Fully homomorphic encryption method, system, device and medium suitable for ciphertext encryption

Abstract

The present invention relates to the field of computer information security technology, and in particular to a fully homomorphic encryption method, system, device and medium suitable for ciphertext encryption. When an application server needs to query the sum or product of multiple fields or compare fields, a query request is initiated to a proxy server; the proxy server receives the request from the application server, encrypts the key fields of the user's query statement, and still ensures the grammatical requirements of the query statement, and sends the encrypted query statement to an encrypted database; the proxy server receives the ciphertext data returned from the terminal database, and performs addition, multiplication or comparison operations on the ciphertext data according to the query statement requirements, and decrypts the operation results and sends them to the application server. The fully homomorphic encryption method suitable for ciphertext encryption provided by the present invention only requires simple large integer operations, has the advantages of low computational overhead, fast computational speed and easy implementation, and realizes efficient data retrieval.

Description

Technical Field

[0001] This invention relates to the field of computer information security technology, and in particular to a fully homomorphic encryption method, system, device, and medium suitable for ciphertext encryption. Background Technology

[0002] In today's information age, data has become the most valuable resource. For individuals, data serves as a record and record, such as photos and videos. For organizations, large amounts of data can help make better decisions; for example, travel companies can plan better routes for users. Data is an integral part of people's daily lives, and it is usually stored centrally. Many companies offer cloud storage technology, which allows users to store their data in the cloud; its essence is database storage technology. Storing personal or corporate data, especially private data, on third-party servers is not secure. The numerous data breaches in recent years have made people pay more attention to data security, and the security of databases as storage media has also received widespread attention.

[0003] Databases, as data storage media, contain massive amounts of data. Faced with various network attacks and security threats, traditional authentication mechanisms alone are no longer sufficient to protect user data security. Many scholars have begun to research methods to improve data security. Among numerous research techniques, encrypted data storage has become the most direct and effective means. Data encryption involves encrypting a meaningful plaintext sequence into a meaningless ciphertext sequence using an encryption algorithm and key. Even if an attacker obtains the ciphertext information, without the decryption key and an unknown encryption algorithm, they cannot obtain any useful information about the original data. This method greatly improves the security of user data.

[0004] Encrypted data storage can solve security issues, but as information, data is subject to random access, meaning it can be accessed by users at any time. Before encryption, data inherently possesses many attributes, such as the comparability and order of numerical data, and the presence of keywords in character data. These attributes support numerous retrieval methods for plaintext data. Encryption disrupts these original attributes, making many operations performed directly on plaintext data impossible to perform on ciphertext, thus hindering ciphertext retrieval. For users, data retrieval is an essential operation, such as retrieving personal photos from the internet or matching website passwords. Inefficient retrieval is unacceptable. Therefore, providing efficient retrieval services while ensuring user data security is of significant research importance. Summary of the Invention

[0005] The main objective of this invention is to provide a lightweight fully homomorphic encryption scheme suitable for database encryption, which has the advantages of low computational overhead, fast computation speed, and ease of implementation.

[0006] To achieve the above objectives, the first aspect of this invention proposes a fully homomorphic encryption method suitable for ciphertext encryption, comprising a proxy server performing the following steps: Randomly generate two large prime numbers of a preset bit length, and simultaneously generate the current timestamp; A public-private key pair is generated based on two large prime numbers and a timestamp. This public-private key pair is used to encrypt data for storage in an encrypted database. Receive a query request initiated by a user server. The query request includes a query statement, which includes query key fields, homomorphic computation types, and computation objects. The query key fields in the query statement are encrypted using the public key of the public-private key pair to obtain the encrypted query statement, which is then sent to the encrypted database. Receive ciphertext of a query from an encrypted database, wherein the ciphertext is the corresponding data retrieved by the encrypted database after receiving the encrypted query statement; Perform homomorphic computation on the query ciphertext according to the type of homomorphic computation to obtain the query result; The query results are decrypted using the private key to obtain the plaintext query results; The query results are sent in plaintext to the user server.

