An efficient threshold multi-party computation method and system based on homomorphic encryption in a decentralized model

Abstract

This invention discloses an efficient threshold multi-party computation method and system based on homomorphic encryption in a decentralized model. The method specifically includes the following steps: (1) each participant agrees on common parameters; (2) each participant generates its own private key; (3) each participant uses its private key multiplied by the parameters and adds noise to generate a public key; (4) each participant uses its public key to encrypt its own plaintext to obtain ciphertext; (5) each participant expands the ciphertext; (6) addition and tensor product function calculations are performed, and the calculated ciphertext is output; (7) the ciphertext from step (6) is relinearized; and (8) the ciphertext from step (7) is decrypted. This invention can solve the problems of trusted third parties, algorithm paralysis after participant corruption, and low efficiency in relinearization in existing multi-party computation based on homomorphic encryption in cloud computing.

Description

Technical Field

[0001] This invention belongs to the field of information security technology and also relates to the field of homomorphic cryptography. Specifically, it is an efficient threshold multi-party calculation and system based on a homomorphic encryption-based CRS model without public random strings. Background Technology

[0002] With the rapid development of cloud computing, its flexible and efficient computing resources and services have provided convenience for users. However, storing secure data in the cloud poses significant privacy risks. Therefore, cloud-based data requires multiple users to collaboratively compute a function without exposing their privacy during multi-party computation. Simultaneously, the computation process involves substantial communication and coordination, increasing latency and computational costs, which significantly amplifies computational complexity. Homomorphic encryption simplifies multi-party computation, thus it is seen as an attempt to reduce security risks. Introducing a trusted third party can improve the efficiency of multi-party computation, but this also introduces issues such as centralization, leading to uncontrollable trust problems. In other words, if someone attacks the "trusted" third party, the privacy of all users and the computation results will be leaked, threatening user data security. This severely hinders the development of multi-party computation and consequently affects the secure deployment of cloud computing. Homomorphic encryption, hailed as the "holy grail" of cryptography, is a highly attractive cryptographic primitive that allows direct computation on ciphertext without decryption. This superior property makes homomorphic encryption an excellent "material" for secure multi-party computation. Traditional one-way homomorphic encryption cannot provide an effective solution for secure multi-party computation. Therefore, by extending one-way homomorphic encryption to multiple users, multi-party homomorphic encryption has emerged, providing a series of promising solutions for secure multi-party computation.

[0003] However, traditional secure multi-party computation schemes based on homomorphic encryption require all participants to collaborate to complete the decryption protocol, which limits the algorithm's fault tolerance and flexibility to some extent. Furthermore, the instantiation of multi-party computation schemes still relies on a Common Random String (CRS) and a trusted third party, weakening the semantic definition of the scheme's security. In addition, homomorphic multiplication operations can corrupt the decryption structure of the multiplication ciphertext, leading to decryption failure and requiring complex relinearization operations on the ciphertext product, which incurs computational inefficiency. Threshold multi-party computation schemes without a CRS model can continue the algorithm process even if some participants fail, and do not rely on CRS or trusted third parties, thus enhancing data security and privacy protection, improving computational efficiency, and increasing algorithm flexibility and reliability. By implementing a relinearization preprocessing scheme under a CRS-free model, an efficient solution is provided for the problem of ciphertext decryption structure corruption during homomorphic multiplication. This is very helpful in improving computational efficiency and reducing the risk of privacy leakage. Therefore, implementing a threshold multi-party computation scheme without a CRS model is feasible and of research significance.

[0004] In summary, there is an urgent need in the field of information security to design an efficient threshold multi-party computation (HMCC) technology based on homomorphic encryption without a CRS model. Based on this, this invention proposes an efficient threshold multi-party computation scheme based on homomorphic encryption without a CRS model. This scheme can solve the problems of trusted third parties, algorithm paralysis due to corruption of participating parties, and low efficiency in relinearization in existing cloud computing HMCC-based multi-party computations. Summary of the Invention

[0005] To address the aforementioned limitations of existing technologies, this invention provides a solution that enhances the security, fault tolerance, and efficiency of multi-party computation in the cloud. It offers a flexible, secure, and efficient multi-party computation solution without relying on a trusted third party and in a CRS-free model. Specifically, it is a decentralized, high-efficiency threshold multi-party computation method and system based on homomorphic encryption. This invention employs a CRS removal method, transforming the "collective public-private key" scheme into a scheme where "each participant possesses a pair of public and private keys." Through preprocessing relinearization, it achieves a highly fault-tolerant, secure, and efficient multi-party computation solution, ultimately laying the foundation for distributed computing security.

