A verifiable fully homomorphic encryption method and device based on a homomorphic message authentication code

Abstract

The application discloses a kind of verifiable homomorphic encryption method and device based on homomorphic message authentication code, comprising: client generates the verification label corresponding to message by hash function;Client carries out batch processing coding to message and verification label, obtains message polynomial and verification label polynomial;Client encrypts message polynomial and verification label polynomial, and sends the ciphertext obtained to cloud server;Cloud server carries out homomorphic computation to ciphertext, and returns the ciphertext calculation result to client;Client verifies ciphertext calculation result, and if verification is passed, accept message calculation result.The verification process of ciphertext calculation result is simple, the verification overhead is lower, and the verification has reusability, is not affected by circuit depth, is processed and coded by using batch processing technology, and multiple messages can be processed simultaneously during homomorphic computation and verification, which greatly reduces the verification overhead of client.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of encryption technology, and particularly relates to a verifiable fully homomorphic encryption method and device based on homomorphic message authentication code. BACKGROUND

[0002] With the rapid development of cloud computing, its powerful computing capability and huge storage space provide strong support for data calculation and processing. However, in recent years, security incidents such as data leakage and service interruption often occur in cloud computing services, which makes data face more security risks, so people pay more attention to security and privacy. With the development of cloud computing, more and more individuals and enterprises choose to share data to the cloud server for calculation. However, this mode needs data transmission to the cloud, which increases the risk of data leakage in the process of transmission, storage and sharing, thereby causing privacy problems.

[0003] In cloud computing, cloud service providers and third parties may access or leak sensitive data of users, resulting in privacy information leakage. However, by using verifiable fully homomorphic encryption technology to encrypt plaintext, even if a malicious party has the right to calculate data, they cannot access the original data content, avoiding problems such as data theft. Malicious or unreliable cloud service providers may return false or inaccurate calculation results, or external attackers may invade the cloud platform through vulnerabilities to obtain, tamper with or delete user data, which will bring serious consequences, especially in critical fields such as financial analysis and medical diagnosis.

[0004] The verifiable fully homomorphic encryption technology generates calculation results with verification proof, so that users can verify the correctness of cloud computing. This means that even if the cloud service provider tries to tamper with the calculation results or return incorrect results, the user can find it and ensure the integrity of data processing, which greatly reduces the risk of external attacks, and it supports multi-party computing on the cloud, and each party can use its own encrypted data to jointly analyze and cooperate, and the calculation result is still encrypted and verifiable. This is particularly important for multi-party cross-field and cross-border cooperation data processing, and solves the data sharing dilemma in the cloud computing environment.

[0005] Fully homomorphic encryption is a powerful encryption technique that can perform arbitrary number of addition and multiplication operations on ciphertexts, and is widely used to protect privacy in data computation. However, fully homomorphic encryption can only guarantee privacy, and lacks the guarantee of correctness of cloud computing. HMAC (Homomorphic Message Authentication Codes) is one of the most commonly used methods to verify the correctness of the calculation result, and its verification overhead is lower than other technologies. HMAC requires encoding preprocessing operation on message tags, but due to the encoding technology, most of the verifiable fully homomorphic encryption schemes based on HMAC support limited circuit depth, and cannot meet the verification simplicity and tag reusability at the same time. Moreover, since most of the current schemes require the client to calculate the tag of the message, it will generate a large verification overhead. SUMMARY

[0006] In order to solve the above problems existing in the prior art, the present application provides a verifiable fully homomorphic encryption method and device based on homomorphic message authentication code.

[0007] The technical problem to be solved by the present application is solved by the following technical scheme:

[0008] In a first aspect, the present application provides a verifiable fully homomorphic encryption method based on homomorphic message authentication code, comprising:

[0009] The client generates a verification tag corresponding to the message through a hash function;

[0010] The client performs batch encoding on the message and the verification tag to obtain a message polynomial and a verification tag polynomial;

[0011] The client encrypts the message polynomial and the verification tag polynomial, and sends the obtained ciphertext to a cloud server;

[0012] The cloud server performs homomorphic computation on the ciphertext, and returns the obtained ciphertext computation result to the client;

[0013] The client verifies the ciphertext computation result, and if the verification is passed, accepts the message computation result obtained according to the ciphertext computation result.

