Decentralization model efficient threshold multi-party calculation method and system based on homomorphic encryption

Abstract

The invention discloses a decentration model efficient threshold multi-party computing method and system based on homomorphic encryption. The method specifically comprises the following steps: (1) each participant agrees a common parameter; (2) the participants generate respective private keys; (3) the participant uses the private key to multiply the parameter and then add noise to generate a public key; (4) the participants encrypt respective plaintexts by using the public keys to obtain ciphertexts; (5) the participant expands the ciphertext; (6) performing addition and tensor product function calculation, and outputting a calculated ciphertext; (7) carrying out relinearization processing on the ciphertext in the step (6); and (8) decrypting the ciphertext in the step (7). According to the method, the problem of trusted third party in homomorphic encryption-based multi-party computing in existing cloud computing, the problem of algorithm paralysis after participants are corrupted and the problem of low efficiency in relinearization can be solved.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and also relates to the field of cryptographic homomorphic encryption technology, and specifically is an efficient threshold multi-party computing and system based on homomorphic encryption without a public random string CRS model. Background Art

[0002] With the rapid development of cloud computing, its flexible and efficient computing resources and services have helped users to provide convenience, but storing secure data in the cloud will bring significant privacy risks. Therefore, cloud data requires multiple users to jointly calculate a function without exposing their privacy during multi-party computing. At the same time, the calculation process involves a lot of communication and coordination, which will increase latency and computing costs, all of which will greatly increase the complexity of the calculation. Homomorphic encryption can simplify the steps of multi-party computing, so it is regarded as an attempt to reduce security risks. The efficiency of multi-party computing can be improved by introducing a trusted third party, but at the same time, the third-party entity brings problems such as centralization, resulting in uncontrollable trust issues. In other words, as long as someone attacks the "trusted" third party, it means that the privacy and calculation results of all users will be leaked, and the security of user data will be threatened, which will seriously hinder the development of multi-party computing and further affect the security deployment of cloud computing. Homomorphic encryption is known as the "holy grail" of cryptography. It is an extremely attractive cryptographic primitive that allows ciphertext to be directly calculated without decryption. This superior property determines that homomorphic encryption is an excellent "material" for secure multi-party computing. Traditional single-party homomorphic encryption cannot provide an effective solution for secure multi-party computing. Therefore, multi-party homomorphic encryption has been developed by extending single-party homomorphic encryption to multiple users, providing a series of promising solutions for secure multi-party computing.

[0003] However, the traditional secure multi-party computing scheme based on homomorphic encryption requires all participants to cooperate to complete the decryption protocol, which limits the fault tolerance and flexibility of the algorithm to a certain extent. Moreover, there is still a problem of relying on the common random string (CRS) and the trusted third party when instantiating the multi-party computing scheme, which weakens the semantic definition of the security of the scheme. In addition, the homomorphic multiplication operation will destroy the decryption structure of the multiplication ciphertext, resulting in decryption failure, and it is necessary to perform complex relinearization operations on the ciphertext product, which will lead to low computational efficiency of the algorithm in the process. The threshold multi-party computing scheme under the CRS-free model can continue the algorithm process when some participants are offline, and does not rely on CRS and trusted third parties, which can enhance data security and privacy protection, improve computational efficiency, and enhance algorithm flexibility and reliability. By implementing a relinearization preprocessing scheme under the CRS-free model, an efficient solution is provided for the problem of the ciphertext decryption structure being destroyed during the homomorphic multiplication process. This is very helpful for improving computational efficiency and reducing the risk of privacy leakage. Therefore, it is feasible and meaningful to implement the threshold multi-party computing scheme under the CRS-free model.

[0004] In summary, in the field of information security, it is urgent to design an efficient threshold multi-party computing technology solution based on homomorphic encryption without a CRS model. Based on this, the present invention proposes an efficient threshold multi-party computing solution based on homomorphic encryption without a CRS model, which can solve the trusted third party problem, the algorithm paralysis problem after the participants are corrupted, and the inefficiency problem in relinearization in the existing cloud computing based on homomorphic encryption multi-party computing. Summary of the invention

[0005] In view of the above-mentioned status of the prior art, the present invention provides a solution that can improve the security, fault tolerance and efficiency of multi-party computing in the cloud, and can provide a flexible, secure and efficient multi-party computing solution without relying on a trusted third party in a CRS-free model. Specifically, it is a decentralized model efficient threshold multi-party computing method and system based on homomorphic encryption. The present invention adopts a method of removing CRS to transform the "collective public and private key" scheme into a "each participant has a pair of public and private keys" scheme. Through the pre-processing relinearization method, a secure multi-party computing solution with high fault tolerance, security and efficiency is realized, and finally the foundation for distributed computing security is laid.