[0006] The technical solution adopted by this invention to solve its technical problem is as follows:

[0007] An efficient threshold multi-party computation method based on homomorphic encryption in a decentralized model is proposed. The main steps include initialization, private key generation, public key generation, encryption, expansion, computation, relinearization, and decryption, as detailed below:

[0008] (1) Common parameters agreed upon by all participating parties;

[0009] (2) Each participant generates its own private key;

[0010] (3) The participants use their private key multiplied by the relevant parameters and add noise to generate a public key;

[0011] (4) The participants use their public keys to encrypt their respective plaintexts to obtain ciphertexts;

[0012] (5) The participants expand the ciphertext;

[0013] (6) Perform addition and tensor product function calculations, and output the ciphertext after calculation;

[0014] (7) Perform relinearization on the ciphertext from step (6);

[0015] (8) Decrypt the ciphertext from step (7).

[0016] As a preferred embodiment, the present invention provides an efficient threshold multi-party computation method based on homomorphic encryption in a decentralized model, the specific steps of which are as follows:

[0017] (1) Initialization phase

[0018] Each participant agrees on a common parameter (n, q, σ, Key, Err), and it is related to the common point α. i ∈R q Related, for all real numbers i, j, i ≠ j, the participants P will be involved. i and participating party P j The difference α between common points i -α j Treat it as a single unit.

[0019] (2) Private key generation stage

[0020] Each participant P i Select your own key s independently and evenly from the key distribution. i ←Key(R q ( ), by selecting a common point on the ring. Each participating party P i Sampling c i,1 ,...,c i,t-1 ←R q By taking c i,k and the k-th power of the common points of all parties Multiply, sum, and add to your own key to construct a share. Disclose the share to other participants P j Participant P i Received from other participants P j The shares are summed to obtain

[0021] (3) Public key generation phase

[0022] From the online participants Retrieve t participants (an error will occur if the number of participants in the online participant set is less than t). These t participants are related to the offline participant P. k of The private keys of each participating party are reconstructed using Lagrange interpolation at their public points. Participant P i Sampling p 1,i ←R q ,e←Err(R q Using private key s i Multiply by p 1,i Add noise e to output p 0,i Generate public key pk i =(p 0,i ,p 1,i ).

[0023] (4) Encryption phase

[0024] Participant P i Sampling u i ←Key(R q ) and e 0,i ,e 1,i ←Err(R q After that, the public key is used to encrypt each plaintext to generate the ciphertext ct. i =(c 0,i ,c 1,i The ciphertext consists of two parts, the first part being c 0,i From plaintext m i u i and p 0,i The product and noise e 0,i The summation is obtained by adding u together, and the second part is composed of u. i and p 1,i The product of and e 1,i It is obtained by summing.

[0025] (5) Expansion Phase

[0026] Participant P i ciphertext ct i =(c 0,i ,c 1,i Expanding the ciphertext from two dimensions to N+1 dimensions, where N is the number of all participants, involves moving the second part of the original ciphertext to the (i+1)th dimension and filling the remaining dimensions with 0s, resulting in the expanded ciphertext.

[0027]

[0028] (6) Calculation stage

[0029] Participant P i and P k Cooperation against ct' i ,ct' k Perform addition and tensor product function calculations, and output the resulting ciphertext ct. add and

[0030] (7) Relinearization stage

[0031] After homomorphic multiplication, the ciphertext transforms from linear to nonlinear, disrupting the decryption structure. An evaluation key is generated, and the ciphertext after homomorphic multiplication is relinearized to restore its decryption structure.

[0032] (8) Decryption stage

[0033] Retrieve t participants from the online participant set (an error will occur if the number of participants in the prior participant set is less than t). These t participants are related to the offline participant P. k of The private keys of each participating party are reconstructed using Lagrange interpolation at their public points. Participant P in the calculation i and P k Sampling e i ,e k ←Smudge(R q ), for the calculated ciphertext Partial decryption begins, participant P i and P k Multiply the (i+1)th and (k+1)th terms in the ciphertext by their respective private keys, and then multiply each by e. i ,e k Sum and output h i and h k And make it public. Regarding h i and h k Summing the results and adding c0 will decrypt the corresponding ciphertext.