[0014] Optionally, before the client generates a verification tag corresponding to the message through a hash function, the method further comprises:

[0015] The client runs a BFV key generation algorithm according to system parameters to obtain a public-private key pair and an evaluation key

[0016] The client runs an HMAC key generation algorithm to obtain a private key sk of the HMAC.

[0017] Optionally, the client generates a verification tag corresponding to the message through a hash function, comprising:

[0018] For each message, the client selects a string as an identifier;

[0019] The client calculates each message and the corresponding identifier using the hash function to obtain a verification tag corresponding to each message.

[0020] Optionally, the client encodes and encrypts the message polynomial and the verification tag polynomial, and sends the obtained ciphertext to the cloud server, comprising:

[0021] The client constructs an invertible matrix using the private key sk;

[0022] The client encodes the verification tag polynomial according to the invertible matrix and the corresponding inverse matrix to obtain an encoding matrix;

[0023] The client obtains an encoding result according to the encoding matrix and the message polynomial;

[0024] The client encrypts the encoding result using the public key of the public-private key pair to obtain the ciphertext, and sends the ciphertext to the cloud server.

[0025] Optionally, the cloud server performs homomorphic computation on the ciphertext and returns the obtained ciphertext computation result to the client, comprising:

[0026] The cloud server performs homomorphic computation on the received ciphertext using the evaluation key and the computation function; wherein the homomorphic computation includes homomorphic multiplication and homomorphic addition;

[0027] Through homomorphic computation, the target of the computation function is completed, and the ciphertext computation result is obtained, and the ciphertext computation result is returned to the client.

[0028] Optionally, the client verifies the ciphertext computation result, and if the verification is passed, the message computation result obtained according to the ciphertext computation result is accepted, comprising:

[0029] The client encodes the hash value corresponding to the message to obtain a hash value polynomial;

[0030] The client calculates the hash value polynomial according to the computation function to obtain a first computation result;

[0031] The client uses the public-private key pair The private key in Decrypting the ciphertext calculation result to obtain a second calculation result;

[0032] Decoding the second calculation result using the private key sk to obtain a third calculation result; wherein the third calculation result includes a plaintext polynomial and a corresponding verification tag polynomial;

[0033] The client verifies the third calculation result using the first calculation result, and receives the plaintext polynomial in the third calculation result if the verification succeeds;

[0034] The client performs an inverse operation on the plaintext polynomial to obtain the message calculation result.

[0035] Optionally, the encoding matrix is ​​expressed as follows:

[0036]

[0037] Among them, D i represents the encoding matrix corresponding to the i-th group of messages, {a, b, c, d} is the HMAC private key sk, and satisfy represents uniform random sampling, represents the modulo t integer ring, t represents the plaintext modulus over the polynomial ring in the system parameters, Denotes the polynomial ring, X n +1 represents the polynomial, N represents the polynomial order of the polynomial ring, P i2 represents the verification tag polynomial corresponding to the i-th group of messages, e i is a random polynomial, represents the reversible matrix, represents the inverse matrix, and mod represents a modulo operation.

[0038] In a second aspect, the present invention provides a verifiable fully homomorphic encryption device based on a homomorphic message authentication code, the device comprising:

[0039] The tag generation module is used to use the client to generate a verification tag corresponding to the message through a hash function;

[0040] a batch encoding module, configured to perform batch encoding on the message and the verification tag using the client to obtain a message polynomial and a verification tag polynomial;

[0041] An encoding encryption module is configured to encode and encrypt the message polynomial and the verification tag polynomial by using the client, and send the obtained ciphertext to a cloud server;

[0042] A homomorphic computation module is configured to perform homomorphic computation on the ciphertext by using the cloud server, and return the obtained ciphertext computation result to the client;

[0043] A result verification module is configured to verify the ciphertext computation result by using the client, and if the verification is passed, accept the message computation result obtained according to the ciphertext computation result.

[0044] The technical scheme provided by the embodiment of the present application can include the following beneficial effects:

[0045] In the above technical scheme, the client generates a verification tag corresponding to a message by using a hash function; the client performs batch processing encoding on the message and the verification tag to obtain a message polynomial and a verification tag polynomial; the client encodes and encrypts the message polynomial and the verification tag polynomial, and sends the obtained ciphertext to a cloud server; the cloud server performs homomorphic computation on the ciphertext, and returns the obtained ciphertext computation result to the client; the client verifies the ciphertext computation result, and if the verification is passed, accepts the message computation result obtained according to the ciphertext computation result. The verification process of the ciphertext computation result is simple, the verification cost is low, and the verification has reusability, and the verification tag after computation can be used for subsequent computation; and the present application does not need to preset the circuit depth and is not affected by the circuit depth, and can perform arbitrary computation; by using the batch processing technology for processing encoding, multiple messages can be processed at the same time during homomorphic computation and verification, which greatly reduces the verification cost of the client.