[0006] The technical solution adopted by the present invention to solve the technical problem is as follows:

[0007] An efficient threshold multi-party computing method for a decentralized model based on homomorphic encryption, the main steps include initialization, private key generation, public key generation, encryption, expansion, calculation, relinearization, and decryption, as follows:

[0008] (1) All parties agree on common parameters;

[0009] (2) The participants generate their own private keys;

[0010] (3) The participants use the private key multiplied by the relevant parameters and then add the noise to generate the public key;

[0011] (4) The participants use the public key to encrypt their respective plaintexts to obtain ciphertexts;

[0012] (5) The participants expand the ciphertext;

[0013] (6) Perform addition and tensor product function calculations and output the calculated ciphertext;

[0014] (7) Relinearize the ciphertext of step (6);

[0015] (8) Decrypt the ciphertext of step (7).

[0016] As a preferred solution, the present invention provides a decentralized model efficient threshold multi-party computing method based on homomorphic encryption, and the specific steps are as follows:

[0017] (1) Initialization phase

[0018] Each participant agrees on the public parameters (n, q, σ, Key, Err) and the public point α i ∈R q Associated, for all real numbers i,j,i≠j, the participant P i and participant P j The difference of the common points α i -α j Considered as a unit.

[0019] (2) Private key generation phase

[0020] Each participant P i Uniformly and independently select their own key s from the key distribution i ←Key(R q ), by selecting a common point on the ring. Each participant P i Samplingc i,1 ,...,c i,t-1 ←R q , by putting c i,k and the kth power of the common points of all parties After multiplication, sum and add your own key to construct the share Publicize the shares to other participants P j . Participant P i Received from other participants P j After the share is added, we get

[0021] (3) Public key generation phase

[0022] Collect from online parties Get t participants from the online participant set (if the number of participants in the online participant set is less than t, an error will be reported). These t participants have an impact on the offline participant P k of The public points of each party are used to reconstruct their private keys using Lagrange interpolation Participant P i Sampling p 1,i ←R q ,e←Err(R q )Use private key s i Multiply by p 1,i Adding noise e to output p 0,i , generate the public key pk i =(p 0,i ,p 1,i ).

[0023] (4) Encryption stage

[0024] Participant P i Sampling u i ←Key(R q ) and e 0,i ,e 1,i ←Err(R q ), use the public key to encrypt each plaintext and generate the ciphertext ct i =(c 0,i ,c 1,i ), the ciphertext consists of two parts, the first part c 0,i By plain text m i 、u i and p 0,i The product of the noise e 0,i The second part is composed of u i and p 1,i The product of and e 1,i It is achieved by seeking sum.

[0025] (5) Expansion stage

[0026] Participant P i The ciphertext ct i =(c 0,i ,c 1,i ) is expanded from two dimensions to N+1 dimensions, where N is the number of all participants. The second part of the original ciphertext is transplanted to the i+1th dimension, and the remaining dimensions are filled with 0 to obtain the extended ciphertext

[0027]

[0028] (6) Calculation phase

[0029] Participant P i and P k Cooperation i ,ct' k Perform addition and tensor product function calculations and output the calculated ciphertext ct add and

[0030] (7) Relinearization stage

[0031] After homomorphic multiplication, the ciphertext is transformed from linear to nonlinear, resulting in the destruction of the decryption structure. Generate an evaluation key, relinearize the ciphertext after homomorphic multiplication, and restore its decryption structure.

[0032] (8) Decryption stage

[0033] Get t participants from the online participant set (if the number of participants in the previous participant set is less than t, an error will be reported). These t participants are responsible for the offline participant P k of The public points of each party are used to reconstruct their private keys using Lagrange interpolation Participants P involved in the calculation i and P k Sampling i ,e k ←Smudge(R q ), the calculated ciphertext Partial decryption begins, and party P i and P k Multiply the i+1th item and the k+1th item in the ciphertext by their respective private keys and add them to e i ,e k Sum output h i and h k And make it public. i and h k Add c after summing 0 The corresponding ciphertext can be decrypted.