[0034] Further optimized scheme: In step (2), the specific construction of the share is as follows: This invention first relaxes the scheme that requires all N participants to be online to complete the protocol by executing a compact variant of Shamir secret sharing on the ring to a threshold scheme where t < N participants are online to complete the protocol. Traditional Shamir secret sharing is executed on a domain, where non-zero elements are invertible, which satisfies the requirement of the Chinese Remainder Theorem (CRT) for constructing Lagrange interpolation coefficients. However, element multiplication in the ring only needs to satisfy the condition of a multiplicative semigroup, that is, not all elements have inverses. If all common points are still directly sampled from the ring, then the i-th participant P required to calculate the Lagrange coefficients is... i and the j-th participant P j common point α i -α j Since inverses may not exist, Lagrange coefficients may not exist either. To implement Lagrange interpolation in a ring, it's necessary to address the issue that some elements in the ring lack inverses. Therefore, a special sequence α1,...,α can be constructed. N As the shared public points of Shamir's secrets, these sequences are characterized by having α for any i ≠ j. i -α j If inverses exist, the process of selecting these sequence elements with inverses is as follows:

[0035] (1) Select range

[0036] This invention restricts the selection of public points for Shamir's secret sharing to... On a constant polynomial, that is, the coefficients of the non-constant terms of the polynomial are 0, as in the form of...

[0037] (2) Constructing special sequences

[0038] Suppose q is a set of prime numbers q1,...,q L The product of , let q min =min(q1,...,q) L This algorithm is in Choose N < q min The presence of distinct values ​​serves as a shared public point in Shamir's secrets, ensuring the formation of the special sequence.

[0039] After completing the Shamir secret share on the ring, the protocol is ready to construct a thresholding scheme. Decentralization is crucial in multi-party computation. In traditional schemes, a trusted third party provides a CRS (Content Request Query), and the participants use the CRS to construct a collective public key. This poses a challenge to the security of the protocol.

[0040] The invention proposes a multi-party variant of the BGV homomorphic encryption algorithm without a CRS model. By transforming the original method of "computing a collective public key" into a more natural method of "each participant having their own individual public key", this approach not only reduces the need for centralization but also makes the security of multi-party computation more dependent on the difficulty of the RLWE problem.

[0041] Further optimization scheme: The process of reconstructing the private key in steps (3) and (8) is the same as the process of constructing the share in step (2).

[0042] Further optimization of the solution: Step (7) is as follows:

[0043] First, generate the evaluation key:

[0044] (1) For a given security parameter λ, let the dimension of RLWE be n, the ciphertext modulus be q, the key distribution be χ, and the error distribution on R be ψ;

[0045] (2) Sampling of each participating party And s←χ; sampling error vector e←ψ d and set The output public key is b = -s·a + e (mod q). For the input plaintext μ ∈ R, the evaluation key is generated according to the following steps.

[0046] Step 1: Sampling r←χ;

[0047] Step 2: Sampling and e1←ψ d And let d0 = -s·d1 + e1 + r·g(mod q);

[0048] Step 3: Sampling e2←ψ d Let d² = r·a + e² + μ·g (mod q);

[0049] Secondly, relinearization is performed:

[0050] Participant i generates its own private key s i Public key (b) i ,a i ) and evaluation key D i , public (b i ,a i D i );

[0051] (1) Participants i and j generate respectively and public key Suppose that for 1 ≤ l ≤ d, we have vector k on i,j,0 [l]= <g -1 (bj [l]),d i,0 >and k i,j,1 [l]= <g -1 (b j [l]),d i,1 >, that is, [k] i,j,0 |k i,j,1 ] = M j ·[d i,0 |d i,1 ], where M j ∈R d×d It is the lth line g -1 (b j [l])∈R d The matrix; let k i,j,2 =d i,2 Obtain the preprocessing results. in:

[0052]

[0053] (2) Each participant inputs the ciphertext whose structure is destroyed after the tensor product. And k pairs of public keys and evaluation keys {(D i ,b i )} 1≤i≤k Generate decryptable ciphertext by following these steps.

[0054] Step 1: Perform a preprocessing step for all cases 1≤i,j≤k and output K. i,j Let the relinearization key be...

