimension of the matrix. The highest degree of the polynomial in the corresponding lattice. It is the modulus of the matrix content.

[0099] S32, to Encryption is performed using the encoding module in the improved symmetric linear homomorphic encryption scheme to obtain the ciphertext. .

[0100] S33, According to the ciphertext , to obtain the matrix ciphertext Decoding key and verification key .

[0101] In one feasible implementation, step S3 is the ProbGen algorithm, which is based on the input key. sum matrix User execution, it will Encryption And generate the decoding key and verification key .in It will first Decomposed into Block matrix, that is, ,as well as ,satisfy Then, the function calls SLHE.Enc() to encrypt. :

[0102] (1)

[0103] in, Its function is to transform the input coefficient vector into... The elements in, i.e. .

[0104] (2)

[0105] Similarly, the algorithm encrypts... And output ciphertext , and .

[0106] The encoding module Enc in the improved symmetric linear homomorphic encryption scheme is used to encode the data.

[0107] Specifically, this step is denoted as Enc( For the input key and message sequence ,in The order is The cyclic group constitutes A matrix of order n, randomly selected from a matrix of order n. Cyclic group Parameters are obtained by sampling. and from Noise sequence obtained after mid-sampling .calculate , and then let Finally, output the ciphertext. .

[0108] S4. The service provider uses the evaluation key. and ciphertext The encrypted calculation result is obtained. .

[0109] In one feasible implementation, step S4 above is the Compute algorithm, which is based on the input evaluation key. and encrypted input data The service provider performs the calculations. The algorithm processes the encrypted data:

[0110] (3)

[0111] Finally, the algorithm returns the encrypted calculation result. .

[0112] In the improved symmetric linear homomorphic encryption scheme, Eval is used to evaluate the data.

[0113] Specifically, this step is denoted as Eval( This step will coefficients and ciphertext As input, calculate the new ciphertext. and update key The new ciphertext satisfies .

[0114] S5, the user uses the evaluation key The encrypted calculation result The correctness of the result was verified.

[0115] In one feasible implementation, step S5 above is the Verify algorithm, which is based on two input evaluation keys. and and the results of encrypted calculations The user executes this. It is used to verify the correctness of the result; if correct, it randomly selects... ,like If the condition is met, output 1; otherwise, output 0.

[0116] Specifically, the correct decryption conditions are: .

[0117] Prove the correctness of the ciphertext after linear multiplication:

[0118] (4)

[0119] S6. If the verification result is correct, the user enters the decoding key. Decoding key and the encrypted calculation results and the encrypted calculation results Decode the result to obtain the final calculation result.

[0120] Optionally, the encrypted computation result in S6 Decoding is performed to obtain the final calculation result, including:

[0121] The encrypted calculation result , will the row and number Column representation Based on the decoding module in the improved symmetric linear homomorphic encryption scheme... Decode the code to obtain the decoding result. .

[0122] In one feasible implementation, step S6 above is a Decode algorithm, which is executed by the user. If the result of the algorithm in the previous step is 1, then the user inputs two decoding keys. and and the results of encrypted calculations The algorithm will decode Output calculation results The first row and number Column representation , call To decrypt .Right now:

[0123] (5)

[0124] Finally, output the calculation results:

[0125] (6)

[0126] In the formula, The operation involves converting the input elements into a coefficient vector, i.e. .

[0127] In the improved symmetric linear homomorphic encryption scheme, Dec is used to decode the data.

[0128] Specifically, this step is denoted as Dec( For input and ciphertext , ,calculate and output plaintext .

[0129] This invention first improves the private LHE (Leveled Homomorphic Encryption) scheme, reducing the ciphertext length when encrypting a set of messages. Its algorithm steps include an initialization algorithm (Setup), a key generation algorithm (KeyGen), an encryption algorithm (Enc), a homomorphic operation algorithm (Eval), and a decryption algorithm (Dec). Based on this, a privacy-preserving verifiable matrix multiplication method with lower critical dimensionality is proposed. This algorithm includes six steps: Setup, KeyGen, ProbGen, Compute, Verify, and Decode. During computation, the user completes the Setup, KeyGen, and ProbGen operations, while the service provider performs the Compute algorithm. After the encrypted computation result is completed, it is passed to the user for Verify and Decode operations. The user decrypts the encrypted computation result to obtain the correct result. The improved private LHE has a simpler decryption implementation, helps reduce critical dimensionality, and the shorter ciphertext reduces ProbGen time and alleviates the initialization burden.

[0130] This invention provides a privacy-preserving verifiable matrix multiplication method with a low critical dimension, which reduces the ciphertext length during encryption and simplifies linear homomorphic encryption algorithms to lower verification and decoding times. The purpose of this invention is to address the problem of excessively long verification and decoding times caused by the high critical dimension of existing privacy-preserving verifiable matrix multiplication schemes. This invention improves the private LHE scheme and, based on this, designs a privacy-preserving verifiable matrix multiplication method with a low critical dimension.