[0034] Further preferred solution: In step (2), the construction share is specifically as follows: The present invention first relaxes the solution that a total of N participants must be online to complete the protocol by executing a compact variant of Shamir secret sharing on the ring, and relaxes it to a threshold solution that t < N participants can complete the protocol online. Traditional Shamir secret sharing is executed on a domain, and all non-zero elements on the domain are reversible, which meets the requirements of the Chinese Remainder Theorem (CRT) for constructing Lagrangian interpolation coefficients. However, the multiplication of elements in the ring only needs to meet the conditions of the multiplication semigroup, that is, not all elements have inverses. At this time, if all common points are still sampled directly from the ring, then the i-th participant P required to calculate the Lagrangian coefficient is i and the jth participant P j The common point α i -α j There may not be an inverse element, so the Lagrange coefficient may not exist. If the Lagrange interpolation method is implemented in a ring, it is necessary to solve the problem that some elements in the ring do not have an inverse element, so a special sequence α can be constructed 1 ,...,α N As the common points of Shamir secret sharing, these sequences are characterized by α for any i≠j i -α j There are inverses, and the process of selecting sequence elements with inverses is as follows:

[0035] (1)Selection range

[0036] The present invention limits the selection of the common point of Shamir secret sharing to The constant polynomial of , that is, the coefficient of the non-constant term of the polynomial is 0, as for

[0037] (2) Constructing a special sequence

[0038] Assume q is a prime number 1 ,...,q L The product of min =min(q 1 ,...,q L ), this algorithm Choose N<q min Different values ​​are used as the common points of Shamir's secret sharing to ensure the formation of a special sequence.

[0039] After completing Shamir secret sharing on the ring, the protocol has the conditions to construct a threshold scheme. In the field of multi-party computing, decentralization is very important. When the participants need to construct a public-private key pair, the trusted third party of the traditional scheme will provide CRS, and the participants will construct a collective public key through CRS, which poses a challenge to the security of the protocol.

[0040] The present invention proposes a multi-party variant of the BGV homomorphic encryption algorithm under a CRS-free model. By transforming the original "calculating collective public key" method into a more natural "each participant has their own separate public key" method, this method not only reduces the centralization requirements, but also makes the security of multi-party computing more dependent on the difficulty of the RLWE problem.

[0041] Further preferred solution: The reconstruction of the private key in steps (3) and (8) is the same as the share construction process in step (2).

[0042] Further preferred solution: Step (7) is as follows:

[0043] First, generate an evaluation key:

[0044] (1) For a given security parameter λ, let the dimension of RLWE be n, the ciphertext modulus be q, the key distribution be χ, and the error distribution on R be ψ;

[0045] (2) Sampling of each participant and s←χ; sampling error vector e←ψ d , and set b = -s·a+e(modq) outputs the public key (b,a); for the input plaintext μ∈R, the evaluation key is generated according to the following steps

[0046] Step 1: sampling r←χ;

[0047] Step 2: Sampling and e 1 ←ψ d , and let d 0 =-s·d 1 +e 1 +r·g(modq);

[0048] Step 3: Sampling 2 ←ψ d , let d 2 =r·a+e 2 +μ·g(modq);

[0049] Next, perform a relinearization:

[0050] Participant i generates their own private key s i 、Public key(b i ,a i ) and the evaluation key D i , public (b i ,a i ,D i );

[0051] (1) Participants i and j generate and the public key Suppose for 1≤l≤d we have Vector k on i,j,0 [l]= <g -1 (b j [l]),d i,0 > and k i,j,1 [l]= <g -1 (b j [l]),d i,1 >, that is, [k i,j,0 |k i,j,1 ]=M j ·[d i,0 |d i,1 ], where M j ∈R d×d is a lth row g -1 (b j [l])∈R d Matrix of i,j,2 =d i,2 , get the preprocessing results, in:

[0052]

[0053] (2) Each participant inputs the ciphertext whose decryption structure is destroyed after the tensor product and k pairs of public keys and evaluation keys {(D i ,b i )} 1≤i≤k , follow the steps below to generate a decryptable ciphertext

[0054] Step 1: For all 1≤i,j≤k, perform preprocessing steps and output K i,j , let the relinearization key be

[0055]

[0056] Step 2: Let c′ 0 ←c 0,0 , for 1≤i≤k, we have c′ i ←c 0,i +c i,0 (modq);

[0057] Step 3: For 1≤i,j≤k, there is (c′ 0 ,c′ i ,c′ j )←(c′ 0 ,c′ i ,c′ j)+g -1 (c i,j )·K i,j (modq).

