Multi-party computing method based on homomorphic encryption, computer medium and electronic equipment

Abstract

The invention discloses a multi-party computing method based on homomorphic encryption, a computer medium and electronic equipment, the method is applied to a data owning party, and the method comprises the following steps: acquiring a private key, a key parameter, an encryption public parameter and plaintext information corresponding to the data owning party; generating a comparison key of the analysis mechanism and a coordination key of the coordination mechanism according to the private key and the key parameter; performing a first preset round of iterative operation based on the private key, the encryption public parameter and the plaintext information to obtain ciphertext information corresponding to the plaintext information; receiving a ciphertext analysis rate obtained by performing encryption operation on the ciphertext information by the analysis mechanism and the coordination mechanism; and performing a second preset round of iterative operation based on the private key, the encryption public parameter and the ciphertext analysis rate to obtain a decrypted temporary comparison result. Therefore, only a data owner knows a real calculation result, and the analysis mechanism and the coordination mechanism directly perform calculation through the ciphertext, so that homomorphic encryption supporting addition, subtraction, multiplication and division operation and comparison operation at the same time can be realized, and the data security of multi-party operation is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of blockchain and cryptography, and more specifically, relates to a multi-party computing method, computer medium and electronic device based on homomorphic encryption. Background Art

[0002] In the financial field, sensitive data needs to be encrypted and protected, and the encrypted data needs to be analyzed. In addition to arithmetic operations such as addition, subtraction, multiplication and division, comparison operations are also required, but traditional solutions only support a single operation. In the current solutions that support both arithmetic operations and logical comparisons, very complex conversion protocols need to be executed, such as the conversion between the CKKS algorithm and the TFHE algorithm, which consumes a lot of computing resources. Alternatively, the homomorphic encryption algorithm protocols of these solutions are complex in design, and the time required to complete a single operation is between milliseconds and seconds, with poor computing efficiency, making it difficult to support massive data analysis.

[0003] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present application, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0004] The purpose of the present invention is to provide a multi-party computing method, computer medium and electronic device based on homomorphic encryption, which are used to improve the problem of time-consuming calculations caused by complex calculation protocols in related technologies.

[0005] According to one aspect of an embodiment of the present application, a multi-party computing method based on homomorphic encryption is provided, which is applied to a data owner, and the method includes:

[0006] Obtain the private key, key parameters, encrypted public parameters and plaintext information corresponding to the data owner;

[0007] Generate a comparison key of the analysis organization and a coordination key of the coordination organization according to the private key and the key parameters;

[0008] Perform a first preset round of iterative operations based on the private key, the encrypted public parameter and the plaintext information to obtain ciphertext information corresponding to the plaintext information;

[0009] The ciphertext analysis rate obtained by the receiving analysis agency and the coordination agency performing encryption operations on the ciphertext information;

[0010] A second preset round of iterative operations is performed based on the private key, the encryption public parameter and the ciphertext analysis rate to obtain a temporary comparison result of the decryption.

[0011] In some embodiments, a first preset round of iterative operations is performed based on a private key, encrypted public parameters and plaintext information to obtain ciphertext information corresponding to the plaintext information, including: performing a first round of iterative calculations based on the private key, encrypted public parameters and plaintext information to obtain an initial iteration factor; calculating a first iteration factor and a second iteration factor based on the private key, encrypted public parameters, plaintext information and the initial iteration factor; the first iteration factor is the previous round iteration factor of the first preset round, and the second iteration factor is the iteration factor of the first preset round; encrypting the plaintext information based on the first iteration factor and the second iteration factor to obtain the ciphertext information.

[0012] In some embodiments, a second preset round of iterative calculations is performed based on the private key, the encryption public parameters and the ciphertext analysis rate to obtain a temporary comparison result of decryption, including: a first round of iterative calculations is performed based on the private key, the encryption public parameters and the ciphertext analysis rate to obtain a first initial iterative ciphertext; an iterative calculation is performed based on the private key, the encryption public parameters and the first initial iterative ciphertext to calculate and obtain a temporary comparison result.

[0013] In some embodiments, a comparison key of the analysis organization and a coordination key of the coordination organization are generated based on a private key and key parameters, including: generating a coordination key based on randomly selecting a preset number of key parameters; performing preset calculations on the private key and the coordination key to obtain a comparison key.

[0014] In some embodiments, after performing a first preset round of iterative operations based on the private key, encrypted public parameters and plaintext information to obtain ciphertext information corresponding to the plaintext information, the method also includes: sending the encrypted public parameters, ciphertext information and comparison key to the analysis agency; sending the encrypted public parameters and coordination key to the coordination agency.

[0015] According to one aspect of an embodiment of the present application, a multi-party computing method based on homomorphic encryption is provided, which is applied to an analysis organization, and the method includes:

[0016] Receive the encrypted public parameters, comparison key and ciphertext information sent by the data owner;

[0017] According to the preset operation model and ciphertext information, a temporary ciphertext to be compared is calculated;

[0018] Perform a third preset round of iterative operations based on the comparison key and the temporary ciphertext to be compared, to obtain a temporary comparison result;

[0019] The temporary comparison result is encrypted using a random obfuscation parameter to obtain a comparison offset result;

[0020] The comparison offset results are sent to the coordinating agency.