[0007] Furthermore, generating a public-private key pair based on two large prime numbers and a timestamp involves the following steps: Multiplying two large prime numbers gives the product of two large prime numbers; Take any large prime number as the private key, and use the current timestamp as the base and the large prime number used as the private key as the exponent to perform an exponentiation operation, resulting in the product of the large prime number and the current timestamp. Multiply the current timestamps of the large prime numbers as the dividend, and use the product of the two large prime numbers as the divisor to perform a modulo operation to obtain the first remainder; Take the first remainder, the large prime number used as the private key, and the product of the two large prime numbers as the public key.

[0008] Furthermore, encrypting the key query fields in the query statement using the public key of the public-private key pair includes the following steps: Identify key fields in the query statement; When the query key field meets the plaintext value range, the query key field is summed with the product of the large prime number used as the private key and the first remainder to obtain the summation result; Using the sum as the dividend and the product of the two prime numbers as the divisor, a modulo operation is performed to obtain the second remainder, which is the key encryption field.

[0009] Furthermore, obtaining the encrypted query statement involves the following steps: Convert the key fields in the query statement into encrypted key fields; The query statement with encrypted key fields is split according to the calculation object to obtain multiple encrypted query statements that correspond one-to-one with the query object.

[0010] Furthermore, decrypting the query result using the private key involves performing a modulo operation with the query result as the dividend and a large prime number (used as the private key) as the divisor to obtain the third remainder.

[0011] A second aspect of this invention discloses a fully homomorphic encryption system suitable for ciphertext encryption, comprising: The key generation module is used to randomly generate two large prime numbers of a preset bit length and generate the current timestamp; it is also used to generate a public-private key pair based on the two large prime numbers and the timestamp, and the public-private key pair is used to encrypt data for storage in an encrypted database; The request receiving module is used to receive query requests initiated by the user server. The query request includes a query statement, which includes query key fields, homomorphic computation types, and computation objects. The request encryption module is used to encrypt the key fields in the query statement based on the public key of the public-private key pair, obtain the encrypted query statement, and send the encrypted query statement to the encrypted database. The ciphertext receiving module is used to receive ciphertext queries from an encrypted database, wherein the ciphertext queries are the corresponding data retrieved by the encrypted database after receiving an encrypted query statement; The homomorphic computation module performs homomorphic computations on the ciphertext of the query according to the type of homomorphic computation to obtain the query result. Specifically, the homomorphic computation module includes an addition unit, a multiplication unit, and a size comparison unit. The addition unit handles homomorphic addition calculations. The multiplication unit handles homomorphic multiplication calculations. The size comparison unit handles size comparison calculations.

[0012] The decryption module is used to decrypt the query results using the private key to obtain the plaintext query results. The sending module is used to send the query results in plaintext to the user server.

[0013] Furthermore, the key generation module includes: The first calculation unit is used to multiply two large prime numbers to obtain the product of the two large prime numbers; The private key generation unit is used to select any large prime number as the private key. The second calculation unit is used to perform exponentiation with the current timestamp as the base and a large prime number as the exponent of the private key, to obtain the result of multiplying the current timestamp by a large prime number. The third calculation unit is used to perform a modulo operation by multiplying the current timestamps of a large prime number as the dividend and the product of the two large prime numbers as the divisor, to obtain the first remainder. The public key generation unit is used to take the first remainder, the large prime number used as the private key, and the product of the two large prime numbers as the public key.

[0014] Furthermore, the requested encryption module includes: The identification unit is used to identify key fields in the query statement. The fourth calculation unit is used to sum the query key field with the product of the large prime number used as the private key and the first remainder when the query key field meets the plaintext value range, and obtain the summation result. The fifth calculation unit is used to perform a modulo operation with the summation result as the dividend and the product of the two prime numbers as the divisor to obtain the second remainder, which is the key encryption field.