[0131] Figure 4 This is a block diagram illustrating a privacy-preserving verifiable matrix multiplication system with low critical dimension, according to an exemplary embodiment. The system is used for a privacy-preserving verifiable matrix multiplication method with low critical dimension. (Refer to...) Figure 4 The system includes users and service providers, among which:

[0132] Users are used to generate public parameters based on security parameters. and keys According to publicly available parameters Key and function families Generate decoding key Evaluation Key and verification key According to the key and matrix Generate matrix ciphertext Decoding key and verification key According to the evaluation key The encrypted calculation result The correctness is verified to obtain the verification result; if the verification result is correct, the decoding key is entered. Decoding key and the encrypted calculation results and the encrypted calculation results Decode the result to obtain the final calculation result.

[0133] In one feasible implementation, a user, due to limited computing and storage capacity, intends to outsource their task to a service provider. The task is simplified to a series of matrix multiplications with identical inputs. To ensure privacy and correctness, the user must encrypt the data before transmitting it to the provider and verify the computation results.

[0134] Service providers, used based on evaluation keys and ciphertext The encrypted calculation result is obtained. .

[0135] In one feasible implementation, a service provider, which could be a cloud server or an edge server, offers computing services to users in exchange for payment. While the service provider faithfully implements this scheme, it remains curious about both the input and the result. Furthermore, in order to earn more profit, it might return an incorrect result to speed up the computation, thus requiring the user to verify and decode the result upon receiving it.

[0136] Optionally, the user generates public parameters based on security parameters. and keys ,include:

[0137] S11. The user calls the initialization module in the improved symmetric linear homomorphic encryption scheme to generate public parameters. .

[0138] S12, Based on publicly available parameters The key is generated by calling the key generation module in the improved symmetric linear homomorphic encryption scheme. .

[0139] Optionally, in S11, the user invokes the initialization module in the improved symmetric linear homomorphic encryption scheme to generate public parameters. ,include:

[0140] Users and service providers generate security parameters And select two prime numbers. , And in the ring noise distribution on Generate public parameters .

[0141] S12 based on public parameters The key is generated by calling the key generation module in the improved symmetric linear homomorphic encryption scheme. ,include:

[0142] From public parameters Randomly and uniformly sampled to obtain the sampling results. And record the key as .

[0143] Optionally, the user can determine the parameters based on the publicly available parameters. Key and function families Generate decoding key Evaluation Key and verification key ,include:

[0144] Users from the function family Get a function , will function Divided into row vectors Generate decoding key based on row vectors Evaluation Key and verification key .

[0145] in, Indicates from public parameters The sampling results of random uniform sampling in the middle, This represents the sum of all vectors in the input row vector.

[0146] Optionally, the user uses a key and matrix Generate matrix ciphertext Decoding key and verification key ,include:

[0147] S31, The user will use the matrix Decomposed into block matrix ,in, , To represent the transpose of a matrix, , Represents the integer field. The modulus representing the contents of the matrix. , This represents the dimension of the matrix.

[0148] S32, to Encryption is performed using the encoding module in the improved symmetric linear homomorphic encryption scheme to obtain the ciphertext. .

[0149] S33, According to the ciphertext , to obtain the matrix ciphertext Decoding key and verification key .

[0150] Optionally, the encoding process of the encoding module in the improved symmetric linear homomorphic encryption scheme includes:

[0151] Get Key and message sequence ;in, The order is The cyclic group constitutes 1-order matrix.

[0152] From order of Cyclic group Parameters obtained by random sampling From the noise distribution Mid-sampling yields noise sequence .

[0153] make , , The ciphertext was calculated. ;in, This indicates the sampling result.

[0154] Optionally, the encrypted calculation result Decoding is performed to obtain the final calculation result, including:

[0155] The encrypted calculation result , will the row and number Column representation Based on the decoding module in the improved symmetric linear homomorphic encryption scheme... Decode the code to obtain the decoding result. This leads to the final calculation result. As shown in equation (1):

[0156] (1)

[0157] In the formula, This represents the final calculation result. This means converting the input elements into a coefficient vector. express Decoding result, express row vectors. express piece.

[0158] This invention provides a privacy-preserving verifiable matrix multiplication method with a low critical dimension, which reduces the ciphertext length during encryption and simplifies linear homomorphic encryption algorithms to lower verification and decoding times. The purpose of this invention is to address the problem of excessively long verification and decoding times caused by the high critical dimension of existing privacy-preserving verifiable matrix multiplication schemes. This invention improves the private LHE scheme and, based on this, designs a privacy-preserving verifiable matrix multiplication method with a low critical dimension.