[0055]

[0056] Step 2: Let c′0 ← c 0,0 For 1≤i≤k, we have c′ i ←c 0,i +c i,0 (modq);

[0057] Step 3: For 1≤i,j≤k, we have (c′0,c′) i ,c′ j )←(c′0,c′ i ,c′ j )+g -1 (c i,j )·K i,j (modq).

[0058] This invention also discloses an efficient threshold multi-party computation system based on homomorphic encryption in a decentralized model, used to execute the above method, which specifically includes the following modules:

[0059] Initialization module: Common parameters agreed upon by all participating parties;

[0060] Private key generation module: Participants generate their own private keys;

[0061] Public key generation module: Participants use their private key multiplied by relevant parameters and add noise to generate a public key;

[0062] Encryption module: Participants use public keys to encrypt their respective plaintext to obtain ciphertext;

[0063] Ciphertext Extension Module: Participants extend the ciphertext;

[0064] Calculation module: Performs addition and tensor product function calculations, and outputs the calculated ciphertext;

[0065] Relinearization module: Performs relinearization processing on the ciphertext obtained by the computation module;

[0066] Decryption module: Decrypts the ciphertext obtained by the relinearization module.

[0067] Compared with the prior art, the present invention has the following significant technical effects:

[0068] This invention employs a method to remove CRS, transforming the "collective public-private key" scheme into a scheme where "each participant has a pair of public and private keys." Through a preprocessing relinearization method, it achieves a highly fault-tolerant, secure, and efficient multi-party computation scheme, ultimately laying the foundation for distributed computing security.

[0069] The preferred embodiment of the present invention implements a threshold decryption scheme by executing a compact variant of Shamir secret sharing on the ring, thereby relaxing the original scheme that required all N participants to be online to complete the decryption to a scheme that only requires t participants out of N participants to be online. Attached Figure Description

[0070] Figure 1 The flowchart below shows a preferred embodiment of the present invention: an efficient threshold multi-party computation method based on homomorphic encryption in a decentralized model.

[0071] Figure 2 This is a block diagram of a decentralized, high-efficiency threshold multi-party computation system based on homomorphic encryption, according to a preferred embodiment of the present invention. Detailed Implementation

[0072] The preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0073] First, the parameters involved in the embodiments of the present invention are defined:

[0074] Let the safety parameter of the scheme in this embodiment be λ, and the polynomial degree n be a power of 2. For the polynomial coefficients modulo... q＞1 Given L distinct prime numbers q1,...,q L The product of, As Representative intervals, ciphertext space This is a polynomial quotient ring. Furthermore, in homomorphic encryption schemes, a←χ is used to represent... Sampling is performed according to the χ² distribution. Key(R) q ) represents a uniform ternary distribution, i.e., a←Key(R) q All coefficients of ) are uniformly and independently chosen from {-1, 0, 1}, and this distribution is used for key generation. Err(R) q ) represents the standard deviation as σ err The discrete Gaussian distribution, i.e., a←Err(R) q All coefficients are independent from the standard deviation σ. err The sampled data is derived from a discrete Gaussian distribution, which is usually sufficient to generate the error polynomial to meet the required difficulty level. Smudge(R) q The smear distribution in noise flooding technology is typically a discrete Gaussian distribution with a large variance, the magnitude of which is related to the safety parameter λ and the variance of the encrypted noise. Related. CRS(R) q R is generated based on a common random string. q The elements are uniformly distributed in the distribution, and all parties sample the same elements from this distribution.

[0075] like Figure 1 As shown in the figure, this embodiment presents an efficient threshold multi-party computation method based on homomorphic encryption in a decentralized model, which specifically includes the following steps:

[0076] (1) Initialization phase

[0077] The parties agree on the common parameters (n,q,σ,Key,Err), and each participating party... With common point α i ∈R q Related, for all real numbers i, j, i ≠ j, the participants P will be involved. i and participating party P j The difference α between common points i -α j Treat it as a single unit.