[0058] The present invention also discloses a decentralized model efficient threshold multi-party computing system based on homomorphic encryption, which is used to execute the above method, and specifically includes the following modules:

[0059] Initialization module: all parties agree on common parameters;

[0060] Private key generation module: Participants generate their own private keys;

[0061] Public key generation module: The participants use the private key multiplied by the relevant parameters and add noise to generate the public key;

[0062] Encryption module: The participants use the public key to encrypt their own plaintext to obtain ciphertext;

[0063] Ciphertext expansion module: Participants expand ciphertext;

[0064] Computation module: performs addition and tensor product function calculations and outputs the calculated ciphertext;

[0065] Relinearization module: relinearizes the ciphertext obtained by the calculation module;

[0066] Decryption module: decrypts the ciphertext obtained by the relinearization module.

[0067] Compared with the prior art, the present invention has the following significant technical effects:

[0068] The present invention adopts the method of removing CRS to transform the "collective public-private key" scheme into a "each participant has a pair of public-private keys" scheme. Through the preprocessing relinearization method, a secure multi-party computing scheme with high fault tolerance, security and efficiency is realized, ultimately laying the foundation for distributed computing security.

[0069] The preferred solution of the present invention implements a threshold decryption scheme by executing a compact variant of Shamir secret sharing on a ring, so that the scheme that originally requires all N participants to be online for decryption is relaxed to a scheme that only requires t participants among the N participants to be online to complete the decryption. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] Figure 1 This is a flow chart of an efficient threshold multi-party computing method in a decentralized model based on homomorphic encryption according to a preferred embodiment of the present invention.

[0071] Figure 2 This is a block diagram of an efficient threshold multi-party computing system in a decentralized model based on homomorphic encryption according to a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0072] The preferred embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0073] First, the parameters involved in the embodiment of the present invention are defined:

[0074] Assume that the security parameter of the solution in this embodiment is λ, the polynomial degree n is a power of 2, and the polynomial coefficient modulus q＞1 There are L different prime numbers q 1 ,...,q L The product of As The representative interval of the ciphertext space is a polynomial quotient ring. In addition, in the homomorphic encryption scheme, a←χ is used to represent Sampling according to the χ distribution. Key(R q ) represents a uniform ternary distribution, that is, a←Key(R q ) are uniformly and independently selected from {-1, 0, 1}, and this distribution is used for key generation. q ) indicates that the standard deviation is σ err The discrete Gaussian distribution of a←Err(R q ) All coefficients are independently derived from err The discrete Gaussian distribution used to generate the error polynomial is usually sufficient to meet the required difficulty requirements. q ) is the smear distribution in the noise flooding technique, which is usually a discrete Gaussian distribution with a large variance and a variance that is proportional to the security parameter λ and the ciphertext noise variance. Related. CRS(R q ) is generated from a public random string R q A uniform distribution in , where each party samples the same number of elements from the distribution.

[0075] like Figure 1 As shown, this embodiment provides a decentralized model efficient threshold multi-party computing method based on homomorphic encryption, which specifically includes the following steps:

[0076] (1) Initialization phase

[0077] All parties agree on public parameters (n, q, σ, Key, Err), and all participants With the common point α i ∈R q Associated, for all real numbers i,j,i≠j, the participant P i and participant P j The difference of the common points α i -α jConsidered as a unit.

[0078] (2) Private key generation phase

[0079] Step 1: Each participant P i Sampling i ←Key(R q ), generate their own private keys. In addition, P i Samplingc i,1 ,...,c i,t-1 ←R q , construct the share according to formula (1);

[0080]

[0081] Step 2: Open to the participant P j . Participant P i Received from P j The share is then calculated according to formula (2);

[0082]

[0083] In this step (2), the construction shares are as follows:

[0084] Firstly, by executing a compact variant of Shamir's secret sharing on the ring, the scheme that all N participants must be online to complete the protocol is relaxed to a threshold scheme that t < N participants can complete the protocol online; a special sequence α is constructed. 1 ,...,α N As the common points of Shamir secret sharing, these sequences have α for any i≠j i -α j There are inverses, and the process of selecting sequence elements with inverses is as follows:

[0085] (1)Selection range

[0086] Restrict the choice of common points for Shamir's secret sharing to On a constant polynomial of, that is, the coefficients of the non-constant terms of the polynomial are 0, for There is αX 0 ;

[0087] (2) Constructing a special sequence

[0088] Let q be a number of prime numbers q 1 ,...,q L The product of min =min(q 1 ,...,q L ),exist Choose N<q min Different values ​​are used as the common points of Shamir's secret sharing to ensure the formation of a special sequence.