[0015] The third aspect of the present invention discloses a fully homomorphic encryption device suitable for ciphertext encryption, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in any of the first aspects of the present invention.

[0016] A fourth aspect of the present invention discloses a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in any of the first aspects of the present invention.

[0017] The technical solution provided by this invention may include the following beneficial effects: In the fully homomorphic encryption method for ciphertext encryption provided by this invention, the proxy server generates a public key pair and stores the encrypted data in the terminal database. When the application server needs to query the sum or product of multiple fields or compare fields, it initiates a query request to the proxy server. The proxy server receives the request from the application server, encrypts the key fields of the user's query statement while still ensuring the syntax requirements of the query statement, and sends the encrypted query statement to the encrypted database. The terminal database receives the query statement, retrieves the ciphertext of the field records, and sends it to the proxy server. The proxy server receives the ciphertext data returned from the terminal database, performs addition, multiplication, or comparison operations on the ciphertext data according to the query statement requirements, decrypts the operation results, and sends them to the application server.

[0018] Existing fully homomorphic algorithms rely on algebraic operations in group and ring domains, while the fully homomorphic encryption method for ciphertext encryption provided by this invention only requires simple large integer operations. It has the advantages of low computational overhead, fast computation speed, and ease of implementation, enabling efficient data retrieval without requiring users to wait for a long time. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the structures shown in these drawings without creative effort.

[0020] Figure 1 This is a flowchart illustrating the fully homomorphic encryption method applicable to ciphertext encryption according to the present invention. Figure 2 This is an interaction diagram of the fully homomorphic encryption method applicable to ciphertext encryption according to the present invention; Figure 3 This is a schematic diagram of the fully homomorphic encryption system applicable to ciphertext encryption according to the present invention; Figure 4 This is a schematic diagram of the fully homomorphic encryption device applicable to ciphertext encryption according to the present invention. Detailed Implementation

[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0022] It should be noted that all directional indications (such as up, down, left, right, front, back, etc.) in the embodiments of the present invention are only used to explain the relative positional relationship and movement of each component in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indication will also change accordingly.

[0023] In this invention, unless otherwise explicitly specified and limited, the terms "connection," "fixed," etc., should be interpreted broadly. For example, "fixed" can mean a fixed connection, a detachable connection, or an integral part; it can mean a mechanical connection or an electrical connection; it can mean a direct connection or an indirect connection through an intermediate medium; it can mean the internal communication of two components or the interaction between two components, unless otherwise explicitly limited. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0024] Furthermore, in this invention, descriptions involving "first," "second," etc., are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the word "and / or" throughout the text means including three parallel solutions; taking "A and / or B" as an example, it includes solution A, solution B, or a solution that simultaneously satisfies A and B. Furthermore, the technical solutions of the various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. When the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed by this invention.

[0025] The system in which this invention is specifically applied includes an application server, a proxy server, and an encrypted database. The encrypted database is used to store encrypted data. The proxy server generates a public key pair and stores the encrypted data in the terminal database. When the application server needs to query the sum or product of multiple fields or compare fields, it initiates a query request to the proxy server. The proxy server receives the request from the application server, encrypts the key fields of the user's query statement while still ensuring the syntax requirements of the query statement, and sends the encrypted query statement to the encrypted database. The terminal database receives the query statement, retrieves the encrypted field records, and sends them to the proxy server. The proxy server receives the encrypted data returned from the terminal database, performs addition, multiplication, or comparison operations on the encrypted data according to the query statement requirements, decrypts the operation results, and sends them to the application server.