[0078] (2) Private key generation stage

[0079] Step 1: Each participant P i Sampling i ←Key(R qEach generates its own private key. Additionally, P... i Sampling c i,1 ,...,c i,t-1 ←R q Construct the shares according to formula (1);

[0080]

[0081] Step Two: Disclosed to participant P j Participant P i Received from P j The share is then calculated according to formula (2);

[0082]

[0083] In this step (2), the shares are constructed as follows:

[0084] First, by executing a compact variant of Shamir's secret sharing on the ring, the scheme requiring all N participants to be online to complete the protocol is relaxed to a threshold scheme where t < N participants being online is sufficient to complete the protocol; a special sequence α1,...,α is constructed. N As a shared public point secretly shared by Shamir, these sequences have α for any i ≠ j. i -α j If inverses exist, the process of selecting these sequence elements with inverses is as follows:

[0085] (1) Select range

[0086] Restrict the choice of public points secretly shared by Shamir to On a constant polynomial, that is, the coefficients of the non-constant terms of the polynomial are 0, for There is αX 0 ;

[0087] (2) Constructing special sequences

[0088] Let q be multiple prime numbers q1,...,q L The product of , let q min =min(q1,...,q) L ),exist Choose N < q min The presence of distinct values ​​serves as a shared public point in Shamir's secrets, ensuring the formation of the special sequence.

[0089] (3) Public key generation phase

[0090] Step 1: From the online participant pool Get t participants (if An error will occur: the number of online participants has not reached the threshold, and a public key cannot be generated. These t online participants jointly support the offline participant P. k Calculate according to equation (3);

[0091]

[0092] Step 2: After completing the private key reconstruction of each participant, sample p from the i-th participant. 1,i ←R q ,e←Err(R q ), calculated according to formula (4);

[0093] p 0,i =-s′ i p 1,i +e (4)

[0094] Step 3: Output PK i =(p 0,i ,p 1,i ).

[0095] (4) Encryption phase

[0096] Participant P i and P k Enter public key pk i , pk k and plaintext m i m k Sampling u i ,u k ←Key(R q ), e 0,i ,e 1,i ,e 0,k ,e 1,k ←Err(R q Participant P i and P k Calculations are performed based on equations (5) and (6);

[0097] ct i =(c 0,i ,c 1,i )=(m i +u i p 0,i +e 0,i ,u i p 1,i +e 1,i (5)

[0098] ct k =(c 0,k ,c 1,k )=(m k +u k p0,k +e 0,k ,u k p 1,k +e 1,k (6)

[0099] (5) Expansion Phase

[0100] Fresh encrypted CT i and ct k Extend according to equations (7) and (8);

[0101]

[0102] (6) Calculation stage

[0103] Participant P i and P k Input two ciphertexts Furthermore, the addition and multiplication functions are calculated according to equations (9) and (10) respectively;

[0104] ct add =ct' i +ct' k (mod q) (9)

[0105]

[0106] (7) Relinearization stage

[0107] Cipher The linearized decryption structure is corrupted, so a relinearization algorithm is run (details below), outputting ct. mult .

[0108] After a homomorphic multiplication operation, the decryption structure of the ciphertext is destroyed, resulting in two ciphertexts. Perform tensor product Among them, ciphertext The private key corresponds to and The tensor product of the private key, It includes some nonlinear terms s corresponding to different participants. i ·s j Multiplication operations disrupt the decryption structure of the ciphertext, so a relinearization method is needed to transform the nonlinear ciphertext into valid ciphertext. However, traditional solutions rely on CRS to generate the public key, which requires generation and computation by a trusted third party, reducing the security of the solution. In this embodiment, a relinearization preprocessing scheme without CRS is implemented as follows:

[0109] First, generate the evaluation key:

[0110] (1) Initialization phase

[0111] For a given security parameter λ, let the dimension of RLWE be n, the ciphertext modulus be q, the key distribution be χ, and the error distribution on R be ψ.

[0112] (2) Key generation stage

[0113] Sampling by each participant And s←χ. Sampling error vector e←ψ d and set The output public key is (b, a) = -s·a + e (mod q). For the input plaintext μ∈R, the evaluation key is generated according to the following steps.

[0114] Step 1: Sampling r←χ.

[0115] Step 2: Sampling and e1←ψ d And let d0 = -s·d1 + e1 + r·g (mod q).

[0116] Step 3: Sampling e2←ψ d Let d2 = r·a + e2 + μ·g (mod q).

[0117] In traditional schemes, parameter 'a' is generated by a trusted third party during the initialization phase and plays the role of CRS in the protocol. This invention eliminates this step by having each party sample during the key generation phase, and using this sample along with the generated 'b' as the public key (b, a). The relinearization method is described below:

[0118] Participant i generates its own private key s i Public key (b) i ,a i ) and evaluation key D i , public (b i ,a i D i ).