[0089] (3) Public key generation phase

[0090] Step 1: From the online party collection Get t participants (if An error will be reported, the number of online participants has not reached the threshold, and the public key cannot be generated). These t online participants jointly control the offline participant P k Calculate according to formula (3);

[0091]

[0092] Step 2: After completing the reconstruction of the private keys of all participants, the i-th participant samples p 1,i ←R q ,e←Err(R q ), calculated according to formula (4);

[0093] p 0,i =-s′ i p 1,i +e (4)

[0094] Step 3: Output pk i =(p 0,i ,p 1,i ).

[0095] (4) Encryption stage

[0096] Participant P i and P k Enter the public key pk i , pk k and plaintext m i , m k , sampling u i ,u k ←Key(R q ), e 0,i ,e 1,i ,e 0,k ,e 1,k ←Err(R q ), participant P i and P k Calculate according to formula (5) and formula (6);

[0097] ct i =(c 0,i ,c 1,i )=(m i +u i p 0,i +e0,i ,u i p 1,i +e 1,i ) (5)

[0098] ct k =(c 0,k ,c 1,k )=(m k +u k p 0,k +e 0,k ,u k p 1,k +e 1,k ) (6)

[0099] (5) Expansion stage

[0100] The fresh ciphertext ct i and ct k Expand according to formula (7) and formula (8);

[0101]

[0102] (6) Calculation phase

[0103] Participant P i and P k Enter two ciphertexts And according to formula (9) and formula (10), the addition and multiplication functions are calculated respectively;

[0104] ct add =ct' i +ct' k (mod q) (9)

[0105]

[0106] (7) Relinearization stage

[0107] Ciphertext The linearized decryption structure of is destroyed, and the relinearization algorithm is run (the algorithm is detailed below), and the output ct mult .

[0108] After the homomorphic multiplication operation, the decryption structure of the ciphertext is destroyed, and there are two ciphertexts Performing a tensor product Among them, the ciphertext The private key corresponds to and The tensor product of the private key of Contains some nonlinear terms corresponding to different participants i ·s jThe multiplication operation destroys the decryption structure of the ciphertext, so it is necessary to convert the nonlinear ciphertext into a valid ciphertext through a relinearization method. However, the traditional solution relies on CRS to generate the public key, which requires the generation and calculation of a trusted third party, reducing the security of the solution. In this embodiment, the relinearization preprocessing solution without CRS is implemented as follows:

[0109] First, generate the evaluation key:

[0110] (1) Initialization phase

[0111] For a given security parameter λ, let the dimension of RLWE be n, the ciphertext modulus be q, the key distribution be χ, and the error distribution on R be ψ.

[0112] (2) Key Generation Phase

[0113] Sampling of all participants and s←χ. Sampling error vector e←ψ d , and set The above b = -s·a+e(mod q) outputs the public key (b,a). For the input plaintext μ∈R, the evaluation key is generated according to the following steps

[0114] Step 1: Sampling r←χ.

[0115] Step 2: Sampling and e 1 ←ψ d , and let d 0 =-s·d 1 +e 1 +r·g(modq).

[0116] Step 3: Sampling 2 ←ψ d , let d 2 =r·a+e 2 +μ·g(modq).

[0117] In the traditional scheme, parameter a is generated by a trusted third party during the initialization phase and plays the role of CRS in the protocol. The present invention removes this step and each party samples it during the key generation phase and uses it together with the generated b as the public key (b, a). The following formally describes the relinearization method:

[0118] Participant i generates their own private key s i 、Public key(b i ,a i ) and the evaluation key D i , public (b i ,a i ,D i ).