[0046] The present application will be further described in detail below with reference to the accompanying drawings and the present application. BRIEF DESCRIPTION OF DRAWINGS

[0047] Figure 1 is a flowchart of a verifiable fully homomorphic encryption method based on homomorphic message authentication code provided by the embodiment of the present application;

[0048] Figure 2 is a block diagram of a verifiable fully homomorphic encryption device based on homomorphic message authentication code provided by the embodiment of the present application. DETAILED DESCRIPTION

[0049] In order to facilitate understanding of the present application scheme, first, the related situations of the prior art and the inventive concept of the present application are briefly described.

[0050] Verifiable computation is an important means. In 2013, two specific implementations of HMAC-based schemes were proposed by technical personnel, both of which support low-order polynomial operations and are efficient, but cannot simultaneously meet the simplicity of verification and the reusability of labels. In 2014, some scholars abstracted the idea of limited extensibility coding, which supports verification to meet simplicity while meeting the reusability of labels to some extent, but the scheme is limited by the preset circuit depth. In 2022, some technical personnel proposed a verifiable fully homomorphic encryption scheme based on polynomial coding, which uses a private key for polynomial coding as a label, the client uses the encoding private key to calculate with the label in advance, and the cloud sends the homomorphic calculation result to the client after homomorphic calculation, and the client compares the pre-calculated label result with the returned homomorphic calculation result. The disadvantage of the scheme is that it can only meet the verification simplicity under low circuit depth, that is, the verification overhead of the receiver will exceed the verification overhead of the original message when the circuit depth is large; the improvement scheme is to use random masking to convert 5 ciphertext values into 3 ciphertext values to reduce the verification overhead, and the disadvantage of the method is that the server and the client need to be online at the same time, the client needs to perform additional calculation, and part of the reusability of the calculation label will be lost.

[0051] Most of the currently proposed verifiable fully homomorphic encryption algorithms based on HMAC are limited by circuit depth when verifying the calculation result, and cannot simultaneously meet the simplicity of verification and the reusability of labels. Therefore, the present application proposes an internet threat detection and backtracking method based on adaptive abnormal behavior analysis to solve the technical problem.

[0052] Figure 1 is a flowchart of a verifiable fully homomorphic encryption method based on homomorphic message authentication code provided by an embodiment of the present application, as shown in Figure 1 , the method comprises the following steps:

[0053] S101, the client generates a verification label corresponding to the message through a hash function.

[0054] Optionally, before S101, the method can further comprise:

[0055] The client runs the BFV key generation algorithm according to the system parameters to obtain a public-private key pair and an evaluation key

[0056] The client runs the HMAC key generation algorithm to obtain the private key sk of HMAC.

[0057] It can be understood that the client inputs the security parameter λ to generate the system parameters Γ of the BFV encryption algorithm, Γ={N,t,q}, , represents a polynomial ring, X N+1 represents the polynomial, N represents the polynomial order of the polynomial ring, Represents the modulus t integer ring, t represents the plaintext modulus on the polynomial ring in the system parameter; then, the client uses the system parameter Γ to run the key generation algorithm of the BFV encryption scheme and outputs the public and private key pair of the BFV encryption scheme and evaluation key And publish the public key and evaluation key And secretly hold the private key Furthermore, the client uses the HMAC key generation algorithm to output the HMAC private key sk = {a, b, c, d, K}, where and satisfy K is the private key of the hash function.

[0058] Optionally, S101 may include:

[0059] For each message, the client chooses a string as an identifier;

[0060] The client uses a hash function to calculate each message and its corresponding identifier to obtain a verification tag corresponding to each message.

[0061] It is understandable that the client can generate labels for n groups, each with l messages; specifically, for the message (m i1 ,m i2 ,...,m il ), the client for each message m ij (j=1,2,...,l) select a string τ ij As a unique identifier, let it be the message m ij The corresponding label; then the client uses the hash function Hash: For message m ij and its label τ ij Calculate and get Hash(τ ij )-m ij , as the verification tag of the message, where m ij Belongs to the message space i=1,2,...,n,j=1,2,...,l.