[0119] (1) Preprocessing stage

[0120] Participants i and j generate respectively and public key Suppose that for 1 ≤ l ≤ d, we have vector k on i,j,0 [l]= <g -1 (b j [l]),d i,0 >and k i,j,1 [l]= <g -1 (b j [l]),d i,1 >, that is, [k i,j,0|k i,j,1 ] = M j ·[d i,0 |d i,1 M j ∈R d×d It is the lth line g -1 (b j [l])∈R d The matrix. Let k i,j,2 =d i,2 Obtain the preprocessing results. in:

[0121]

[0122] (2) Relinearization stage

[0123] Each participant inputs the ciphertext whose structure is corrupted after tensor product. And k pairs of public keys and evaluation keys {(D i ,b i )} 1≤i≤k Generate a decryptable ciphertext by following these steps.

[0124] Step 1: For all 1≤i,j≤k, perform step (1) to preprocess the output K. i,j Let the relinearization key be...

[0125]

[0126] Step 2: Let c′0 ← c 0,0 For 1≤i≤k, we have c′ i ←c 0,i +c i,0 (modq).

[0127] Step 3: For 1≤i,j≤k, we have (c′0,c′) i ,c′ j )←(c′0,c′ i ,c′ j )+g -1 (c i,j )·K i,j (modq).

[0128] (8) Decryption stage

[0129] From the online participant pool Get t participants (if An error will occur: the number of online participants has not reached the threshold, and a public key cannot be generated. These t online participants jointly support the offline participant P. k Calculate according to formula (11);

[0130]

[0131] Complete the private key reconstruction for each offline participant. Participant P i and P k The ciphertext after the input function is calculated is in the form of equation (12);

[0132]

[0133] Here, ct f =ct add Participant P i and P k Sampling e i ,e k ←Smudge(R q The initial part is decrypted, and calculations are performed according to equations (13) and (14) respectively;

[0134] h i =c i s′ i +e i (13)

[0135] h k =c k s′ k +e k (14)

[0136] Participant P i and P k Public h i and h k Then, we jointly calculate m. i +m k ≈c0+∑h i .

[0137] In this embodiment, the process of reconstructing the private key in steps (3) and (8) is the same as the process of constructing the share in step (2).

[0138] The following section provides code implementations of the method of this invention and existing algorithms, and compares the algorithm efficiency. For specific results, please refer to Comparison Table 1.

[0139] Table 1. Performance comparison of TMHE and TMHE_WCRS, in milliseconds (ms)

[0140]

[0141] In the comparative experiment, the number of participants N=20, the logarithm of the polynomial degree logn=10,11,12,13,14, and the threshold t=3,7,11,15,19 were selected respectively to analyze the performance of the thresholding algorithm under two models (CRS model and no CRS model). Among them, TMHE is the threshold homomorphic algorithm under the CRS model proposed by Mouchet et al. (Mouchet C, Bertrand E, Hubaux J P. An efficient threshold access-structure for rlwe-based multiparty homomorphic encryption[J]. Journal of Cryptology,2023,36(2):10.), and TMHE_WCRS is the threshold homomorphic algorithm under the no CRS model proposed in this invention. As shown in Table 1, the two algorithms show two different performance trends with the change of the number of thresholds. With the increase of the number of thresholds, the time of TMHE_WCRS algorithm decreases, while the time of TMHE algorithm increases. Specifically, under conditions of high threshold numbers (t = 15, 19), the TMHE_WCRS algorithm has a shorter time than the TMHE algorithm. However, under conditions of low threshold numbers (t = 3, 7), the TMHE algorithm has a shorter time than the TMHE_WCRS algorithm. This is because: under high threshold conditions, the number of online participants is larger, requiring the thresholding algorithm under the CRS model to construct more private keys. Under low threshold conditions, the number of offline participants is larger, requiring the thresholding algorithm without CRS to construct more private keys. When the threshold t = 11, the time of the two algorithms varies for different polynomial degrees. This is due to the CRS model's ability to construct a "collective public-private key" using only the private keys of t participants, and then encrypting and decrypting the plaintext of N participants. Although this approach sacrifices significant security for performance, it is still weaker than the non-CRS model when logn = 10, 14. It is precisely this characteristic of the CRS model that causes its thresholding algorithm's time to fluctuate significantly with changes in the number of thresholds. The CRS-free model has a smaller variation in algorithm runtime compared to the threshold algorithm under the CRS model because the number of participants in the public and private key generation algorithm does not change with the threshold number (essentially always remaining at N).