[0021] In some embodiments, the preset operation model includes addition operation, multiplication operation and preset coefficient, and the ciphertext information includes a first ciphertext; according to the preset operation model and the ciphertext information, a temporary ciphertext to be compared is calculated, including: adding multiple sub-ciphertexts in the first ciphertext to obtain a summed ciphertext; multiplying the summed ciphertext and the preset coefficient to obtain a multiplication ciphertext; performing a comparison operation based on the multiplication ciphertext and the comparison ciphertext in the first ciphertext to calculate the temporary ciphertext to be compared.

[0022] In some embodiments, a third preset round of iterative calculations is performed based on the comparison key and the temporary ciphertext to be compared to obtain a temporary comparison result, including: performing a first round of iterative calculations based on the comparison key and the temporary ciphertext to be compared to obtain a second initial iterative ciphertext; performing iterative calculations based on the comparison key and the second initial iterative ciphertext to calculate and obtain the temporary comparison result.

[0023] In some embodiments, the method further includes: receiving a comparison result sent by a coordination agency; generating a ciphertext analysis rate based on the comparison result and an encrypted public parameter; and sending the ciphertext analysis rate to a data owner.

[0024] According to one aspect of an embodiment of the present application, a multi-party computing method based on homomorphic encryption is provided, which is applied to a coordination organization. The method includes:

[0025] Receiving the encrypted public parameters and coordination key sent by the data owner, and receiving the comparison offset results sent by the analysis agency;

[0026] Encrypting the comparison offset result based on the coordination key to generate a comparison result;

[0027] The comparison results are sent to an analysis agency.

[0028] According to one aspect of an embodiment of the present application, a computer medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the multi-party computing method based on homomorphic encryption provided by any embodiment of the present application is implemented.

[0029] According to one aspect of an embodiment of the present application, an electronic device is provided, including: a processor; a memory for storing executable instructions of the processor; the processor executes the executable instructions to enable the electronic device to implement the multi-party computing method based on homomorphic encryption provided by any embodiment of the present application.

[0030] In the technical solution of the present application, the data owner is responsible for generating a comparison key and a coordination key, and encrypting the plaintext information to obtain the ciphertext information; then the data owner sends the comparison key and the encrypted data to the analysis agency, and sends the coordination key to the coordination agency; the analysis agency then uses a preset operation model to directly operate on the encrypted data, that is, the analysis agency does not have to decrypt the encrypted data to perform the operation; and the coordination agency uses the coordination key to calculate the encrypted data sent by the analysis agency, that is, the coordination agency does not have to decrypt the encrypted data to perform the operation; finally, the data owner performs a second preset round of iterative operations based on the private key, the encryption public parameter and the ciphertext analysis rate to obtain a temporary comparison result of the decryption; in this way, only the data owner can know the true calculation result, and the analysis agency and the coordination agency directly calculate through the ciphertext, which can realize homomorphic encryption that supports addition, subtraction, multiplication and division operations and comparison operations at the same time, improves the problem of easy privacy leakage caused by the need to decrypt data when other participants calculate, thereby improving the data security of multi-party operations.

[0031] It should be understood that the above general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] The drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present application, and together with the specification are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0033] Figure 1 The flowchart of a multi-party computing method based on homomorphic encryption provided in one embodiment of the present application is schematically shown.

[0034] Figure 2 The flowchart of a multi-party computing method based on homomorphic encryption provided in one embodiment of the present application is schematically shown.

[0035] Figure 3 The flowchart of a multi-party computing method based on homomorphic encryption provided in one embodiment of the present application is schematically shown.

[0036] Figure 4 The structural block diagram of an electronic device provided by an embodiment of the present application is schematically shown.

[0037] Figure 5 The structure block diagram of a computer system for implementing an electronic device according to an embodiment of the present application is schematically shown. DETAILED DESCRIPTION

[0038] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this application will be more comprehensive and complete and fully convey the concept of the example embodiments to those skilled in the art.

[0039] In addition, the features, structures or characteristics described in the present application may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present application. However, those skilled in the art will appreciate that the technical scheme of the present application can be put into practice without one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known methods, devices, realizations or operations are not shown or described in detail to avoid blurring the various aspects of the present application.

[0040] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0041] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0042] Homomorphic encryption is a form of encryption that allows people to perform a specific form of algebraic operations on ciphertext, while the result of the operation is still encrypted data. The result obtained by decrypting the result of the operation is the same as the result of the same operation on the plaintext. In other words, this technology allows people to perform operations such as addition, subtraction, multiplication, division or logical comparison on encrypted data, and the result of the operation is still the correct result, without having to decrypt the data during the entire processing process. The significance of this technology is that it truly and fundamentally solves the confidentiality problem when entrusting data and its operations to a third party, such as for various cloud computing applications. Assume a homomorphic encryption algorithm, including: plaintext m, public key pk, private key sk = keygen() and ciphertext c = E(m,pk), where E represents the homomorphic encryption algorithm, plaintext m = D(c,sk), where D is the homomorphic decryption algorithm. And ciphertext c3 = add(c1,c2), add is the homomorphic ciphertext addition algorithm; ciphertext c2 = mul(c1,m2), mul is the homomorphic plaintext and ciphertext multiplication algorithm.