[0159] Figure 5 This is a schematic diagram of the structure of a privacy-protected verifiable matrix multiplication device provided in an embodiment of the present invention, as shown below. Figure 5 As shown, a privacy-preserving verifiable matrix multiplication device may include the above-mentioned Figure 4 The illustrated privacy-preserving verifiable matrix multiplication system has a low critical dimension. Optionally, the privacy-preserving verifiable matrix multiplication device 410 may include a first processor 2001.

[0160] Optionally, the privacy-protected verifiable matrix multiplication device 410 may also include a memory 2002 and a transceiver 2003.

[0161] The first processor 2001, memory 2002, and transceiver 2003 can be connected via a communication bus.

[0162] The following is combined Figure 5 A detailed description of each component of the privacy-preserving verifiable matrix multiplication device 410 is provided below:

[0163] The first processor 2001 is the control center of the privacy-preserving verifiable matrix multiplication device 410. It can be a single processor or a collective term for multiple processing elements. For example, the first processor 2001 can be one or more central processing units (CPUs), application-specific integrated circuits (ASICs), or one or more integrated circuits configured to implement embodiments of the present invention, such as one or more digital signal processors (DSPs), or one or more field-programmable gate arrays (FPGAs).

[0164] Optionally, the first processor 2001 can perform various functions of the privacy-protected verifiable matrix multiplication device 410 by running or executing software programs stored in the memory 2002 and calling data stored in the memory 2002.

[0165] In a specific implementation, as one example, the first processor 2001 may include one or more CPUs, for example... Figure 5 CPU0 and CPU1 are shown in the diagram.

[0166] In a specific implementation, as one example, the privacy-protected verifiable matrix multiplication device 410 may also include multiple processors, for example... Figure 5 The first processor 2001 and the second processor 2004 are shown in the diagram. Each of these processors can be a single-core processor or a multi-core processor. Here, a processor can refer to one or more devices, circuits, and / or processing cores used to process data (such as computer program instructions).

[0167] The memory 2002 is used to store the software program that executes the present invention, and is controlled by the first processor 2001 to execute it. The specific implementation method can be referred to the above method embodiment, and will not be repeated here.

[0168] Optionally, the memory 2002 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. The memory 2002 may be integrated with the first processor 2001 or may exist independently, and may be connected to the interface circuit of the privacy-protected verifiable matrix multiplication device 410. Figure 5 (Not shown in the image) is coupled to the first processor 2001, and this embodiment of the invention does not specifically limit this.

[0169] The transceiver 2003 is used to communicate with network devices or with terminal devices.

[0170] Alternatively, transceiver 2003 may include a receiver and a transmitter. Figure 5 (Not shown separately). The receiver is used to implement the receiving function, and the transmitter is used to implement the transmitting function.

[0171] Optionally, the transceiver 2003 can be integrated with the first processor 2001 or exist independently, and can be connected to the interface circuit of the privacy-protected verifiable matrix multiplication device 410. Figure 5 (Not shown in the image) is coupled to the first processor 2001, and this embodiment of the invention does not specifically limit this.

[0172] It should be noted that, Figure 5 The structure of the privacy-protected verifiable matrix multiplication device 410 shown does not constitute a limitation on the router. Actual knowledge structure identification devices may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0173] Furthermore, the technical effect of the privacy-preserving verifiable matrix multiplication device 410 can be referred to the technical effect of the privacy-preserving verifiable matrix multiplication method with a low critical dimension described in the above method embodiments, and will not be repeated here.

[0174] It should be understood that the first processor 2001 in the embodiments of the present invention may be a central processing unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc.

[0175] It should also be understood that the memory in the embodiments of the present invention can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous DRAM (DDR SDRAM), enhanced synchronous DRAM (ESDRAM), synchronous linked DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0176] The above embodiments can be implemented, in whole or in part, by software, hardware (such as circuits), firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive.

[0177] It should be understood that the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. A and B can be singular or plural. Additionally, the character " / " in this article generally indicates an "or" relationship between the preceding and following related objects, but it can also represent an "and / or" relationship. Please refer to the context for a more accurate understanding.

[0178] In this invention, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of a single item or a plurality of items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be a single item or multiple items.