[0026] Specifically, the following is combined with Figure 1 This describes a fully homomorphic encryption method applicable to ciphertext encryption according to embodiments of the present invention. The proxy server performs the following steps: Step S1: Randomly generate two large prime numbers with a preset bit length, and simultaneously generate the current timestamp; specifically, two large prime numbers can be randomly generated based on the input security parameters. The security parameters include the number of large prime numbers to generate and the preset bit length of the large prime numbers. More specifically, in one embodiment of the invention, the input security parameter (2, l Two are randomly generated. lbits Large prime numbers of length p , q .

[0027] Step S2: Generate a public-private key pair based on two large prime numbers and a timestamp. The public-private key pair is used to encrypt data for storage in an encrypted database.

[0028] Specifically, generating a public-private key pair based on two large prime numbers and a timestamp involves the following steps: Step S21: Multiply the two large prime numbers to obtain the product of the two large prime numbers; Step S22: Take any large prime number as the private key, and use the current timestamp as the base and the large prime number used as the private key as the exponent to perform an exponentiation operation to obtain the result of multiplying the large prime number by the current timestamp. Step S23: Multiply the current timestamps of the large prime numbers as the dividend, and use the product of the two large prime numbers as the divisor to perform a modulo operation to obtain the first remainder; Step S24: Take the first remainder, the large prime number used as the private key, and the product of the two large prime numbers as the public key.

[0029] That is, step S2 calculates the public key and private key using the two large prime numbers and the current timestamp according to the following formulas (1) and (2): Formula (1); Formula (2); in, n The product of two prime numbers, p For a large prime number to be used as the private key, q For another large prime number, r The first remainder, timestamp This is the current timestamp. timestamp p For the current timestamp p The power of . Correspondingly, the public key of the public-private key pair is . p k ( p , r , n ), private key is s k ( p ).

[0030] For example: Table (1) below shows the Student table that needs to be stored in an encrypted database:

[0031] The proxy server uses the public key p k ( p , r , n The fields are encrypted to obtain Table (2), which is the Student data table stored in the encrypted database after encryption.

[0032]

[0033] Step S3: Receive a query request initiated by the user server. The query request includes a query statement, which includes the query key fields, the type of homomorphic computation, and the computation object. For example, based on Tables (1) and (2), the query statement is: SELECT Name, Sources1+Sources2 From Student WHERE Age >16; In this query, "16" is the key field, Sources1+Sources2 is an addition operation in the homomorphic computation category, and Sources1 and Sources2 are the computation objects. The query can be understood as: find people in the Student table who are older than 16, and output their names and the sum of their scores 1 and 2.

[0034] Step S4: Encrypt the key fields in the query statement using the public key of the public-private key pair to obtain the encrypted query statement, and send the encrypted query statement to the encrypted database; Step S41: Identify the key query field in the query statement; specifically, according to the example query statement above, identify "16" as the key query field.

[0035] Step S42: When the query key field meets the plaintext value range, sum the query key field with the product of the large prime number used as the private key and the first remainder to obtain the summation result; Step S43: Using the summation result as the dividend and the product of the two prime numbers as the divisor, perform a modulo operation to obtain the second remainder. The second remainder is the encryption key field.

[0036] Examples are provided for steps S42 and S43. Specifically, the key field "16" can be queried. The judgment, among which m The unencrypted query key field is used to determine whether it meets the plaintext value range. If it exceeds the plaintext value range, it needs to be segmented, padded, and then encrypted. When the above conditions are met, the query key field is calculated according to formula (3) to obtain the encrypted key field: Formula (3); Where 'c' is the encryption key field. m For unencrypted query key fields, n The product of two prime numbers, p For a large prime number to be used as the private key, r It is the first remainder.

[0037] More specifically, the key field “16” is encrypted as “86691299036136340305573900146953” after being calculated according to formula (3).

[0038] Step S44: Convert the query key fields in the query statement into encrypted key fields; that is, the query statement is: SELECT Name, Sources1+Sources2 From Student WHERE Age >86691299036136340305573900146953; Step S45: Split the query statement with encrypted key fields according to the calculation object to obtain multiple encrypted query statements that correspond one-to-one with the query object.