[0043] The data owner hopes that other participants will assist in data analysis and at the same time hope to improve the problem of malicious parties obtaining original data. Figure 1 As shown, the present application provides a multi-party computing method based on homomorphic encryption, which is applied to the data owner. The method includes S110 to S150, and the specific process is as follows.

[0044] S110, obtaining the private key, key parameters, encrypted public parameters and plaintext information corresponding to the data owner.

[0045] Specifically, the data owner refers to a party that owns the original data. The private key refers to a key that is kept by the data owner and is not disclosed to other participants. The data owner can randomly generate binary data of a specified number of bits as a private key, such as generating a 256-bit binary number as a private key. It can also regenerate a binary number when the first 8 bits are 0. This is to increase the complexity of the private key and reduce the possibility of being cracked by malicious parties. The key parameter is a parameter used to generate an encrypted public parameter. The user can set the key parameter to a prime number, a natural number, an integer, or other numerical values ​​in mathematical definitions. The data owner can randomly select one from all prime numbers (such as 2, 3, 5, 7, 11...) as the key parameter p. The encrypted public parameter is the key that the data owner discloses to other participants. Other participants can use the encrypted public parameter and other parameters to perform arithmetic and comparison operations. For example, the encrypted public parameter n=n last *p, where n last It represents the encryption public parameter of the previous round, p represents the key parameter, and the initial value of the encryption public parameter can be 1, 2, 3 or any other value. When the number of bits of the encryption public parameter n is greater than the specified number of bits, the value is taken as the final encryption public parameter n. The specified number of bits can be 64, 128, 256 or other values ​​equal to 2. t The value of , t is a positive integer. Plain text information can also be called raw data. For example, the data owner has a list of user deposits, corresponding to deposits a = [1, 2, 30] (unit: 10,000 yuan), yield b = [0.1, 0.2, 0.3], where the specific data of the deposits: 1, 2 and 30, and the specific values ​​of the yields: 0.1, 0.2 and 0.3 are all plain text information. The data owner can provide plain text information such as deposits and yields to other participants for data analysis, and other participants will feedback the analysis results to the data owner.

[0046] S120. Generate a comparison key of the analysis organization and a coordination key of the coordination organization based on the private key and key parameters.

[0047] Specifically, the analysis agency refers to the participant who uses the comparison key to operate on the ciphertext, and the coordination agency refers to the participant who uses the coordination key to operate on the ciphertext. The comparison key and coordination key generated by the data owner are respectively distributed to the non-colluding analysis agency and coordination agency, so that the subsequent operation results are not only obtained by the analysis agency, but the coordination agency will also participate in the operation. The malicious party cannot only attack a small number of participants to obtain the plaintext information, which can increase the difficulty for the malicious party to steal data and improve the security of multi-party computing. In this step, the private key and key parameters are substituted into the preset key generation algorithm to generate the comparison key and coordination key, where the preset key generation algorithm can be an algorithm formed by performing preset addition, subtraction, multiplication, division or other arithmetic operations on the private key and key parameters.

[0048] In some embodiments, a comparison key of the analysis organization and a coordination key of the coordination organization are generated based on a private key and key parameters, including: generating a coordination key based on randomly selecting a preset number of key parameters; performing preset calculations on the private key and the coordination key to obtain a comparison key.

[0049] Specifically, assuming that there are k key parameters p, the preset number in this embodiment is k / 2, that is, k / 2 key parameters p are randomly selected, and the coordination key d=p i *p j , where p i represents one of the k / 2 randomly selected key parameters p, p j It also represents one of the k / 2 randomly selected key parameters p, but p i ≠p j . Compare key compare =key+d, where key represents the private key and d represents the coordination key. It should be understood that the preset calculation may be key-d or key / d in addition to the key+d shown. The examples listed are only for illustrating one method of generating the coordination key and the comparison key. Other preset key generation algorithms may also be used.

[0050] S130, performing a first preset round of iterative operations based on the private key, the encrypted public parameter and the plaintext information to obtain ciphertext information corresponding to the plaintext information.

[0051] Specifically, the first preset round of iterative operations refers to performing the first preset round of iterative operations using the specified data; the iterative operation refers to using the output result of each round of calculation as the input of the next round of calculation, and performing the next round of calculation again; the first preset round can be determined by referring to the reference standard of asymmetric encryption algorithm, which stipulates that at least 16 rounds of iterative encryption can meet the security requirements, that is, the first preset round can be greater than or equal to 16. The first preset round of iterative operations has a corresponding iterative algorithm, the private key, the encryption public parameter and the plaintext information are substituted into the iterative algorithm, and the first preset round of iterative operations are performed to obtain the ciphertext information.