[0179] It should be understood that, in various embodiments of the present invention, the order of the above-mentioned process numbers does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0180] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0181] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the devices, apparatuses, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0182] In the several embodiments provided by this invention, it should be understood that the disclosed devices, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0183] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0184] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0185] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0186] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A privacy-preserving verifiable matrix multiplication method with low critical dimension, characterized in that The method is implemented by a privacy-preserving verifiable matrix multiplication system with a relatively low critical dimension, the system comprising a user and a service provider, and the method comprises: S1. The user generates public parameters based on security parameters and the key ; S2. The user determines the public parameters , key And the function family , generate the decoding key , Evaluation Key and verification key ; S3, the user uses the key And the matrix , generating the matrix The ciphertext , decoding key and verification key ; S4. The service provider evaluates the key And the ciphertext , and get the encrypted calculation result ; S5. The user evaluates the key , the encrypted calculation result Verify the correctness of and obtain the verification result; S6. If the verification result is correct, the user enters the decoding key , decoding key And the encrypted calculation results , and the encrypted calculation result Decode and get the final calculation result.

2. The privacy-preserving verifiable matrix multiplication method with lower critical dimension according to claim 1, characterized in that The user in S1 generates public parameters based on security parameters and the key ,include: S11, the user calls the initialization module in the improved symmetric linear homomorphic encryption scheme to generate public parameters ; S12, according to the public parameters , call the key generation module in the improved symmetric linear homomorphic encryption scheme to generate the key .

3. The privacy-preserving verifiable matrix multiplication method with lower critical dimension according to claim 2, characterized in that The user in S11 calls the initialization module in the improved symmetric linear homomorphic encryption scheme to generate public parameters ,include: The user and service provider generate security parameters , and select two prime numbers , And in the ring The noise distribution on , generate public parameters ; The step S12 is based on the public parameters , call the key generation module in the improved symmetric linear homomorphic encryption scheme to generate the key ,include: From the public parameters Random uniform sampling is performed in the sample to obtain the sampling result , and record the key as .

4. The privacy-preserving verifiable matrix multiplication method with lower critical dimension according to claim 1, characterized in that The user in S2 according to the public parameter , key And the function family , generate the decoding key , Evaluation Key and verification key ,include: The user from the function family Get a function in , the function Divide Row vector , generates a decoding key based on the row vector , Evaluation Key and verification key ; in, Indicates that the public parameters The sampling results of random uniform sampling in , It means to find the sum of all vectors of the input row vector.

5. The privacy-preserving verifiable matrix multiplication method with lower critical dimension according to claim 1, characterized in that The user in S3 uses the key And the matrix , generating the matrix The ciphertext , decoding key and verification key ,include: S31, the user sets the matrix Decompose into Block Matrix ,in, , represents the transpose of a matrix, , represents the domain of integers, represents the modulus of the matrix contents, , Indicates the dimension of the matrix; S32, the , encrypted according to the encoding module in the improved symmetric linear homomorphic encryption scheme, and the ciphertext is obtained ; S33, according to the ciphertext , and get the matrix The ciphertext , decoding key and verification key .

6. The privacy-preserving verifiable matrix multiplication method with lower critical dimension according to claim 5, characterized in that The encoding process of the encoding module in the improved symmetric linear homomorphic encryption scheme includes: Get the key and message sequence ;in, The order is The cyclic group of Matrix of order; From the order Cyclic group of Random sampling to get parameters , from the noise distribution The noise sequence is obtained by sampling ; make , , , calculate the ciphertext ;in, Indicates the sampling result.

7. The privacy-preserving verifiable matrix multiplication method with lower critical dimension according to claim 1, characterized in that The encrypted calculation result in S6 Decode and get the final calculation results, including: The encrypted calculation result , will Row and The columns are represented as According to the decoding module in the improved symmetric linear homomorphic encryption scheme Decode and get the decoding result , and then get the final calculation result , as shown in the following formula (1): （1） In the formula, Represents the final calculation result, Indicates converting the input elements into coefficient vectors. express Decoding result, express row vectors, express piece.

8. A privacy-preserving verifiable matrix multiplication system with a lower critical dimension, wherein the privacy-preserving verifiable matrix multiplication system with a lower critical dimension is used to implement the privacy-preserving verifiable matrix multiplication method with a lower critical dimension as claimed in any one of claims 1 to 7, characterized in that: The system includes a user and a service provider, wherein: The user is used to generate public parameters based on security parameters and the key ; According to the public parameters , key And the function family , generate the decoding key , Evaluation Key and verification key According to the key And the matrix , generating the matrix The ciphertext , decoding key and verification key ; Based on the evaluation key , the encrypted calculation result The correctness of the verification is verified to obtain the verification result; if the verification result is correct, the decoding key is input , decoding key And the encrypted calculation results , and the encrypted calculation result Decode and obtain the final calculation result; The service provider, for evaluating the key And the ciphertext , and get the encrypted calculation result .

9. A privacy-preserving verifiable matrix multiplication device, characterized in that: The privacy-preserving verifiable matrix multiplication device comprises: processor; A memory having computer-readable instructions stored thereon, wherein when the computer-readable instructions are executed by the processor, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores program codes, which can be called by a processor to execute the method according to any one of claims 1 to 7.

Images