[0039] Since the encrypted database lacks the ability to compute large prime numbers, the query statement was broken down according to the computational object: The first query statement: SELECT Name, Sources1 From Student WHERE Age > 86691299036136340305573900146953; can be understood as: finding people in the Student table who are older than 16 years old and outputting their names and scores of 1. The second query statement: SELECT Name, Sources2 From Student WHERE Age > 86691299036136340305573900146953; can be understood as: finding people in the Student table who are older than 16 years old and outputting their names and scores of 2.

[0040] As can be seen from the above examples, in the embodiments of the present invention, if there are N computational objects in the query statement, then N corresponding encrypted query statements will be split out, where N is a positive integer greater than 2. The splitting process retains only one computed object in the query statement, removing homomorphic computed requests and other computed objects. This ensures that the query statement meets the syntax requirements.

[0041] The encrypted database can retrieve the encrypted data corresponding to score 1 of students older than 16 based on the first query. The encrypted database can retrieve the encrypted data corresponding to score 2 of students older than 16 based on the second query.

[0042] Step S5: Receive the query ciphertext from the encrypted database. The query ciphertext is the corresponding data retrieved by the encrypted database after receiving the encrypted query statement; that is, the proxy server receives the encrypted data corresponding to the score 1 of students older than 16 and the encrypted data corresponding to the score 2 of students older than 16 retrieved by the encrypted database.

[0043] Step S6: Perform homomorphic computation on the query ciphertext according to the type of homomorphic computation to obtain the query result; specifically, the types of homomorphic computation include addition, multiplication and size comparison.

[0044] Step S7: Decrypt the query result using the private key to obtain the plaintext query result.

[0045] Specifically, the query result is used as the dividend, and the large prime number used as the private key is used as the divisor for modulo operation to obtain the third remainder. That is, the query result is calculated according to Formula 4.

[0046] Formula (4); in, The query result is in plaintext, i.e., the decrypted result. For the query results, .

[0047] Among them, for the plaintext of the query results ,have: Formula (5); That is, for the decryption result, if If the result is the same as the original result, then return the result. ,like If the result is negative, then calculate and return the result. .

[0048] To be more specific, let's take addition as an example: The ciphertext obtained from the first query statement is: , , The first plaintext is unencrypted; the second query statement returns the ciphertext as follows: , = ; This is the unencrypted second plaintext.

[0049] Homomorphic addition is calculated as follows: Formula (6); in, This is the query result after homomorphic addition.

[0050] Among them, for The decryption result is proven as follows: Formula (7); Formula (8); Q.E.D. That is, homomorphic addition exists. It meets the requirements for homomorphic addition calculation.

[0051] To be more specific, taking multiplication as an example: the ciphertext obtained from the first query statement is... , , The first plaintext is unencrypted; the second query statement returns the ciphertext as follows: , = ; This is the unencrypted second plaintext.

[0052] Homomorphic multiplication is calculated as follows: Formula (9); in, This is the query result after homomorphic multiplication.

[0053] Among them, for The decryption result is proven as follows: Formula (10); Formula (11); Q.E.D. That is, homomorphic multiplication exists. It meets the requirements for homomorphic multiplication calculation.

[0054] To be more specific, taking size comparison as an example: the ciphertext obtained from the first query statement is... , , The first plaintext is unencrypted; the second query statement returns the ciphertext as follows: , = ; This is the unencrypted second plaintext.

[0055] Size comparison calculation is as follows: Formula (12); in The difference between the two ciphertexts is used to determine the decryption result. If true, return. The value is greater than Otherwise, return The value is greater than .

[0056] Make the following proof: Formula (13); Formula (14); Formula (15); Formula (16); In summary, the decryption result is compared with 0. If the decryption result... It can be concluded that ,on the contrary .

[0057] Q.E.D.

[0058] Step S8: Send the query result in plaintext to the user server.