[0052] In some embodiments, a first preset round of iterative operations is performed based on a private key, encrypted public parameters and plaintext information to obtain ciphertext information corresponding to the plaintext information, including: performing a first round of iterative calculations based on the private key, encrypted public parameters and plaintext information to obtain an initial iteration factor; calculating a first iteration factor and a second iteration factor based on the private key, encrypted public parameters, plaintext information and the initial iteration factor; the first iteration factor is the previous round iteration factor of the first preset round, and the second iteration factor is the iteration factor of the first preset round; encrypting the plaintext information based on the first iteration factor and the second iteration factor to obtain the ciphertext information.

[0053] Specifically, suppose the i+1th round iteration factor x i+1 =key*x i -x i-1 %n, where key represents the private key, x i represents the iteration factor of the i-th round, x i-1 represents the i-1th round iteration factor, n represents the encrypted public parameter, x i-1 %n is the remainder operation, which means the dividend x i-1 Divide by the divisor n, and take the remainder. i-1 At least x1, then i is at least 2, and the initial iteration factor and the second round iteration factor cannot be calculated according to the above formula. Therefore, the initial iteration factor x1 = key*mr%n is set, where m represents the plaintext information and r represents a random number, which is a randomly generated binary number with a specified number of bits. For example, the specified number of bits can be 64, 128, 256 or other numbers equal to 2. wThe value of , w is a positive integer. In this way, the initial iteration factor x1 can be calculated. And set the second round iteration factor x2 = key*x1-m%n, that is, substitute the private key key, the initial iteration factor x1, the plaintext information m and the encrypted public parameter n into the calculation formula of the second round iteration factor to obtain the second round iteration factor. By analogy, the third round iteration factor x3 = key*x2-x1%n, repeatedly substitute the previous round iteration factor and the previous round iteration factor into the iteration factor calculation formula, and calculate the iteration factors of the third round and above. If 16 rounds of iterations are performed, that is, the first iteration factor is x 15 , the second iteration factor is x 16 , then the ciphertext information c=(x 16 ,x 15 ).

[0054] In some embodiments, after performing a first preset round of iterative operations based on the private key, encrypted public parameters and plaintext information to obtain ciphertext information corresponding to the plaintext information, the method also includes: sending the encrypted public parameters, ciphertext information and comparison key to the analysis agency; sending the encrypted public parameters and coordination key to the coordination agency.

[0055] Specifically, as mentioned above, the encrypted public parameter n is a public encryption parameter, and the analysis agency and the coordination agency can use the encrypted public parameter and the comparison key to operate on the ciphertext information. The coordination agency can use the encrypted public parameter and the coordination key to operate on the first intermediate result fed back by the analysis agency. In another embodiment, the data owner can also directly send the encrypted public parameter to the analysis agency and the coordination agency after generating the encrypted public parameter; and after generating the comparison key and the coordination key, send the comparison key to the analysis agency and send the coordination key to the coordination agency; without having to wait for the generation of the ciphertext information, the time for sending the encrypted public parameter, the comparison key, the coordination key and the ciphertext information is not limited to the method of this embodiment.

[0056] S140, receiving the ciphertext analysis rate obtained by the analysis agency and the coordination agency performing encryption operations on the ciphertext information.

[0057] Specifically, the process of the analysis agency and the coordination agency performing encryption operations on the ciphertext information to obtain the ciphertext analysis rate may include: the analysis agency uses the comparison key to operate on the ciphertext information to obtain a first intermediate result, the first intermediate result is sent to the coordination agency for further operation to obtain a second intermediate result, the coordination agency sends the second intermediate result to the analysis agency, and the analysis agency performs operations based on the second intermediate result to obtain the ciphertext analysis rate. It should be noted that the specific process of the analysis agency and the coordination structure jointly calculating the ciphertext analysis rate is detailed in the subsequent S210 to S250, and S310 to S330, and the specific explanation is not expanded here. After calculating the ciphertext analysis rate, the data owner receives the ciphertext analysis rate sent by the analysis agency, and then continues to execute the subsequent steps.

[0058] S150, performing a second preset round of iterative operations based on the private key, the encryption public parameter and the ciphertext analysis rate to obtain a temporary comparison result of decryption.

[0059] Specifically, the second preset round of iterative operations is similar to the first preset round of iterative operations, and also refers to the use of specified data to perform the second preset round of iterative operations, wherein the specified data and the second preset round may be different from the first preset round of iterative operations, or the iterative calculation formula of the second preset round of iterative operations is different from the first preset round of iterative operations. For example, the first preset round of iterative operations is to iteratively encrypt plaintext information, and the algorithm of the iterative factor includes a remainder operation, while the second preset round of iterative operations is to decrypt the ciphertext information, which is the opposite process of iterative encryption. Therefore, the second preset round of iterative operations may include a modulo operation to restore an accurate temporary comparison result.

