Verifiable fully homomorphic encryption method and device based on homomorphic message authentication code

Abstract

The invention discloses a verifiable fully homomorphic encryption method and device based on a homomorphic message authentication code. The method comprises the steps that a client generates a verification label corresponding to a message through a hash function; the client performs batch processing coding on the message and the verification label to obtain a message polynomial and a verification label polynomial; the client performs coding encryption on the message polynomial and the verification label polynomial, and sends an obtained ciphertext to the cloud server; the cloud server performs homomorphic calculation on the ciphertext and returns an obtained ciphertext calculation result to the client; and the client verifies the ciphertext calculation result, and receives the message calculation result if the verification is passed. Through the technical scheme, the verification process of the ciphertext calculation result is simple, the verification overhead is relatively low, the verification has reusability and is not influenced by the circuit depth, coding is processed by using a batch processing technology, a plurality of messages can be processed at the same time during homomorphic calculation and verification, and the verification overhead of a client is greatly reduced.

Description

Technical Field

[0001] The present invention belongs to the field of encryption technology, and specifically relates to a verifiable fully homomorphic encryption method and device based on homomorphic message authentication code. Background Art

[0002] With the rapid development of cloud computing, its powerful computing power and huge storage space provide strong support for data computing and processing. However, in recent years, security incidents such as data leakage and service interruption have often occurred in cloud computing services, which has exposed data to more security risks, so people are more concerned about security and privacy. With the development of cloud computing, more and more individuals and enterprises choose to share data to cloud servers for computing. However, this model requires data to be transmitted to the cloud, which increases the risk of data leakage during transmission, storage and sharing, leading to privacy issues.

[0003] In cloud computing, cloud service providers and third parties may access or leak users' sensitive data, resulting in privacy information leakage. However, by encrypting plaintext with verifiable fully homomorphic encryption technology, even if malicious parties have the authority to calculate data, they cannot access the original data content, avoiding problems such as data theft. Malicious or unreliable cloud service providers may return false or inaccurate calculation results, or external attackers may invade the cloud platform through vulnerabilities to obtain, tamper with or delete user data. This behavior can have serious consequences, especially in key areas (such as financial analysis and medical diagnosis).

[0004] The calculation results generated by the verifiable fully homomorphic encryption technology are accompanied by verification proofs, allowing users to verify the correctness of cloud computing. This means that even if the cloud service provider attempts to tamper with the calculation results or return incorrect results, users can still find out and ensure the integrity of data processing, which greatly reduces the risk of external attacks. In addition, it supports multi-party computing in the cloud, and each party can use their own encrypted data for collaborative analysis, and the calculation results are still encrypted and verifiable. This is particularly important for data processing involving multiple parties across fields and borders, and solves the data sharing dilemma in the cloud computing environment.

[0005] Fully homomorphic encryption is a powerful encryption technology that can perform any number of addition and multiplication calculations on ciphertext and is widely used to protect privacy in data computing. However, fully homomorphic encryption can only guarantee privacy and lacks the guarantee of correctness in cloud computing. HMAC (Homomorphic Message Authentication Codes) is one of the most commonly used methods to verify the correctness of calculation results, and its verification overhead is lower than other technologies. HMAC requires encoding preprocessing operations on message tags, but due to encoding technology reasons, most HMAC-based verifiable fully homomorphic encryption schemes support limited circuit depth and cannot simultaneously meet verification simplicity and tag reusability. In addition, since most current schemes require the client to calculate the message tag, a large verification overhead will be incurred. Summary of the invention

[0006] In order to solve the above problems existing in the prior art, the present invention provides a verifiable fully homomorphic encryption method and device based on homomorphic message authentication code.

[0007] The technical problem to be solved by the present invention is achieved through the following technical solutions:

[0008] In a first aspect, the present invention provides a verifiable fully homomorphic encryption method based on a homomorphic message authentication code, the method comprising:

[0009] The client generates a verification tag corresponding to the message through a hash function;

[0010] The client performs batch encoding on the message and the verification tag to obtain a message polynomial and a verification tag polynomial;

[0011] The client encodes and encrypts the message polynomial and the verification tag polynomial, and sends the obtained ciphertext to the cloud server;

[0012] The cloud server performs homomorphic calculation on the ciphertext, and returns the obtained ciphertext calculation result to the client;

[0013] The client verifies the ciphertext calculation result, and if the verification passes, accepts the message calculation result obtained based on the ciphertext calculation result.