[0062] S102: The client performs batch encoding on the message and the verification tag to obtain a message polynomial and a verification tag polynomial.

[0063] It is understandable that the client uses the Single Instruction Multiple Data (SIMD) technology to batch encode n groups of messages and corresponding verification tags, where for the i-th group (i=1,2,...,n), the i-th group of messages (m i1 ,m i2 ,...,m il ) and its corresponding verification tag (Hash(τ i1 )-m i1 ,Hash(τ i2 )-m i2 ,...,Hash(τ il )-m il ) are encoded as polynomials P i1 , Among them, P i1 Denotes the message polynomial, P i2 represents the verification label polynomial.

[0064] S103. The client encodes and encrypts the message polynomial and the verification tag polynomial, and sends the obtained ciphertext to the cloud server.

[0065] Optionally, S103 may include:

[0066] The client uses the private key sk to construct a reversible matrix;

[0067] The client encodes the verification tag polynomial according to the reversible matrix and the corresponding inverse matrix to obtain the encoding matrix;

[0068] The client obtains the encoding result based on the encoding matrix and message polynomial;

[0069] The client uses a public-private key pair The public key in The encoded result is encrypted to obtain the ciphertext, and the ciphertext is sent to the cloud server.

[0070] It is understandable that the client uses the private key sk of the HMAC algorithm to construct a reversible matrix. and its inverse matrix To verify the label polynomial P for n groups i2 (i=1,2,...,n) for encoding; for the i-th group of verification label polynomials, generate a 2×2 dimensional encoding matrix D i , message polynomial P i1 With the encoding matrix D i Composition encoding result: y i =(P i1 ,D i ), the client uses the public key of the BFV scheme To generate the encoding result y i =(P i1 ,D i ) is encrypted to obtain σ i =(c 0i ,c 1i ), where c 0i ←BFV.Enc(P i1 ),c 1i ←BFV.Enc(D i ),i=1,2,...,n;The client encrypts the n ciphertexts (σ1,σ2,...,σ n ) and the calculation function f(@) are sent to the cloud server.

[0071] Optionally, the encoding matrix is ​​expressed as follows:

[0072]

[0073] Among them, D i represents the encoding matrix corresponding to the i-th group of messages, {a, b, c, d} is the HMAC private key sk, and satisfy represents uniform random sampling, represents the modulo t integer ring, t represents the plaintext modulus over the polynomial ring in the system parameters, represents a polynomial ring, X N +1 indicates the polynomial, N indicates the polynomial order of the polynomial ring, P i2 represents the verification tag polynomial corresponding to the i-th group of messages, e i is a random polynomial, represents a reversible matrix, represents the inverse matrix, and mod represents the modulo operation.

[0074] S104. The cloud server performs homomorphic calculation on the ciphertext and returns the obtained ciphertext calculation result to the client.

[0075] Optionally, S104 may include:

[0076] Cloud Server Utilization Evaluation Key The sum calculation function performs homomorphic calculation on the received ciphertext; wherein the homomorphic calculation includes homomorphic multiplication and homomorphic addition;

[0077] Through homomorphic computing, the goal of the calculation function is completed, the ciphertext calculation result is obtained, and the ciphertext calculation result is returned to the client.

[0078] It can be understood that, for the received n groups of ciphertexts (σ1, σ2,..., σn), the cloud server uses the evaluation key of the BFV scheme n and the calculation function f(·) to perform homomorphic addition and homomorphic multiplication calculation. Homomorphic addition: for two ciphertexts σ=(c0, c1) and σ'=(c'0, c'1), the homomorphic addition calculation is performed in the ciphertext calculation manner wherein Homomorphic multiplication: for two ciphertexts σ=(c0, c1) and σ'=(c'0, c'1), the homomorphic multiplication calculation is performed in the ciphertext calculation manner wherein BFV.Mul(c1, c'0), BFV.Mul(c1, c'1)). Through the homomorphic addition and multiplication calculation, the target of the calculation function f(·) is completed, and the ciphertext calculation result is obtained as The cloud server returns the homomorphic calculation ciphertext calculation result σ f(·) to the client.

[0079] S105, the client verifies the ciphertext calculation result, and if the verification is passed, accepts the message calculation result obtained according to the ciphertext calculation result.