[0060] In the technical solution of the present application, the data owner is responsible for generating a comparison key and a coordination key, and encrypting the plaintext information to obtain the ciphertext information; then the data owner sends the comparison key and the encrypted data to the analysis agency, and sends the coordination key to the coordination agency; the analysis agency then uses the comparison key to directly operate on the encrypted data, that is, the analysis agency does not have to decrypt the encrypted data to perform the operation; and the coordination agency uses the coordination key to calculate the encrypted data sent by the analysis agency, that is, the coordination agency does not have to decrypt the encrypted data to perform the operation; finally, the data owner performs a second preset round of iterative operations based on the private key, the encryption public parameter and the ciphertext analysis rate to obtain a temporary comparison result of the decryption; in this way, only the data owner can know the true calculation result, and the analysis agency and the coordination agency directly perform calculations through the ciphertext, which can realize homomorphic encryption that supports addition, subtraction, multiplication and division operations and comparison operations at the same time, improves the problem of easy privacy leakage caused by the need to decrypt data when other participants calculate, thereby improving the data security of multi-party operations.

[0061] In some embodiments, a second preset round of iterative calculations is performed based on the private key, the encryption public parameters and the ciphertext analysis rate to obtain a temporary comparison result of decryption, including: a first round of iterative calculations is performed based on the private key, the encryption public parameters and the ciphertext analysis rate to obtain a first initial iterative ciphertext; an iterative calculation is performed based on the private key, the encryption public parameters and the first initial iterative ciphertext to calculate and obtain a temporary comparison result.

[0062] Specifically, the second preset round iteration operation can be understood as the reverse process of the first preset round iteration operation. Then the first round iteration can be calculated based on the first iteration factor and the second iteration factor of the first preset round iteration operation, that is, the low round iteration ciphertext of the second preset round iteration operation is calculated based on the high round iteration factor of the first preset round iteration operation. For example, the i-1th round iteration ciphertext c b_x(i-1) =key*c b_xi -c b_x(i+1) mod n, assuming that 16 rounds of operations are performed in the first preset round of iterative operations, then the maximum iteration factor x (i+1) is x 16 , so the first initial iteration ciphertext c b_x14 =key*c b_x15 -c b_x16 mod n, where c b_x15 Indicates the ciphertext analysis rate c b One of the items, c b_x16 Indicates the ciphertext analysis rate c b One of the items, c b_x16 mod n means the dividend c b_x16 Divide by the divisor n and round down the result. And so on, the ciphertext c of the 15th round of iteration is calculated. b_x0 =key*c b_x1 -c b_x2 mod n, thereby decrypting and obtaining a temporary comparison result.

[0063] like Figure 2 As shown, the present application provides a multi-party computing method based on homomorphic encryption, which is applied to an analysis organization. The method includes S210 to S250, and the specific process is as follows.

[0064] S210, receiving the encrypted public parameters, comparison key and ciphertext information sent by the data owner.

[0065] Specifically, as mentioned above, the data owner generates the encryption public parameter n and the comparison key key compare And ciphertext information c, the analysis agency receives the above data sent by the data owner to carry out subsequent calculation process.

[0066] S220. Calculate and obtain a temporary ciphertext to be compared according to a preset operation model and ciphertext information.

[0067] Specifically, the preset operation model is a data analysis model owned by the analysis agency, which can be obtained by training or summarizing sample data. As the core achievement of the analysis agency, the analysis agency generally does not want the data owner to know its preset operation model. Therefore, the data owner is required to provide ciphertext information so that the analysis agency can substitute the ciphertext information into the preset operation model and calculate the temporary ciphertext to be compared.

[0068] In some embodiments, the preset operation model includes addition operation, multiplication operation and preset coefficient, and the ciphertext information includes a first ciphertext; according to the preset operation model and the ciphertext information, a temporary ciphertext to be compared is calculated, including: adding multiple sub-ciphertexts in the first ciphertext to obtain a summed ciphertext; multiplying the summed ciphertext and the preset coefficient to obtain a multiplication ciphertext; comparing the multiplication ciphertext with the comparison ciphertext in the first ciphertext to obtain a temporary ciphertext to be compared.

[0069] Specifically, the preset operation model may include addition, multiplication and preset coefficients. For example, the preset operation model in the plain text state is (b1+b2, b2+b3)? 5*(a1+a2)>a3, where a1, a2 and a3 are user deposit values, b1, b2 and b3 are user deposit yields, and 5 is a preset coefficient. The meaning of the preset operation model is that the sum of the user's first deposit value a1 and the second deposit value a2 is multiplied by 5 to obtain the sum product result, and the sum product result is compared with the third deposit value a3. If the comparison result is that the sum product result is greater than the third deposit value a3, then the final deposit yield is b1+b2, otherwise the final deposit yield is b2+b3. The analysis agency receives ciphertext information, where the ciphertext information c includes the first ciphertext c corresponding to the user's deposit value. a The second ciphertext c corresponding to the user's deposit yield b , the first ciphertext c a Specifically including c a1 、c a2 and c a3 , the second ciphertext c b Specifically including c b1 、c b2 and c b3 According to the above preset operation model, multiple sub-ciphertexts in the first ciphertext are added to obtain the sum ciphertext, which means that the sub-ciphertext c a1 and sub-ciphertext c a2 Perform addition operation to obtain the sum ciphertext c add =(c add _ x16 ,cadd_x15 )=((c a1_x16 +c a2_x16 )%n,(c a1 _ x15 +c a2 _ x15 )%n)) The sum ciphertext and the preset coefficient are multiplied to obtain the multiplication ciphertext, which means that the sum ciphertext c add Multiply it with the preset coefficient to get the multiplication ciphertext c mul =(c mul_x16 ,c mul_x15 )=(5*c add_x16 ,5*c add_x15 ). The comparison ciphertext in the first ciphertext refers to the ciphertext c corresponding to the third deposit value a3. a3 , then compare the multiplication ciphertext with the comparison ciphertext in the first ciphertext to obtain the temporary ciphertext to be compared c compare_tmp =(c mul_x16 -c a3_x16 ,c mul_x15 -c a3_x15 ).