[0014] Optionally, before the client generates a verification tag corresponding to the message through a hash function, the method further includes:

[0015] The client runs the BFV key generation algorithm according to the system parameters to obtain the public and private key pair and evaluation key

[0016] The client runs the HMAC key generation algorithm to obtain the HMAC private key sk.

[0017] Optionally, the client generates a verification tag corresponding to the message through a hash function, including:

[0018] For each message, the client selects a string as an identifier;

[0019] The client uses the hash function to calculate each message and the corresponding identifier to obtain a verification tag corresponding to each message.

[0020] Optionally, the client encodes and encrypts the message polynomial and the verification tag polynomial, and sends the obtained ciphertext to the cloud server, including:

[0021] The client constructs a reversible matrix using the private key sk;

[0022] The client encodes the verification tag polynomial according to the reversible matrix and the corresponding inverse matrix to obtain a coding matrix;

[0023] The client obtains an encoding result according to the encoding matrix and the message polynomial;

[0024] The client uses the public-private key pair The public key in The encoding result is encrypted to obtain the ciphertext, and the ciphertext is sent to the cloud server.

[0025] Optionally, the cloud server performs homomorphic calculation on the ciphertext and returns the obtained ciphertext calculation result to the client, including:

[0026] The cloud server uses the evaluation key and performing homomorphic calculation on the received ciphertext using a calculation function; wherein the homomorphic calculation includes homomorphic multiplication and homomorphic addition;

[0027] Through homomorphic computing, the goal of the computing function is completed, the ciphertext computing result is obtained, and the ciphertext computing result is returned to the client.

[0028] Optionally, the client verifies the ciphertext calculation result, and if the verification passes, accepts the message calculation result obtained according to the ciphertext calculation result, including:

[0029] The client encodes the hash value corresponding to the message to obtain a hash value polynomial;

[0030] The client calculates the hash value polynomial according to the calculation function to obtain a first calculation result;

[0031] The client uses the public-private key pair The private key in Decrypting the ciphertext calculation result to obtain a second calculation result;

[0032] Decoding the second calculation result using the private key sk to obtain a third calculation result; wherein the third calculation result includes a plaintext polynomial and a corresponding verification tag polynomial;

[0033] The client verifies the third calculation result using the first calculation result, and receives the plaintext polynomial in the third calculation result if the verification succeeds;

[0034] The client performs an inverse operation on the plaintext polynomial to obtain the message calculation result.

[0035] Optionally, the encoding matrix is ​​expressed as follows:

[0036]

[0037] Among them, D i represents the encoding matrix corresponding to the i-th group of messages, {a,b,c,d} is the private key sk of HMAC, And meet represents uniform random sampling, represents the modulo t integer ring, t represents the plaintext modulus over the polynomial ring in the system parameter, represents the polynomial ring, X n +1 indicates the polynomial, N indicates the polynomial order of the polynomial ring, P i2 represents the verification tag polynomial corresponding to the i-th group of messages, e i is a random polynomial, represents the reversible matrix, represents the inverse matrix, and mod represents a modulo operation.

[0038] In a second aspect, the present invention provides a verifiable fully homomorphic encryption device based on a homomorphic message authentication code, the device comprising:

[0039] A tag generation module, used to generate a verification tag corresponding to a message using a hash function by the client;

[0040] A batch encoding module, used to perform batch encoding on the message and the verification tag using the client to obtain a message polynomial and a verification tag polynomial;

[0041] An encoding and encryption module, used to encode and encrypt the message polynomial and the verification tag polynomial using the client, and send the obtained ciphertext to the cloud server;

[0042] A homomorphic computing module, used to perform homomorphic computing on the ciphertext using the cloud server, and return the obtained ciphertext computing result to the client;

[0043] The result verification module is used to verify the ciphertext calculation result using the client, and if the verification is successful, accept the message calculation result obtained based on the ciphertext calculation result.