[0080] Optionally, S105 can include:

[0081] The client encodes the hash value corresponding to the message to obtain a hash value polynomial;

[0082] The client calculates the hash value polynomial according to the calculation function to obtain a first calculation result;

[0083] The client decrypts the ciphertext calculation result using the private key in the public and private key pair to obtain a second calculation result;

[0084] The second calculation result is decoded using the private key sk to obtain a third calculation result; wherein the third calculation result includes a plaintext polynomial and a corresponding verification tag polynomial;

[0085] The client verifies the third calculation result using the first calculation result, and if the verification is passed, receives the plaintext polynomial in the third calculation result;

[0086] The client performs inverse operation on the plaintext polynomial to obtain a message calculation result.

[0087] It can be understood that the client encodes the hash values of the n groups of messages into a hash value polynomial, wherein for the i-th group of messages (m i1 , i2 ​..., m il ), the Hash value (Hash (τ i1 ), Hash (τ i2 ),..., Hash (τ il )) corresponding to the message is encoded into a polynomial The client calculates n polynomials , obtains the first calculation result The client uses the private key of the BFV key generation algorithm to decrypt the ciphertext calculation result σ f(·) returned by the cloud server, and obtains the second calculation result ρ1 = (P1', D') corresponding to the plaintext polynomial, wherein P1' <- BFV.Dec (c P1 ), D' <- BFV.Dec (c D ); the client uses the private key sk of the HMAC to decode the second calculation result ρ1 = (P1', D'), and obtains the third calculation result y' = (y0, y1) corresponding to the plaintext and the verification tag, wherein y0 = P1', y1 is the polynomial of the first row and the first column of the decoded matrix D1, and the matrix D1 is a 2x2 matrix, and is represented as follows:

[0088]

[0089] The client uses the first calculation result ρ and the third calculation result (y0, y1) returned by the cloud server to verify, checks If the equation is established, the result y0 is accepted. The client performs the inverse operation of the SIMD batch processing on the polynomial y0, and obtains the calculated message calculation result f (m 1i , m 2i ,..., m ni ), i = 1,..., l.

[0090] Figure 2 is a block diagram of a verifiable fully homomorphic encryption device based on a homomorphic message authentication code provided by an embodiment of the application, as shown in the figure, the device 200 comprises: Figure 2

[0091] A tag generation module 201 is configured to generate a verification tag corresponding to a message by using a hash function by a client.

[0092] A batch processing encoding module 202 is configured to perform batch processing encoding on the message and the verification tag by using the client, and obtain a message polynomial and a verification tag polynomial.

[0093] ​The encoding encryption module 203 is configured to encode and encrypt the message polynomial and the verification tag polynomial by using the client, and send the obtained ciphertext to the cloud server;

[0094] The homomorphic computation module 204 is configured to perform homomorphic computation on the ciphertext by using the cloud server, and return the obtained ciphertext computation result to the client;

[0095] The result verification module 205 is configured to verify the ciphertext computation result by using the client, and if the verification is passed, accept the message computation result obtained according to the ciphertext computation result.

[0096] Through the above technical solution, by using batch encoding technology, multiple messages can be processed simultaneously during homomorphic computation and verification, thereby greatly reducing the verification overhead of the client; by generating an invertible matrix, the generated verification tag polynomial is converted into a matrix by using the invertible matrix and its inverse matrix, thereby reducing the communication overhead, and the client only needs to verify the addition and subtraction once, ensuring that the verification overhead is constant, and maintaining the reusability of the tag; and without presetting the circuit depth, the verification of the fully homomorphic encryption is not affected by the circuit depth, arbitrary computation can be performed, and the communication overhead will not increase with the increase of the number of computations.

[0097] For the specific processing process of each module of the device, please refer to the related content of the first aspect, which will not be repeated here.

[0098] The above is a further detailed description of the present application in combination with specific preferred embodiments, and the specific implementation of the present application cannot be limited to these descriptions. For ordinary skilled persons in the technical field to which the present application belongs, without departing from the concept of the present application, a number of simple deductions or substitutions can be made, which should be regarded as falling within the protection scope of the present application.

Claims

1. A verifiable fully homomorphic encryption method based on homomorphic message authentication code, characterized in that: The method comprises: The client generates a verification tag corresponding to the message through a hash function; The client performs batch encoding on the message and the verification tag to obtain a message polynomial and a verification tag polynomial; The client encodes and encrypts the message polynomial and the verification tag polynomial, and sends the obtained ciphertext to the cloud server; The cloud server performs homomorphic calculation on the ciphertext and returns the obtained ciphertext calculation result to the client; The client verifies the ciphertext calculation result, and if the verification passes, accepts the message calculation result obtained based on the ciphertext calculation result.