[0070] S230, performing a third preset round of iterative operations based on the comparison key and the temporary ciphertext to be compared, to obtain a temporary comparison result.

[0071] Specifically, the third preset round of iterative operations is similar to the second preset round of iterative operations, and also refers to the use of specified data to perform the third preset round of iterative operations, wherein the specified data may be different from the second preset round of iterative operations, or the iterative calculation formula of the third preset round of iterative operations is different from the second preset round of iterative operations, for example, the second preset round of iterative operations is to decrypt the ciphertext information, and the second preset round of iterative operations may include a modulo operation. The third preset round of iterative operations is one of the steps in the ciphertext comparison stage, so it is necessary to use the comparison key to perform the third preset round of iterative operations on the temporary ciphertext to be compared, so as to obtain a temporary comparison result.

[0072] In some embodiments, a third preset round of iterative calculations is performed based on the comparison key and the temporary ciphertext to be compared to obtain a temporary comparison result, including: performing a first round of iterative calculations based on the comparison key and the temporary ciphertext to be compared to obtain a second initial iterative ciphertext; performing iterative calculations based on the comparison key and the second initial iterative ciphertext to calculate and obtain the temporary comparison result.

[0073] For example, the ciphertext c of the i-1th round of iteration compare_tmp_x(i-1) =key compare ,c compare_tmp_xi -c compare_tmp_x(i+1) , where key compare Indicates the comparison key, ccompare_tmp_xi Represents the iteration factor x i The corresponding temporary ciphertext to be compared, c compare_tmp_x(i+1) Represents x i+1 The corresponding temporary ciphertext to be compared. Since 16 rounds of operations were performed in the first preset round of iterative operations, the maximum iteration factor x (i+1) is x 16 , so the second initial iteration ciphertext c_ compare_tmp_x14 =key compare ,c compare_tmp_x15 -c compare_tmp_x16 , where the temporary ciphertext to be compared c compare_tmp_x16 is the iteration factor x 16 The corresponding temporary ciphertext to be compared, c compare_tmp_x15 is the iteration factor x 15 The corresponding temporary ciphertext to be compared. By analogy, the iterative ciphertext c of the 15th round is calculated. compare_tmp_x0 , the 15th round of iterative ciphertext c compare_tmp_x0 It is the temporary comparison result compare_tmp =c compare_tmp_x2 .

[0074] S240: Encrypt the temporary comparison result using a random obfuscation parameter to obtain a comparison offset result.

[0075] Specifically, the random confusion parameter r obs Is a parameter that specifies the number of digits. The specified number of digits can be 2, 4, 8, 16, or 64. x The value of x is a positive integer. Use the random obfuscation parameter to encrypt the temporary comparison result and generate the comparison offset result compare obs =result_ compare_tmp *r obs In another embodiment, the offset result is compared obs =result_ compare_tmp / r obs Alternatively, the random obfuscation parameter and the temporary comparison result may be substituted into other encryption algorithms to obtain a comparison offset result. The algorithms in the above examples are only some of the ways to generate the comparison offset result.

[0076] S250: Send the comparison offset result to the coordination organization.

[0077] Specifically, compare the offset results obs The comparison result is sent to the coordination mechanism so that the coordination mechanism can perform operations and obtain the comparison result. obs It can be understood as the first intermediate result mentioned above.

[0078] In some embodiments, the method further includes: receiving a comparison result sent by a coordination agency; generating a ciphertext analysis rate based on the comparison result and an encrypted public parameter; and sending the ciphertext analysis rate to a data owner.

[0079] Specifically, the comparison result is the result obtained by the coordination agency using the coordination key and the comparison offset result to perform a preset operation, which can be understood as the aforementioned second intermediate result. The analysis agency receives the comparison result, so that the analysis agency calculates the comparison offset result, and the coordination agency calculates the comparison result. The coordination structure cannot decrypt to obtain the true value of the comparison offset result. Even if the ciphertext analysis rate is generated by the analysis agency, the analysis agency cannot decrypt to obtain the true value of the comparison result. Therefore, the analysis agency cannot decrypt to obtain the true value of the ciphertext analysis rate. It can be seen that the analysis agency and the coordination agency cannot know the true value of the ciphertext during the entire ciphertext analysis operation process. It is difficult for malicious attackers to steal data, which can improve the security of multi-party computing.