[0044] The technical solution provided by the embodiments of the present invention may have the following beneficial effects:

[0045] In the above technical scheme, the client generates a verification tag corresponding to the message through a hash function; the client performs batch encoding on the message and the verification tag to obtain a message polynomial and a verification tag polynomial; the client encodes and encrypts the message polynomial and the verification tag polynomial, and sends the obtained ciphertext to the cloud server; the cloud server performs homomorphic calculation on the ciphertext, and returns the obtained ciphertext calculation result to the client; the client verifies the ciphertext calculation result, and if the verification passes, the message calculation result obtained according to the ciphertext calculation result is accepted. The verification process of the ciphertext calculation result is simple, the verification overhead is low, and the verification is reusable, and the calculated verification tag can be used for subsequent calculations; and the present invention does not need to preset the circuit depth, is not affected by the circuit depth, and can perform any calculation; by using batch processing technology for processing encoding, multiple messages can be processed simultaneously during homomorphic calculation and verification, greatly reducing the verification overhead of the client.

[0046] The present invention will be further described in detail below with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 It is a flowchart of a verifiable fully homomorphic encryption method based on homomorphic message authentication code provided by an embodiment of the present invention;

[0048] Figure 2 It is a block diagram of a verifiable fully homomorphic encryption device based on homomorphic message authentication code provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0049] In order to facilitate the understanding of the scheme of the present invention, the relevant state of the prior art and the inventive concept of the present invention are first briefly described.

[0050] Verifiable computing is an important means. In 2013, some technicians proposed two specific implementations of HMAC-based schemes, both of which support low-order polynomial operations and are highly efficient, but cannot simultaneously meet the simplicity of verification and the reusability of labels. In 2014, some scholars abstracted the idea of ​​finite scalability coding, which supports verification to meet simplicity while meeting the reusability of labels to a certain extent, but the scheme is limited by the preset circuit depth. In 2022, some technicians proposed a verifiable fully homomorphic encryption scheme based on polynomial encoding, which uses a private key for polynomial encoding as a label. The client uses the encoded private key and the label for calculation in advance. After the cloud performs homomorphic calculation, it sends the homomorphic calculation results to the client. The client compares the pre-calculated label results with the returned homomorphic calculation results. The shortcoming of this scheme is that it can only meet the verification simplicity under low circuit depth, that is, the verification overhead of the receiver will exceed the overhead of verifying the original message when the circuit depth is large; its improved scheme is to use random masks to convert 5 ciphertext values ​​into 3 ciphertext values ​​to reduce the verification overhead. The shortcoming of this method is that it requires the server and the client to be online at the same time, the client needs to perform additional calculations, and the reusability of some calculation labels will be lost.

[0051] Most of the currently proposed HMAC-based verifiable fully homomorphic encryption algorithms are limited by circuit depth when verifying the calculation results, and cannot simultaneously meet the simplicity of verification and the reusability of labels. Therefore, the present invention proposes an Internet threat detection and backtracking method based on adaptive abnormal behavior analysis to solve this technical problem.

[0052] Figure 1 is a flowchart of a verifiable fully homomorphic encryption method based on homomorphic message authentication code provided by an embodiment of the present invention, such as Figure 1 As shown, the method comprises the following steps:

[0053] S101. The client generates a verification tag corresponding to the message through a hash function.

[0054] Optionally, before S101, the method may further include:

[0055] The client runs the BFV key generation algorithm based on the system parameters to obtain the public and private key pair. and evaluation key

[0056] The client runs the HMAC key generation algorithm to obtain the HMAC private key sk.

[0057] It can be understood that the client inputs the security parameter λ to generate the system parameter Γ={N,t,q} of the BFV encryption algorithm. represents a polynomial ring, X N+1 indicates the polynomial, N indicates the polynomial order of the polynomial ring, represents the modulus t integer ring, t represents the plaintext modulus on the polynomial ring in the system parameter; then, the client uses the system parameter Γ to run the key generation algorithm of the BFV encryption scheme and outputs the public and private key pair of the BFV encryption scheme and evaluation key And publish the public key and evaluation key And keep the private key secret In addition, the client uses the HMAC key generation algorithm to output the HMAC private key sk = {a, b, c, d, K}, where: And meet K is the private key of the hash function.

[0058] Optionally, S101 may include:

[0059] For each message, the client chooses a string as an identifier;

[0060] The client uses a hash function to calculate each message and the corresponding identifier to obtain a verification tag corresponding to each message.

[0061] It is understandable that the client can generate labels for n groups, each with l messages; specifically, for the message (m i1 ,m i2 ,...,m il ), the client for each message m ij (j=1,2,...,l) select a string τ ij As a unique identifier, let it be the message m ij The corresponding label; then the client uses the hash function Hash: For message m ij and its label τ ij Calculate and get Hash(τ ij )-m ij , as the verification tag of the message, where m ij Belongs to the message space i=1,2,...,n,j=1,2,...,l.