[0119] (1) Preprocessing stage

[0120] Participants i and j generate and the public key Suppose for 1≤l≤d we have Vector k on i,j,0 [l]= <g -1 (b j [l]),d i,0 > and k i,j,1 [l]= <g -1 (b j [l]),d i,1 >, that is, [k i,j,0 |k i,j,1 ]=M j ·[d i,0 |d i,1 ] Among them, M j ∈R d×d is a lth row g -1 (b j [l])∈R d Let k i,j,2 =d i,2 , get the preprocessing results, in:

[0121]

[0122] (2) Relinearization stage

[0123] Each participant inputs the ciphertext whose decryption structure is destroyed after the tensor product and k pairs of public keys and evaluation keys {(D i ,b i )} 1≤i≤k , follow the steps below to generate a decryptable ciphertext

[0124] Step 1: For all 1≤i,j≤k, execute step (1) to preprocess and output K i,j , let the relinearization key be

[0125]

[0126] Step 2: Let c′ 0 ←c 0,0 , for 1≤i≤k, we have c′ i ←c 0,i +c i,0 (modq).

[0127] Step 3: For 1≤i,j≤k, there is (c′ 0,c′ i ,c′ j )←(c′ 0 ,c′ i ,c′ j )+g -1 (c i,j )·K i,j (modq).

[0128] (8) Decryption stage

[0129] From the online party collection Get t participants (if An error will be reported, the number of online participants has not reached the threshold, and the public key cannot be generated). These t online participants jointly control the offline participant P k Calculate according to formula (11);

[0130]

[0131] Complete the reconstruction of the private keys of all offline participants. i and P k The ciphertext after input function calculation is as shown in formula (12);

[0132]

[0133] Here, ct f =ct add . Participant P i and P k Sampling i ,e k ←Smudge(R q ), start partial decryption, and calculate according to formula (13) and formula (14) respectively;

[0134] h i =c i s′ i +e i (13)

[0135] h k =c k s′ k +e k (14)

[0136] Participant P i and P k Public i and h k Then, calculate m i +m k ≈c 0 +∑h i .

[0137] In this embodiment, the reconstruction of the private key in steps (3) and (8) is the same as the share construction process in step (2).

[0138] The method of the present invention and the existing algorithm are implemented in code below, and the efficiency of the algorithms is compared. For specific results, please refer to Comparison Table 1.

[0139] Table 1. Performance comparison of TMHE and TMHE_WCRS, in milliseconds (ms)

[0140]

[0141] In the comparative experiment, the number of participants N = 20, the logarithm of the polynomial degree logn = 10, 11, 12, 13, 14 and the threshold t = 3, 7, 11, 15, 19 were selected respectively to analyze the performance of the threshold algorithm under the two models (CRS model and non-CRS model). Among them, TMHE is the threshold homomorphic algorithm under the CRS model proposed by Mouchet et al. (Mouchet C, Bertrand E, Hubaux J P. An efficient threshold access-structure for rlwe-based multiparty homomorphic encryption [J]. Journal of Cryptology, 2023, 36 (2): 10.), and TMHE_WCRS is the threshold homomorphic algorithm under the non-CRS model proposed in the present invention. As shown in Table 1, the two algorithms show two different performance change trends with the change of the number of thresholds. As the number of thresholds increases, the time of the TMHE_WCRS algorithm decreases, while the time of the TMHE algorithm increases. Among them, under the condition of high threshold number (t=15,19), the TMHE_WCRS algorithm time is lower than the TMHE algorithm. Under the condition of low threshold number (t=3,7), the TMHE algorithm time is lower than the TMHE_WCRS algorithm. This is because: under the condition of high threshold, the number of online participants is large, resulting in the threshold algorithm under the CRS model needing to construct more private keys. Under the condition of low threshold, the number of offline participants is large, resulting in the threshold algorithm without CRS model needing to construct more private keys. When the threshold t=11, the time of the two algorithms has advantages and disadvantages for different polynomial orders. This is due to the fact that the CRS model can construct the "collective public and private key" with the private keys of t participants, and then encrypt and decrypt the plaintext of N participants. Although this approach sacrifices greater security in exchange for performance, it is still weaker than the non-CRS model when logn=10,14. It is also this characteristic of the CRS model that causes its threshold algorithm to have a large fluctuation in algorithm time when the threshold number changes. In the non-CRS model, since the number of parties actually involved in the public-private key generation algorithm does not change with the change of the threshold number (essentially always remains N), the algorithm running time changes less than the threshold algorithm under the CRS model.