[0059] Existing fully homomorphic algorithms rely on algebraic operations in group and ring domains, while the fully homomorphic encryption method for ciphertext encryption provided by this invention only requires simple large integer operations. It has the advantages of low computational overhead, fast computation speed, and ease of implementation, enabling efficient data retrieval without requiring users to wait for a long time.

[0060] A second aspect of the present invention discloses a fully homomorphic encryption system 300 suitable for ciphertext encryption, comprising: The key generation module 301 is used to randomly generate two large prime numbers of a preset bit length and generate the current timestamp; it is also used to generate a public-private key pair based on the two large prime numbers and the timestamp, the public-private key pair being used to encrypt data for storage in an encrypted database; The request receiving module 302 is used to receive a query request initiated by the user server. The query request includes a query statement, which includes query key fields, homomorphic computation types, and computation objects. The encryption module 303 is requested to encrypt the key fields in the query statement according to the public key of the public-private key pair, obtain the encrypted query statement, and send the encrypted query statement to the encrypted database. The ciphertext receiving module 304 is used to receive query ciphertext from the encrypted database, wherein the query ciphertext is the corresponding data retrieved by the encrypted database after receiving the encrypted query statement; The homomorphic computation module 305 is used to perform homomorphic computation on the query ciphertext according to the type of homomorphic computation to obtain the query result. The decryption module 306 is used to decrypt the query results using the private key to obtain the plaintext of the query results; The sending module 307 is used to send the query result in plaintext to the user server.

[0061] Furthermore, the key generation module 301 includes: The parameter generation unit is used to randomly generate two large prime numbers of a preset bit length, and at the same time generate the current timestamp; The first calculation unit is used to multiply two large prime numbers to obtain the product of the two large prime numbers; The private key generation unit is used to select any large prime number as the private key. The second calculation unit is used to perform exponentiation with the current timestamp as the base and a large prime number as the exponent of the private key, to obtain the result of multiplying the current timestamp by a large prime number. The third calculation unit is used to perform a modulo operation by multiplying the current timestamps of a large prime number as the dividend and the product of the two large prime numbers as the divisor, to obtain the first remainder. The public key generation unit is used to take the first remainder, the large prime number used as the private key, and the product of the two large prime numbers as the public key.

[0062] Furthermore, the request encryption module 303 includes: The identification unit is used to identify key fields in the query statement. The fourth calculation unit is used to sum the query key field with the product of the large prime number used as the private key and the first remainder when the query key field meets the plaintext value range, and obtain the summation result. The fifth calculation unit is used to perform a modulo operation with the summation result as the dividend and the product of the two prime numbers as the divisor to obtain the second remainder, which is the key encryption field.

[0063] Furthermore, the request encryption module 303 also includes: An encryption unit is used to convert key query fields in a query statement into encrypted key fields. The splitting unit is used to split the query statement with encrypted key fields according to the calculation object, so as to obtain multiple encrypted query statements that correspond one-to-one with the query object.

[0064] Furthermore, the decryption module 306 includes: The sixth calculation unit is used to perform a modulo operation with the query result as the dividend and a large prime number used as the private key as the divisor to obtain the third remainder.

[0065] It should be noted that the fully homomorphic encryption system 300 for ciphertext encryption provided in this embodiment of the invention can be built on a proxy server, and the various units and modules mentioned above can refer to program modules or units. Furthermore, more details and corresponding technical effects of the system in this embodiment of the invention can be found in the description of the method embodiments above, and will not be repeated here.

[0066] The system described in the above embodiments of the present invention can be used to execute the corresponding method embodiments of the present invention and achieve the technical effects achieved by the above method embodiments of the present invention, which will not be repeated here.