[0080] like Figure 3 As shown, the present application provides a multi-party computing method based on homomorphic encryption, which is applied to a coordination organization. The method includes S310 to S330, and the specific process is as follows.

[0081] S310, receiving the encrypted public parameters and coordination key sent by the data owner, and receiving the comparison offset result sent by the analysis agency.

[0082] Specifically, as mentioned above, the encrypted public parameter n and coordination key d generated by the data owner are sent to the coordination agency, and the comparison offset result calculated by the analysis agency is compared. obs Sent to the coordination agency, which receives the encrypted public parameter n, the coordination key d and the comparison offset result compare obs , for subsequent calculation process.

[0083] S320: Encrypt the comparison offset result based on the coordination key to generate a comparison result.

[0084] Specifically, based on the coordinated key d, the offset result is compared. obs Encrypt and generate comparison results compare result =compare obs *d

[64] , indicates compare obs The 64th digit after taking the modulus from d is 0, which means (a1+a2) is greater than a3. If the 64th digit is 1, which means (a1+a2) is less than a3.

[0085] S330, sending the comparison result to an analysis agency.

[0086] Specifically, the coordination agency compares the comparison results result Send to the analysis agency so that the analysis agency can compare based on the comparison results result Generate ciphertext analysis rate.

[0087] The electronic equipment of this application is introduced below, such as Figure 4 As shown, the present application provides an electronic device 400, which includes: a processor 410 and a memory 420, the memory 420 is used to store executable instructions of the processor; the processor 410 executes the executable instructions to enable the electronic device to implement any embodiment of the present application to provide a multi-party computing method based on homomorphic encryption.

[0088] Specifically, the multi-party computing party based on homomorphic encryption provided by the present application is stored in the memory 420 of the electronic device, and the multi-party computing party based on homomorphic encryption is executed by the processor 410 to control the data owner to be responsible for generating comparison keys and coordination keys, and encrypting the plaintext information to obtain ciphertext information; then the data owner sends the comparison key and the encrypted data to the analysis agency, and sends the coordination key to the coordination agency; the analysis agency then uses the comparison key to directly operate on the encrypted data, that is, the analysis agency does not need to decrypt the encrypted data to perform the operation; and the coordination agency uses the coordination key to calculate the encrypted data sent by the analysis agency, that is, the coordination agency does not need to decrypt the encrypted data to perform the operation; finally, the data owner performs a second preset round of iterative operations based on the private key, the encryption public parameter and the ciphertext analysis rate to obtain a temporary comparison result of the decryption; in this way, only the data owner can know the true calculation result, and the analysis agency and the coordination agency directly calculate through the ciphertext, which can realize homomorphic encryption that supports addition, subtraction, multiplication and division operations and comparison operations at the same time, improves the problem of easy privacy leakage caused by the need to decrypt data when calculating by other participants, thereby improving the data security of multi-party operations.

[0089] It should be known that the specific implementation content of the electronic device in the present application has been explained in detail in the corresponding method embodiment and will not be repeated here.

[0090] Figure 5 The structure block diagram of a computer system for implementing an electronic device according to an embodiment of the present application is schematically shown.

[0091] It should be noted that Figure 5 The computer system 500 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0092] like Figure 5As shown, the computer system 500 includes a processor 501, which can be a CPU (Central Processing Unit) or an MCU (Microcontroller Unit). The processor 501 can perform various appropriate actions and processes according to the program stored in the read-only memory 502 (Read-Only Memory, ROM) or the program loaded from the storage part 508 to the random access memory 503 (Random Access Memory, RAM). In the random access memory 503, various programs and data required for system operation are also stored. The processor 501, the read-only memory 502 and the random access memory 503 are connected to each other through a bus 504. The input / output interface 505 (Input / Output interface, i.e., I / O interface) is also connected to the bus 504.

[0093] The following components are connected to the input / output interface 505: an input section 506 including a keyboard, a mouse, etc.; an output section 507 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a local area network card, a modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the input / output interface 505 as needed. A removable medium 511, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 510 as needed so that a computer program read therefrom is installed into the storage section 508 as needed.

[0094] In particular, according to an embodiment of the present application, the process described in each method flow chart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer readable medium, and the computer program contains a program code for executing the method shown in the flow chart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 509, and / or installed from the removable medium 511. When the computer program is executed by the processor 501, various functions defined in the system of the present application are executed.

[0095] It should be noted that the computer-readable medium shown in the embodiment of the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by an instruction execution system, device or device or used in combination with it. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a computer-readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer readable signal media may also be any computer readable medium other than computer readable storage media, which may send, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0096] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the above-mentioned module, program segment or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0097] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0098] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the example implementation methods described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation method of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the implementation method according to the present application.

[0099] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary technical means in the art that are not disclosed in the present application.