[0142] Table 2. Performance comparison of thresholding algorithm and non-thresholding algorithm under CRS-free model, in milliseconds (ms).

[0143]

[0144] In the comparative experiment, the number of participants N=20, the logarithm of the polynomial degree logn=10,11,12,13,14, and the threshold t=3,7,11,15,19 were selected respectively to analyze the impact of the threshold scheme on the performance of the MHE algorithm. Among them, MHE_WCRS is the non-threshold MHE algorithm without CRS model, proposed by Luo et al. (Luo F, Wang H, Saif AK, et al. Multi-key FullyHomomorphic Encryption without CRS from RLWE[J]. Computer Standards&Interfaces,2023,86:103742.), and TMHE_WCRS is the threshold MHE algorithm without CRS model. As shown in Table 2, TMHE_WCRS has a shorter time than MHE_WCRS and better performance.

[0145] like Figure 2 As shown, this embodiment discloses an efficient threshold multi-party computation system based on homomorphic encryption in a decentralized model, used to execute the above method, specifically including the following modules:

[0146] Initialization module: Common parameters agreed upon by all participating parties;

[0147] Private key generation module: Participants generate their own private keys;

[0148] Public key generation module: Participants use their private key multiplied by relevant parameters and add noise to generate a public key;

[0149] Encryption module: Participants use public keys to encrypt their respective plaintext to obtain ciphertext;

[0150] Ciphertext Extension Module: Participants extend the ciphertext;

[0151] Calculation module: Performs addition and tensor product function calculations, and outputs the calculated ciphertext;

[0152] Relinearization module: Performs relinearization processing on the ciphertext obtained by the computation module;

[0153] Decryption module: Decrypts the ciphertext obtained by the relinearization module.

[0154] Other aspects of this embodiment can be found in the embodiments described above.

[0155] The above description is merely a preferred embodiment of the present invention and the technical principles employed. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and various obvious changes, readjustments, and substitutions can be made without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in detail through the above embodiments, the present invention is not limited to the above embodiments, and may include many other equivalent embodiments without departing from the concept of the present invention, the scope of which is determined by the scope of the appended claims.

Claims

1. An efficient threshold multi-party computation method based on homomorphic encryption in a decentralized model, characterized by: Specifically, the steps include the following: (1) Common parameters agreed upon by all participating parties; (2) Each participant generates its own private key; (3) The participants use their private key multiplied by the parameters and added to the noise to generate a public key; (4) The participants use their public keys to encrypt their respective plaintexts to obtain ciphertexts; (5) The participants expand the ciphertext; (6) Perform addition and tensor product function calculations, and output the ciphertext after calculation; (7) Perform relinearization on the ciphertext from step (6); (8) Decrypt the ciphertext from step (7); The specific steps are as follows: (1) Each participating party agrees on the common parameters n, q, σ, Key, Err, and the common point α. i ∈R q Relatedly, for real numbers i, j, the participating party P i and participating party P j The difference α between common points i -α j Consider i as a single unit; where i ≠ j; (2) Each participant P i Each key s is selected independently and uniformly from the key distribution. i ←Key(R q ), by selecting a common point on the ring; each participating party P i Sampling c i,1 ,...,c i,t-1 ←R q By taking c i,k k-th power of the common points of all parties Multiply, sum, and add each key to construct a share. Disclose the share to other participants P j Participant P i Received from other participants P j The shares are summed to obtain (3) From the set of online participants P online Get t participants; these t participants are related to offline participant P. k of The private key is reconstructed using Lagrange interpolation from the public key of each participant. Participant P i Sampling p 1,i ←R q ,e←Err(R q Using private key s i Multiply by p 1,i Add noise e to output p 0,i Generate public key pk i =(p 0,i ,p 1,i ); (4) Participant P i Sampling u i ←Key(R q ) and e 0,i ,e 1,i ←Err(R q After that, the public key is used to encrypt each plaintext to generate the ciphertext ct. i =(c 0,i ,c 1,i The ciphertext consists of two parts, the first part being c 0,i From plaintext m i u i and p 0,i The product and noise e 0,i The summation is obtained by adding u together, and the second part is composed of u. i and p 1,i The product of and e 1,i Summation; (5) Participant P i ciphertext ct i =(c 0,i ,c 1,i Expanding the ciphertext from two dimensions to N+1 dimensions, where N is the number of all participants, involves transferring the second part of the ciphertext to the (i+1)th dimension and filling the remaining dimensions with 0s, resulting in the expanded ciphertext. (6) Participant P i and P k Cooperation against ct' i ,ct' k Perform addition and tensor product function calculations, and output the resulting ciphertext ct. add and (7) Generate an evaluation key, relinearize the ciphertext after homomorphic multiplication, and restore its decryption structure; (8) Obtain t participants from the online participant set; these t participants are related to the offline participant P. k of The private key is reconstructed using Lagrange interpolation from the public key of each participant. Participant P in the calculation i and P k Sampling e i ,e k ←Smudge(R q ), for the calculated ciphertext Partial decryption begins, participant P i and P k Multiply the (i+1)th and (k+1)th terms in the ciphertext by their respective private keys, and then multiply each by e. i ,e k Summation, output h i and h k And make it public; regarding h i and h k Summing the results and adding c0 will decrypt the ciphertext.