[0142] Table 2. Performance comparison of threshold algorithm and non-threshold algorithm without CRS model, in milliseconds (ms)

[0143]

[0144] In the comparative experiment, the number of participants N = 20, the logarithm of the polynomial degree logn = 10, 11, 12, 13, 14 and the threshold t = 3, 7, 11, 15, 19 were selected respectively to analyze the impact of the threshold scheme on the performance of the MHE algorithm. Among them, MHE_WCRS is a non-threshold MHE algorithm without CRS model, proposed by Luo et al. (Luo F, Wang H, Saif AK, et al. Multi-key FullyHomomorphic Encryption without CRS from RLWE[J]. Computer Standards&Interfaces, 2023, 86: 103742.), and TMHE_WCRS is a threshold MHE algorithm without CRS model. As shown in Table 2, the time of TMHE_WCRS is lower than that of MHE_WCRS, and the performance is better.

[0145] like Figure 2 As shown, this embodiment discloses a decentralized model efficient threshold multi-party computing system based on homomorphic encryption, which is used to execute the above method, and specifically includes the following modules:

[0146] Initialization module: all parties agree on common parameters;

[0147] Private key generation module: Participants generate their own private keys;

[0148] Public key generation module: The participants use the private key multiplied by the relevant parameters and add noise to generate the public key;

[0149] Encryption module: The participants use the public key to encrypt their own plaintext to obtain ciphertext;

[0150] Ciphertext expansion module: Participants expand ciphertext;

[0151] Computation module: performs addition and tensor product function calculations and outputs the calculated ciphertext;

[0152] Relinearization module: relinearizes the ciphertext obtained by the calculation module;

[0153] Decryption module: decrypts the ciphertext obtained by the relinearization module.

[0154] For other contents of this embodiment, reference may be made to the above embodiments.

[0155] The above description is only a preferred embodiment of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may also include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. An efficient threshold multi-party computing method based on homomorphic encryption in a decentralized model, characterized by: The specific steps include: (1) All parties agree on common parameters; (2) The participants generate their own private keys; (3) The participants use the private key multiplied by the parameter and then add the noise to generate the public key; (4) The participants use the public key to encrypt their respective plaintexts to obtain ciphertexts; (5) The participants expand the ciphertext; (6) Perform addition and tensor product function calculations and output the calculated ciphertext; (7) Relinearize the ciphertext of step (6); (8) Decrypt the ciphertext of step (7).

2. The decentralized model efficient threshold multi-party computing method based on homomorphic encryption as claimed in claim 1 is characterized in that: The steps are as follows: (1) All parties agree on the common parameters n, q, σ, Key, Err, and the common point α i ∈R q Associated, for real numbers i,j, the participant P i and participant P j The difference of the common points α i -α j is regarded as a unit; where i≠j; (2) Each participant P i Uniformly and independently select their respective keys s from the key distribution i ←Key(R q ), by selecting a common point on the ring; each participant P i Samplingc i,1 ,...,c i,t-1 ←R q , by putting c i,k and the kth power of the common points of all parties Multiply and sum them together and add each key to construct the share Publicize the shares to other participants P j ;Participant P i Received from other participants P j After the share is added, we get (3) From online participants Get t participants from the offline participant P k of The private key is reconstructed using the Lagrange interpolation method with the public points of each participant Participant P i Sampling p 1,i ←R q ,e←Err(R q )Use private key s i Multiply by p 1,i Adding noise e to output p 0,i , generate the public key pk i =(p 0,i ,p 1,i ); (4) Participant P i Sampling u i ←Key(R q ) and e 0,i ,e 1,i ←Err(R q ), use the public key to encrypt each plaintext and generate the ciphertext ct i =(c 0,i ,c 1,i ), the ciphertext consists of two parts, the first part c 0,i By plain text m i 、u i and p 0,i The product of the noise e 0,i The second part is composed of u i and p 1,i The product of and e 1,i It is achieved through seeking and summing up; (5)Participant P i The ciphertext ct i =(c 0,i ,c 1,i ) is expanded from two dimensions to N+1 dimensions, where N is the number of all participants. The second part of the ciphertext is transplanted to the i+1th dimension, and the remaining dimensions are filled with 0 to obtain the extended ciphertext (6)Participant P i and P k Cooperation i ,ct' k Perform addition and tensor product function calculations and output the calculated ciphertext ct add and (7) Generate an evaluation key, relinearize the ciphertext after homomorphic multiplication, and restore its decryption structure; (8) Obtain t participants from the set of online participants; these t participants have an impact on the offline participant P. k of The private key is reconstructed using the Lagrange interpolation method with the public points of each participant Participants P involved in the calculation i and P k Sampling i ,e k ←Smudge(R q ), the ciphertext after calculation Partial decryption begins, and party P i and P k Multiply the i+1th item and the k+1th item in the ciphertext by their respective private keys and add them to e i ,e k Sum and output h i and h k and make it public; i and h k After the sum, add c0 to decrypt the ciphertext.