[0062] S102: The client performs batch encoding on the message and the verification tag to obtain a message polynomial and a verification tag polynomial.

[0063] It can be understood that the client uses the Single Instruction Multiple Data (SIMD) technology to batch encode n groups of messages and corresponding verification tags, where for the i-th group (i=1,2,...,n), the i-th group of messages (m i1 ,m i2 ,...,m il ) and its corresponding verification tag (Hash(τ i1 )-m i1 ,Hash(τ i2 )-m i2 ,...,Hash(τ il )-m il ) are encoded as polynomials P i1 , Among them, P i1 represents the message polynomial, P i2 represents the verification label polynomial.

[0064] S103: The client encodes and encrypts the message polynomial and the verification tag polynomial, and sends the obtained ciphertext to the cloud server.

[0065] Optionally, S103 may include:

[0066] The client uses the private key sk to construct a reversible matrix;

[0067] The client encodes the verification tag polynomial according to the reversible matrix and the corresponding inverse matrix to obtain the encoding matrix;

[0068] The client obtains the encoding result based on the encoding matrix and the message polynomial;

[0069] The client uses a public-private key pair The public key in The encoding result is encrypted to obtain the ciphertext, and the ciphertext is sent to the cloud server.

[0070] It is understandable that the client uses the private key sk of the HMAC algorithm to construct a reversible matrix. and its inverse matrix To verify the label polynomial P for n groups i2 (i=1,2,...,n) for encoding; for the i-th group of verification label polynomials, generate a 2×2 dimensional encoding matrix D i , message polynomial P i1 With the encoding matrix D i The encoding result is: y i =(P i1 ,D i ), the client uses the public key of the BFV scheme To generate the encoding result y i =(P i1 ,D i ) is encrypted to obtain σ i =(c 0i ,c 1i ), where c 0i ←BFV.Enc(P i1 ),c 1i ←BFV.Enc(D i ),i=1,2,...,n;The client encrypts the encoded data and obtains n groups of ciphertexts (σ1,σ2,...,σ n ) and the calculation function f(@) are sent to the cloud server.

[0071] Optionally, the encoding matrix is ​​expressed as follows:

[0072]

[0073] Among them, D i represents the encoding matrix corresponding to the i-th group of messages, {a,b,c,d} is the private key sk of HMAC, And meet represents uniform random sampling, represents the modulo t integer ring, t represents the plaintext modulus over the polynomial ring in the system parameter, represents a polynomial ring, X N +1 indicates the polynomial, N indicates the polynomial order of the polynomial ring, P i2 represents the verification tag polynomial corresponding to the i-th group of messages, e i is a random polynomial, represents a reversible matrix, represents the inverse matrix, and mod represents the modulo operation.

[0074] S104. The cloud server performs homomorphic calculation on the ciphertext and returns the obtained ciphertext calculation result to the client.

[0075] Optionally, S104 may include:

[0076] Cloud Server Utilization Evaluation Key The sum calculation function performs homomorphic calculation on the received ciphertext; wherein the homomorphic calculation includes homomorphic multiplication and homomorphic addition;

[0077] Through homomorphic computing, the goal of the calculation function is completed, the ciphertext calculation result is obtained, and the ciphertext calculation result is returned to the client.

[0078] It can be understood that for the received n groups of ciphertext (σ1,σ2,...,σ n ), the cloud server uses the evaluation key of the BFV scheme And the calculation function f(·) is used to perform homomorphic addition and homomorphic multiplication. Homomorphic addition: For two ciphertexts σ=(c0,c1) and σ′=(c′0,c′1), homomorphic addition is performed. The ciphertext calculation method is in Homomorphic multiplication: For two ciphertexts σ=(c0,c1) and σ′=(c0′,c1′), homomorphic multiplication is performed. The ciphertext calculation method is in BFV.Mul(c1,c0′),BFV.Mul(c1,c1′)). Through homomorphic addition and multiplication, the goal of calculating the function f(·) is completed, and the ciphertext calculation result is obtained: The cloud server will calculate the ciphertext result of homomorphic computing σ f(·) Return to the client.

[0079] S105. The client verifies the ciphertext calculation result. If the verification is successful, the client accepts the message calculation result obtained based on the ciphertext calculation result.