[0067] like Figure 4 As shown, another aspect of the present invention discloses a fully homomorphic encryption device 400 suitable for ciphertext encryption, comprising: a processor 401 and a memory 402. The processor 401 and the memory 402 are connected, for example, via a bus 403. Further, the fully homomorphic encryption device 400 suitable for ciphertext encryption may also include a transceiver 404. It should be noted that in practical applications, the transceiver 404 is not limited to one, and the structure of the fully homomorphic encryption device 400 suitable for ciphertext encryption does not constitute a limitation on the embodiments of this application. The processor 401 is used in the embodiments of this application to implement the functions of various units and modules of the fully homomorphic encryption system suitable for ciphertext encryption. The processor 401 may be a CPU, a general-purpose processor, a DSP, an ASIC, an FPGA, or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor 401 may also be a combination that implements computing functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc. The bus 403 may include a path for transmitting information between the above components. Bus 403 can be a PCI bus or an EISA bus, etc. Bus 403 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 4 The term "bus" is represented by a single thick line, but this does not imply that there is only one bus or one type of bus. The memory 402 can be a ROM or other type of static storage device capable of storing static information and instructions, RAM or other type of dynamic storage device capable of storing information and instructions, or it can be an EEPROM, CD-ROM or other optical disc storage, optical disk storage (including compressed optical disks, laser discs, optical discs, digital universal optical disks, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto. The memory 402 is used to store application program code that executes the scheme of this application, and its execution is controlled by the processor 401. The processor 401 is used to execute the application program code stored in the memory 402 to implement the fully homomorphic encryption method suitable for ciphertext encryption provided by this invention.

[0068] On the other hand, embodiments of the present invention provide a storage medium on which a computer program is stored, the program being executed by a processor of the steps of a fully homomorphic encryption method applicable to ciphertext encryption as performed by the server described above.

[0069] The above-described product can perform the methods provided in the embodiments of this application, and has the corresponding functional modules and beneficial effects for performing the methods. Technical details not described in detail in this embodiment can be found in the methods provided in the embodiments of this application.

[0070] The optional embodiments of the present invention have been described in detail above with reference to the accompanying drawings. However, the embodiments of the present invention are not limited to the specific details in the above embodiments. Within the scope of the technical concept of the embodiments of the present invention, various simple modifications can be made to the technical solutions of the embodiments of the present invention, and these simple modifications all fall within the protection scope of the embodiments of the present invention.

[0071] It should also be noted that the various specific technical features described in the above embodiments can be combined in any suitable manner without contradiction. To avoid unnecessary repetition, the embodiments of the present invention will not describe the various possible combinations separately.

[0072] The above description is only a preferred embodiment of the present invention and does not limit the patent scope of the present invention. All equivalent structural transformations made under the concept of the present invention using the contents of the present invention specification and drawings, or direct / indirect applications in other related technical fields, are included within the patent protection scope of the present invention.

Claims

1. A fully homomorphic encryption method suitable for ciphertext encryption, characterized by: Including the proxy server performs the following steps: Randomly generate two large prime numbers with preset bit lengths and generate the current timestamp at the same time; Generate a public-private key pair based on two large prime numbers and a timestamp, wherein the public-private key pair is used to encrypt data for storage in an encrypted database; Receiving a query request initiated by a user server, the query request including a query statement, the query statement including a query key field, a homomorphic computing type, and a computing object; Encrypting a query key field in the query statement according to the public key of the public-private key pair to obtain an encrypted query statement, and sending the encrypted query statement to an encryption database; Receiving a query ciphertext from an encrypted database, wherein the query ciphertext is corresponding data retrieved by the encrypted database after receiving the encrypted query statement; Perform homomorphic computation on the query ciphertext according to the type of homomorphic computation to obtain the query result; Decrypt the query result using the private key to obtain the plain text of the query result; The query result is sent in plain text to the user server.