2. The method for verifiable fully homomorphic encryption based on homomorphic message authentication code according to claim 1 is characterized in that: Before the client generates a verification tag corresponding to the message using a hash function, the method further includes: The client runs the BFV key generation algorithm based on the system parameters to obtain the public and private key pair and evaluation key The client runs the HMAC key generation algorithm to obtain the HMAC private key sk.

3. The verifiable fully homomorphic encryption method based on homomorphic message authentication code according to claim 1 is characterized in that: The client generates a verification tag corresponding to the message through a hash function, including: For each message, the client selects a string as an identifier; The client uses the hash function to calculate each message and the corresponding identifier to obtain a verification tag corresponding to each message.

4. The method for verifiable fully homomorphic encryption based on homomorphic message authentication code according to claim 2, characterized in that: The client encodes and encrypts the message polynomial and the verification tag polynomial, and sends the obtained ciphertext to the cloud server, including: The client constructs a reversible matrix using the private key sk; The client encodes the verification tag polynomial according to the reversible matrix and the corresponding inverse matrix to obtain an encoding matrix; The client obtains an encoding result according to the encoding matrix and the message polynomial; The client uses the public-private key pair The public key in The encoding result is encrypted to obtain the ciphertext, and the ciphertext is sent to the cloud server.

5. The method for verifiable fully homomorphic encryption based on homomorphic message authentication code according to claim 4 is characterized in that: The cloud server performs homomorphic computation on the ciphertext and returns the obtained ciphertext computation result to the client, including: The cloud server uses the evaluation key and performing homomorphic calculation on the received ciphertext using a calculation function; wherein the homomorphic calculation includes homomorphic multiplication and homomorphic addition; Through homomorphic computation, the goal of the computation function is completed, the ciphertext computation result is obtained, and the ciphertext computation result is returned to the client.

6. The method for verifiable fully homomorphic encryption based on homomorphic message authentication code according to claim 5, characterized in that: The client verifies the ciphertext calculation result, and if the verification passes, accepts the message calculation result obtained based on the ciphertext calculation result, including: The client encodes the hash value corresponding to the message to obtain a hash value polynomial; The client calculates the hash value polynomial according to the calculation function to obtain a first calculation result; The client uses the public-private key pair The private key in Decrypting the ciphertext calculation result to obtain a second calculation result; Decoding the second calculation result using the private key sk to obtain a third calculation result; wherein the third calculation result includes a plaintext polynomial and a corresponding verification tag polynomial; The client verifies the third calculation result using the first calculation result, and receives the plaintext polynomial in the third calculation result if the verification succeeds; The client performs an inverse operation on the plaintext polynomial to obtain the message calculation result.

7. The verifiable fully homomorphic encryption method based on homomorphic message authentication code according to claim 4 is characterized in that: The encoding matrix is ​​expressed as follows: Among them, D i represents the encoding matrix corresponding to the i-th group of messages, {a, b, c, d} is the HMAC private key sk, and satisfy represents uniform random sampling, represents the modulo t integer ring, t represents the plaintext modulus over the polynomial ring in the system parameters, Denotes the polynomial ring, X N +1 represents the polynomial, N represents the polynomial order of the polynomial ring, [ i2 represents the verification tag polynomial corresponding to the i-th group of messages, e i is a random polynomial, represents the reversible matrix, represents the inverse matrix, and mod represents a modulo operation.

8. A verifiable fully homomorphic encryption device based on homomorphic message authentication code, characterized in that: The device comprises: The tag generation module is used to use the client to generate a verification tag corresponding to the message through a hash function; a batch encoding module, configured to perform batch encoding on the message and the verification tag using the client to obtain a message polynomial and a verification tag polynomial; An encoding and encryption module, configured to use the client to encode and encrypt the message polynomial and the verification tag polynomial, and send the obtained ciphertext to a cloud server; A homomorphic computing module, configured to perform homomorphic computing on the ciphertext using the cloud server, and return the obtained ciphertext computing result to the client; The result verification module is used to verify the ciphertext calculation result using the client, and if the verification is successful, accept the message calculation result obtained based on the ciphertext calculation result.

Images