[0080] Optionally, S105 may include:

[0081] The client encodes the hash value corresponding to the message to obtain a hash value polynomial;

[0082] The client calculates the hash value polynomial according to the calculation function to obtain a first calculation result;

[0083] The client uses a public-private key pair The private key in Decrypting the ciphertext calculation result to obtain a second calculation result;

[0084] Decoding the second calculation result using the private key sk to obtain a third calculation result; wherein the third calculation result includes a plaintext polynomial and a corresponding verification tag polynomial;

[0085] The client verifies the third calculation result using the first calculation result, and if the verification succeeds, receives the plaintext polynomial in the third calculation result;

[0086] The client performs an inverse operation on the plaintext polynomial to obtain the message calculation result.

[0087] It can be understood that the client encodes the hash value of n groups of messages into a hash value polynomial, where for the i-th group of messages (m i1 ,m i2,...,m il ), the hash value corresponding to the message (Hash (τ i1 ),Hash(τ i2 ),…,Hash(τ il )) Encoded as a polynomial using SIMD technology The client calculates n polynomials based on the calculation function f(·) Perform calculations to obtain the first calculation result The client uses the private key of the BFV key generation algorithm Calculate the ciphertext result σ returned by the cloud server f(·) Decryption is performed to obtain the second calculation result of the corresponding plaintext polynomial ρ1=(P1′,D′), where P1′←BFV.Dec(c P1 ),D′←BFV.Dec(c D ); The client uses the HMAC private key sk to decode the second calculation result ρ1=(P1′,D′) to obtain the third calculation result y′=(y0,y1) corresponding to the plaintext and the verification tag, where y0=P1′, y1 is the polynomial of the first row and first column of the decoded matrix D1, and the matrix D1 is a 2×2 dimensional matrix, which is expressed as follows:

[0088]

[0089] The client uses the first calculation result ρ and the third calculation result (y0, y1) returned by the cloud server to verify and check If the equation holds, the result y0 is accepted. The client performs the inverse operation of SIMD batch processing on the polynomial y0 and obtains the calculated message calculation result f(m 1i ,m 2i ,…,m ni ),i=1,…,l.

[0090] Figure 2 is a block diagram of a verifiable fully homomorphic encryption device based on homomorphic message authentication code provided by an embodiment of the present invention, such as Figure 2 As shown, the device 200 includes:

[0091] The tag generation module 201 is used to generate a verification tag corresponding to the message by using a hash function by the client;

[0092] Batch encoding module 202, used to batch encode the message and the verification tag using the client to obtain a message polynomial and a verification tag polynomial;

[0093] The encoding and encryption module 203 is used to encode and encrypt the message polynomial and the verification tag polynomial using the client, and send the obtained ciphertext to the cloud server;

[0094] Homomorphic computing module 204, used to perform homomorphic computing on the ciphertext using the cloud server, and return the obtained ciphertext computing result to the client;

[0095] The result verification module 205 is used to verify the ciphertext calculation result using the client, and if the verification is successful, the message calculation result obtained according to the ciphertext calculation result is accepted.

[0096] Through the above technical scheme, by using batch coding technology, multiple messages can be processed simultaneously during homomorphic calculation and verification, greatly reducing the verification overhead of the client; by generating a reversible matrix, the generated verification label polynomial is converted into a matrix using the reversible matrix and its inverse matrix, thereby reducing the communication overhead, and the client only needs to verify the addition and subtraction once, ensuring that the verification overhead is at a constant level and maintaining the reusability of the label; and there is no need to preset the circuit depth, the verification of fully homomorphic encryption is not affected by the circuit depth, and any calculation can be performed, and the communication overhead will not increase with the increase in the number of calculations.

[0097] For the specific processing process of each module of the device, please refer to the relevant content of the first aspect and will not be repeated here.

[0098] The above contents are further detailed descriptions of the present invention in combination with specific preferred embodiments, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions or substitutions can be made without departing from the concept of the present invention, which should be regarded as falling within the protection scope of the present invention.

Claims

1. A verifiable fully homomorphic encryption method based on homomorphic message authentication code, characterized in that: The method comprises: The client generates a verification tag corresponding to the message through a hash function; The client performs batch encoding on the message and the verification tag to obtain a message polynomial and a verification tag polynomial; The client encodes and encrypts the message polynomial and the verification tag polynomial, and sends the obtained ciphertext to the cloud server; The cloud server performs homomorphic calculation on the ciphertext, and returns the obtained ciphertext calculation result to the client; The client verifies the ciphertext calculation result, and if the verification passes, accepts the message calculation result obtained based on the ciphertext calculation result.