[0100] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A multi-party computing method based on homomorphic encryption, characterized in that: Applied to the data owner, the method includes: Obtain the private key, key parameters, encrypted public parameters and plaintext information corresponding to the data owner; Generate a comparison key of the analysis organization and a coordination key of the coordination organization according to the private key and the key parameters; Perform a first preset round of iterative calculation based on the private key, the encrypted public parameter and the plaintext information to obtain ciphertext information corresponding to the plaintext information; Receiving a ciphertext analysis rate obtained by the analysis mechanism and the coordination mechanism performing encryption operations on the ciphertext information; A second preset round of iterative calculation is performed based on the private key, the encryption public parameter and the ciphertext analysis rate to obtain a temporary comparison result of decryption.

2. The multi-party computing method based on homomorphic encryption as claimed in claim 1, characterized in that: The performing a first preset round of iterative operations based on the private key, the encrypted public parameter and the plaintext information to obtain ciphertext information corresponding to the plaintext information includes: Perform a first round of iterative calculation based on the private key, the encrypted public parameter and the plaintext information to obtain an initial iteration factor; Based on the private key, the encrypted public parameter, the plaintext information and the initial iteration factor, a first iteration factor and a second iteration factor are calculated; the first iteration factor is the iteration factor of the previous round of the first preset round, and the second iteration factor is the iteration factor of the first preset round; The plaintext information is encrypted based on the first iteration factor and the second iteration factor to obtain the ciphertext information.

3. The multi-party computing method based on homomorphic encryption as claimed in claim 1, characterized in that: The performing a second preset round of iterative calculation based on the private key, the encryption public parameter and the ciphertext analysis rate to obtain a temporary comparison result of decryption includes: Perform a first round of iterative calculation based on the private key, the encryption public parameter and the ciphertext analysis rate to obtain a first initial iterative ciphertext; An iterative operation is performed based on the private key, the encrypted public parameter and the first initial iterative ciphertext to calculate and obtain the temporary comparison result.

4. The multi-party computing method based on homomorphic encryption according to claim 1, characterized in that: The step of generating a comparison key of an analysis organization and a coordination key of a coordination organization according to the private key and the key parameter comprises: generating the coordination key based on randomly selecting a preset number of key parameters; The private key and the coordination key are subjected to a preset calculation to obtain the comparison key.

5. The multi-party computing method based on homomorphic encryption according to claim 1, characterized in that: After performing a first preset round of iterative operations based on the private key, the encrypted public parameter and the plaintext information to obtain ciphertext information corresponding to the plaintext information, the method further includes: Sending the encrypted public parameter, the ciphertext information and the comparison key to the analysis agency; The encrypted public parameters and the coordination key are sent to the coordination mechanism.

6. A multi-party computing method based on homomorphic encryption, characterized in that: Applied to an analysis organization, the method comprises: Receive the encrypted public parameters, comparison key and ciphertext information sent by the data owner; Calculate and obtain a temporary ciphertext to be compared according to a preset operation model and the ciphertext information; Perform a third preset round of iterative operations based on the comparison key and the temporary ciphertext to be compared, to obtain a temporary comparison result; The temporary comparison result is encrypted using a random obfuscation parameter to obtain a comparison offset result; The comparison offset result is sent to a coordination mechanism.

7. The multi-party computing method based on homomorphic encryption as claimed in claim 6, characterized in that: The preset operation model includes an addition operation, a multiplication operation and a preset coefficient, and the ciphertext information includes a first ciphertext; and the step of calculating a temporary ciphertext to be compared according to the preset operation model and the ciphertext information includes: Performing an addition operation on multiple sub-ciphertexts in the first ciphertext to obtain a summed ciphertext; Performing a multiplication operation on the sum ciphertext and the preset coefficient to obtain a multiplication ciphertext; A comparison operation is performed based on the multiplication ciphertext and the comparison ciphertext in the first ciphertext to obtain the temporary ciphertext to be compared.

8. The multi-party computing method based on homomorphic encryption as claimed in claim 6, characterized in that: The performing a third preset round of iterative operations based on the comparison key and the temporary ciphertext to be compared to obtain a temporary comparison result includes: Perform a first round of iterative calculation based on the comparison key and the temporary ciphertext to be compared to obtain a second initial iterative ciphertext; An iterative operation is performed based on the comparison key and the second initial iterative ciphertext to calculate and obtain the temporary comparison result.

9. The multi-party computing method based on homomorphic encryption as claimed in claim 6, characterized in that: The method further comprises: receiving a comparison result sent by the coordination mechanism; generating a ciphertext analysis rate based on the comparison result and the encryption public parameter; The ciphertext analysis rate is sent to the data owner.

10. A multi-party computing method based on homomorphic encryption, characterized in that: Applied to a coordination organization, the method comprises: Receiving the encrypted public parameters and coordination key sent by the data owner, and receiving the comparison offset results sent by the analysis agency; Encrypting the comparison offset result based on the coordination key to generate a comparison result; The comparison result is sent to the analysis mechanism.

11. A computer readable medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the multi-party computing method based on homomorphic encryption described in any one of claims 1 to 10 is implemented.

12. An electronic device, characterized in that: include: processor; A memory, configured to store executable instructions of the processor; The processor executes the executable instructions to enable the electronic device to implement the multi-party computing method based on homomorphic encryption as described in any one of claims 1 to 10.

Images