2. The fully homomorphic encryption method suitable for ciphertext encryption according to claim 1, characterized in that: Generating a public-private key pair based on two large prime numbers and a timestamp includes the following steps: Multiply two large prime numbers to get the product of the two large prime numbers; Take any large prime number as the private key, use the current timestamp as the base, and perform a power operation with the large prime number as the exponent to get the multiplication result of the large prime number and the current timestamp; Use the result of multiplying the current timestamp by a large prime number as the dividend, and the product of the two prime numbers as the divisor to perform a modulo operation to obtain the first remainder; Take the first remainder, the large prime number used as the private key, and the product of two large prime numbers as the public key.

3. The fully homomorphic encryption method suitable for ciphertext encryption according to claim 2, characterized in that: Encrypting the query key field in the query statement using the public key of the public-private key pair includes the following steps: Identify the query key fields in the query statement; When the query key field meets the plaintext value range, the query key field and the product of the large prime number as the private key and the first remainder are summed to obtain a sum result; A modular operation is performed with the sum result as the dividend and the product of the two prime numbers as the divisor to obtain a second remainder, where the second remainder is an encryption key field.

4. The fully homomorphic encryption method suitable for ciphertext encryption according to claim 3, characterized in that: Obtaining the encrypted query statement includes the following steps: Convert the query key field in the query statement into an encrypted key field; The query statement with the encrypted key field is split according to the calculation object to obtain multiple encrypted query statements corresponding to the query objects one by one.

5. The fully homomorphic encryption method suitable for ciphertext encryption according to claim 1, characterized in that: Decrypting the query result using the private key includes: performing a modulo operation using the query result as a dividend and a large prime number serving as the private key as a divisor to obtain a third remainder.

6. A fully homomorphic encryption system suitable for ciphertext encryption, characterized by: include: The key generation module is used to randomly generate two large prime numbers with preset bit lengths and generate the current timestamp; Also used to generate a public-private key pair based on two large prime numbers and a timestamp, wherein the public-private key pair is used to encrypt data for storage in an encrypted database; A request receiving module, used to receive a query request initiated by a user server, wherein the query request includes a query statement, and the query statement includes a query key field, a homomorphic computing type, and a computing object; A request encryption module is used to encrypt the query key field in the query statement according to the public key of the public-private key pair to obtain an encrypted query statement, and send the encrypted query statement to the encryption database; A ciphertext receiving module, used to receive a query ciphertext from an encrypted database, wherein the query ciphertext is corresponding data retrieved after the encrypted database receives the encrypted query statement; A homomorphic computing module is used to perform homomorphic computing on the query ciphertext according to the homomorphic computing type to obtain the query result; A decryption module is used to decrypt the query result using a private key to obtain the query result in plain text; The sending module is used to send the query result in plain text to the user server.

7. The fully homomorphic encryption system suitable for ciphertext encryption according to claim 6, characterized in that: The key generation module includes: A first calculation unit is used for multiplying two large prime numbers to obtain the product of the two large prime numbers; A private key generation unit, used to take any large prime number as a private key; The second calculation unit is used to perform a power operation with the current timestamp as the base and the large prime number as the private key as the exponent to obtain a multiplication result of the large prime number and the current timestamp; A third calculation unit is used for performing a modulo operation using a multiplication result of a large prime number and a current timestamp as a dividend and a product of the two prime numbers as a divisor to obtain a first remainder; The public key generation unit is used to take the first remainder, the large prime number used as the private key and the product of two large prime numbers as the public key.

8. The fully homomorphic encryption system suitable for ciphertext encryption according to claim 6, characterized in that: The request encryption module includes: An identification unit, used for identifying a query key field in a query statement; A fourth calculation unit is used to sum the query key field with the product of the large prime number as the private key and the first remainder to obtain a sum result when the query key field meets the plaintext value range; The fifth calculation unit is used to perform a modular operation with the sum result as the dividend and the product of the two prime numbers as the divisor to obtain a second remainder, where the second remainder is an encryption key field.

9. A fully homomorphic encryption device suitable for ciphertext encryption, characterized in that: The method comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method according to any one of claims 1 to 5 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 5.

Images