2. The method for verifiable fully homomorphic encryption based on homomorphic message authentication code according to claim 1 is characterized in that: Before the client generates a verification tag corresponding to the message through a hash function, the method further includes: The client runs the BFV key generation algorithm according to the system parameters to obtain the public and private key pair and evaluation key The client runs the HMAC key generation algorithm to obtain the HMAC private key sk.

3. The method for verifiably fully homomorphic encryption based on homomorphic message authentication code according to claim 1 is characterized in that: The client generates a verification tag corresponding to the message through a hash function, including: For each message, the client selects a string as an identifier; The client uses the hash function to calculate each message and the corresponding identifier to obtain a verification tag corresponding to each message.

4. The method for verifiable fully homomorphic encryption based on homomorphic message authentication code according to claim 2 is characterized in that: The client encodes and encrypts the message polynomial and the verification tag polynomial, and sends the obtained ciphertext to the cloud server, including: The client constructs a reversible matrix using the private key sk; The client encodes the verification tag polynomial according to the reversible matrix and the corresponding inverse matrix to obtain a coding matrix; The client obtains an encoding result according to the encoding matrix and the message polynomial; The client uses the public-private key pair The public key in The encoding result is encrypted to obtain the ciphertext, and the ciphertext is sent to the cloud server.

5. The method for verifiable fully homomorphic encryption based on homomorphic message authentication code according to claim 4 is characterized in that: The cloud server performs homomorphic calculation on the ciphertext and returns the obtained ciphertext calculation result to the client, including: The cloud server uses the evaluation key and performing homomorphic calculation on the received ciphertext using a calculation function; wherein the homomorphic calculation includes homomorphic multiplication and homomorphic addition; Through homomorphic computing, the goal of the computing function is completed, the ciphertext computing result is obtained, and the ciphertext computing result is returned to the client.

6. The method for verifiably fully homomorphic encryption based on homomorphic message authentication codes according to claim 5 is characterized in that: The client verifies the ciphertext calculation result, and if the verification is successful, accepts the message calculation result obtained according to the ciphertext calculation result, including: The client encodes the hash value corresponding to the message to obtain a hash value polynomial; The client calculates the hash value polynomial according to the calculation function to obtain a first calculation result; The client uses the public-private key pair The private key in Decrypting the ciphertext calculation result to obtain a second calculation result; Decoding the second calculation result using the private key sk to obtain a third calculation result; wherein the third calculation result includes a plaintext polynomial and a corresponding verification tag polynomial; The client verifies the third calculation result using the first calculation result, and receives the plaintext polynomial in the third calculation result if the verification succeeds; The client performs an inverse operation on the plaintext polynomial to obtain the message calculation result.

7. The method for verifiable fully homomorphic encryption based on homomorphic message authentication code according to claim 4 is characterized in that: The encoding matrix is ​​expressed as follows: Among them, D i represents the encoding matrix corresponding to the i-th group of messages, {a,b,c,d} is the private key sk of HMAC, And meet represents uniform random sampling, represents the modulo t integer ring, t represents the plaintext modulus over the polynomial ring in the system parameter, represents the polynomial ring, X N +1 represents the polynomial, N represents the polynomial order of the polynomial ring, [ i2 represents the verification tag polynomial corresponding to the i-th group of messages, e i is a random polynomial, represents the reversible matrix, represents the inverse matrix, and mod represents a modulo operation.

8. A verifiable fully homomorphic encryption device based on homomorphic message authentication code, characterized in that: The device comprises: A tag generation module, used to generate a verification tag corresponding to a message using a hash function by the client; A batch encoding module, used to perform batch encoding on the message and the verification tag using the client to obtain a message polynomial and a verification tag polynomial; An encoding and encryption module, used to encode and encrypt the message polynomial and the verification tag polynomial using the client, and send the obtained ciphertext to the cloud server; A homomorphic computing module, used to perform homomorphic computing on the ciphertext using the cloud server, and return the obtained ciphertext computing result to the client; The result verification module is used to verify the ciphertext calculation result using the client, and if the verification is successful, accept the message calculation result obtained based on the ciphertext calculation result.

Images