3. The decentralized model efficient threshold multi-party computing method based on homomorphic encryption as claimed in claim 2 is characterized in that: In step (2), the construction shares are as follows: By executing a compact variant of Shamir's secret sharing on the ring, the scheme where all N participants must be online to complete the protocol is relaxed to a threshold scheme where t < N participants can complete the protocol online. Construct a special sequence α1,...,α N As the common points of Shamir secret sharing, these sequences have α for any i≠j i -α j There are inverses, and the process of selecting sequence elements with inverses is as follows: (1)Selection range Restrict the choice of common points for Shamir's secret sharing to On a constant polynomial of, that is, the coefficients of the non-constant terms of the polynomial are 0, for There is αX 0 ; (2) Constructing special sequences Let q be a number of prime numbers q1,...,q L The product of min =min(q1,...,q L ),exist Choose N<q min different values ​​are used as the public points of Shamir's secret sharing.

4. The decentralized model efficient threshold multi-party computing method based on homomorphic encryption as claimed in claim 3 is characterized in that: Step (7) is as follows: First, generate an evaluation key: (1) For a given security parameter λ, let the dimension of RLWE be n, the ciphertext modulus be q, the key distribution be χ, and the error distribution on R be ψ; (2) Sampling of each participant and s←χ; sampling error vector e←ψ d , and set b = -s·a+e(mod q) outputs the public key (b,a); for the input plaintext μ∈R, the evaluation key is generated according to the following steps Step 1: sampling r←χ; Step 2: Sampling and e1←ψ d , and let d0 = -s·d1+e1+r·g(modq); Step 3: Sampling e2←ψ d , let d2 = r·a+e2+μ·g(modq); Next, perform a relinearization: Participant i generates their own private key s i 、Public key(b i ,a i ) and the evaluation key D i , public (b i ,a i ,D i ); (1) Participants i and j generate and the public key Suppose for 1≤l≤d we have Vector k on i,j,0 [l]= <g -1 (b j [l]),d i,0 > and k i,j,1 [l]= <g -1 (b j [l]),d i,1 >, that is, [k i,j,0 |k i,j,1 ]=M j ·[d i,0 |d i,1 ], where M j ∈R d×d is a lth row g -1 (b j [l])∈R d Matrix of i,j,2 =d i,2 , get the preprocessing results, in: (2) Each participant inputs the ciphertext whose decryption structure is destroyed after the tensor product and k pairs of public keys and evaluation keys {(D i ,b i )} 1≤i≤k , follow the steps below to generate a decryptable ciphertext Step 1: For all 1≤i,j≤k, perform preprocessing steps and output K i,j , let the relinearization key be Step 2: Let c′0←c 0,0 , for 1≤i≤k, there is c i ′←c 0,i +c i,0 (modq); Step 3: For 1≤i,j≤k, there is (c′0,c i ′,c′ j )←(c′0,c i ′,c′ j )+g -1 (c i,j )·K i,j (modq).

5. A decentralized model efficient threshold multi-party computing system based on homomorphic encryption, used to execute the method according to any one of claims 1 to 4, characterized in that: The modules include: Initialization module: all parties agree on common parameters; Private key generation module: Participants generate their own private keys; Public key generation module: The participants use the private key multiplied by the parameter and then add the noise to generate the public key; Encryption module: The participants use the public key to encrypt their own plaintext to obtain ciphertext; Ciphertext expansion module: Participants expand ciphertext; Computation module: performs addition and tensor product function calculations and outputs the calculated ciphertext; Relinearization module: relinearizes the ciphertext obtained by the calculation module; Decryption module: decrypts the ciphertext obtained by the relinearization module.

Images