2. The efficient threshold multi-party computation method based on homomorphic encryption in a decentralized model as described in claim 1, characterized in that, In step (2), the share is constructed as follows: By implementing a compact variant of Shamir's secret sharing on the ring, the scheme in which all N participants must be online to complete the protocol is relaxed to a threshold scheme in which the protocol can be completed with t < N participants online; Construct a special sequence α1,...,α N As a shared public point secretly shared by Shamir, these sequences have α for any i ≠ j. i -α j If inverses exist, the process of selecting these sequence elements with inverses is as follows: (1) Select range Restrict the selection of public points secretly shared by Shamir to R q =Z q [X] / (X n +1) on a constant polynomial, that is, the coefficients of the non-constant terms of the polynomial are 0, for There is αX 0 ; (2) Constructing special sequences Let q be multiple prime numbers q1,...,q L The product of , let q min =min(q1,...,q) L ),exist Choose N < q min A number of distinct values ​​serve as the public points that Shamir secretly shares.

3. The efficient threshold multi-party computation method for decentralized models based on homomorphic encryption as described in claim 2, characterized in that, Step (7) is as follows: First, generate the evaluation key: (1) For a given security parameter λ, let the dimension of RLWE be n, the ciphertext modulus be q, the key distribution be χ, and the error distribution on R be ψ; (2) Sampling of each participating party And s←χ; sampling error vector e←ψ d and set The output public key is b = -s·a + e (mod q). For the input plaintext μ∈R, the evaluation key is generated according to the following steps. Step 1: Sampling r←χ; Step 2: Sampling and e1←ψ d And let d0 = -s·d1 + e1 + r·g(mod q); Step 3: Sampling e2←ψ d Let d² = r·a + e² + μ·g (mod q); Secondly, relinearization is performed: Participant i generates its own private key s i Public key (b) i ,a i ) and evaluation key D i , public (b i ,a i D i ); (1) Participants i and j generate respectively and public key Let for have vectors on and Right now Where M j ∈R d×d It is the first Behavior The matrix; let k i,j,2 =d i,2 Obtain the preprocessing results. in: (2) Each participant inputs the ciphertext whose structure is destroyed after the tensor product. And k pairs of public keys and evaluation keys {(D i ,b i )} 1≤i≤k Generate decryptable ciphertext by following these steps. Step 1: Perform a preprocessing step for all cases 1≤i,j≤k and output K. i,j Let the relinearization key be... Step 2: Let c′0 ← c 0,0 For 1≤i≤k, we have c′ i ←c 0,i +c i,0 (modq); Step 3: For 1≤i,j≤k, we have (c′0,c′) i ,c′ j )←(c′0,c′ i ,c′ j )+g -1 (c i,j )·K i,j (mod q).

4. A high-efficiency threshold multi-party computation system based on homomorphic encryption in a decentralized model, used to perform the method as described in any one of claims 1-3, characterized in that, Specifically, it includes the following modules: Initialization module: Common parameters agreed upon by all participating parties; Private key generation module: Participants generate their own private keys; Public key generation module: Participants use their private key multiplied by parameters and added noise to generate a public key; Encryption module: Participants use public keys to encrypt their respective plaintext to obtain ciphertext; Ciphertext Extension Module: Participants extend the ciphertext; Calculation module: Performs addition and tensor product function calculations, and outputs the calculated ciphertext; Relinearization module: Performs relinearization processing on the ciphertext obtained by the computation module; Decryption module: Decrypts the ciphertext obtained by the relinearization module.

Images