Data encryption and decryption method, device, equipment and storage medium

Abstract

The embodiments of the present application provide a data encryption and decryption method, apparatus, device and storage medium, which relate to the field of data security technology. The method generates a corresponding encryption public key, an encryption private key and a mask parameter according to a public parameter, encrypts the target data with the encryption public key to obtain encrypted data, sends the mask parameter, the encryption public key and the encrypted data to a server device, and the server device uses the encryption public key to expand the encrypted data to obtain an extended ciphertext, performs homomorphic addition calculation on the extended ciphertext based on the encryption public key and the mask parameter, and sends the obtained addition ciphertext to the user terminal device, and partially decodes the addition ciphertext using the encryption private key to obtain a decoded plaintext. Each user terminal device generates a corresponding mask parameter. During the homomorphic addition process, the mask parameter is used to ensure that ciphertexts from different sources can be securely merged, the calculation result maintains semantic security, prevents the leakage of sensitive information, and enhances the security of the multi-key encryption system.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to data encryption and decryption methods, devices, equipment, and storage media. Background Art

[0002] Homomorphic encryption (HE) is an encryption technology that allows computing operations to be performed directly on encrypted data without decrypting the data during the entire computing process. This protects data confidentiality while enabling secure processing of sensitive information.

[0003] In related technologies, multi-key homomorphic encryption (MKHE) schemes allow multiple parties to encrypt data using independent keys and conduct joint computations without decrypting the data. Ultimately, only authorized parties can decrypt the computation results. CKKS and BFV are two commonly used schemes for multi-key homomorphic encryption. However, in both schemes, attackers can potentially infer the original data by analyzing correlations (such as linear relationships) between ciphertexts, posing certain security risks. Summary of the Invention

[0004] The main purpose of the embodiments of the present application is to propose data encryption and decryption methods, devices, equipment and storage media to improve the security of multi-key homomorphic encryption schemes.

[0005] To achieve the above objectives, a first aspect of an embodiment of the present application provides a data encryption and decryption method, which is applied to a user terminal device. The method includes:

[0006] Obtaining public parameters generated according to security parameters, and generating corresponding encryption public key, encryption private key and mask parameters according to the public parameters;

[0007] encrypting the target data using the encryption public key to obtain encrypted data, and sending the mask parameter, the encryption public key, and the encrypted data to the server device, so that the server device uses the encryption public key to expand the encrypted data to obtain extended ciphertext, and performs homomorphic addition calculation on the extended ciphertext based on the encryption public key and the mask parameter, and then sends the obtained addition ciphertext to the user device;

[0008] The received addition ciphertext is partially decoded using the encryption private key to obtain the corresponding decoded plaintext.

[0009] In some embodiments, the public parameters include at least a ciphertext modulus, a key distribution, a Gaussian error distribution, and a public reference string; the mask parameters include a masked ciphertext and a masked key; and generating corresponding encrypted public keys, encrypted private keys, and mask parameters based on the public parameters includes:

[0010] Obtaining private key parameters according to the key distribution, obtaining the encrypted private key according to the private key parameters, and obtaining the encrypted public key according to the key distribution, the public reference string, the ciphertext modulus, and the Gaussian error distribution;

[0011] Gadget encryption is performed on the masked random polynomial to obtain the masked key, and target data is encrypted based on the masked random polynomial and the encryption public key to obtain the masked ciphertext.

[0012] In some embodiments, obtaining the encrypted public key according to the key distribution, the public reference string, the ciphertext modulus, and the Gaussian error distribution includes:

[0013] generating a first noise term according to the Gaussian error distribution, and obtaining a first intermediate term according to the first noise term and the ciphertext modulus;

[0014] A second intermediate item is obtained based on the private key parameter and the public reference string, a third intermediate item is obtained by summing the first intermediate item and the second intermediate item, and the encrypted public key is obtained according to the third intermediate item and the public reference string.

[0015] In some embodiments, the public parameter further includes a plaintext modulus, and encrypting the target data based on the masked random polynomial and the encryption public key to obtain the masked ciphertext includes:

[0016] Obtaining a product of the masked random polynomial and the encryption public key to obtain a first masked intermediate term, and generating a second noise term and a third noise term according to the Gaussian error distribution;

[0017] When the encryption algorithm is the first encryption algorithm, obtaining a second masked intermediate term according to the second noise term and the third noise term, and obtaining the masked ciphertext according to the sum of the first masked intermediate term and the second masked intermediate term;

[0018] When the encryption algorithm is the second encryption algorithm, masked initial data is obtained according to the plaintext modulus, the ciphertext modulus and the target data, the sum of the masked initial data and the second noise term is calculated to obtain a third masked intermediate term, a fourth masked intermediate term is obtained according to the third masked intermediate term and the third noise term, and the masked ciphertext is obtained according to the sum of the first masked intermediate term and the fourth masked intermediate term.

[0019] In some embodiments, encrypting the target data using the encryption public key to obtain encrypted data includes:

[0020] generating a fourth noise term and a fifth noise term according to the Gaussian error distribution, obtaining an encryption distribution parameter according to the key distribution, and calculating a product of the encryption distribution parameter and the encryption public key to obtain a fifth masked intermediate term;

[0021] When the encryption algorithm is the first encryption algorithm, the target data is used as the encryption initial data; when the encryption algorithm is the second encryption algorithm, the masked initial data is used as the encryption initial data;

[0022] The encrypted data is obtained according to the encrypted initial data, the fifth noise term and the fifth mask intermediate term.

[0023] To achieve the above-mentioned purpose, a second aspect of an embodiment of the present application provides a data encryption and decryption method, applied to a server device, comprising:

[0024] Obtaining at least one encrypted data from different user terminal devices and corresponding encryption public key and mask parameter;

[0025] Acquire the encryption public key of at least one other user terminal device to obtain an extended public key, and expand the encrypted data based on the extended public key and the mask parameter to obtain an extended ciphertext;

[0026] Performing homomorphic addition calculation on at least two of the extended ciphertexts using the mask parameter to obtain an addition ciphertext corresponding to the user terminal device, and sending the addition ciphertext to the corresponding user terminal device;

[0027] Obtain decoded plaintexts obtained by partially decoding the addition ciphertexts using the encryption private key on the user terminal device, aggregate all the decoded plaintexts, and obtain target plaintexts.

[0028] In some embodiments, the mask parameter includes a mask key, and the step of extending the extended ciphertext based on the extended public key and the mask parameter to obtain the extended ciphertext includes:

[0029] Calculating the difference between each of the extended public keys and the corresponding encrypted public key, and accumulating the difference values ​​to obtain a total difference value;

[0030] An outer product operation is performed on the total difference value and the mask key to obtain the extended ciphertext, where the extended ciphertext includes a plaintext component and a public key component.

[0031] In some embodiments, the mask parameter further includes a masked ciphertext, and the performing homomorphic addition calculation on at least two extended ciphertexts using the mask parameter to obtain the corresponding addition ciphertext of the user terminal device includes:

[0032] Obtaining the encryption public key, the masked ciphertext, and the masked key corresponding to each of the extended ciphertexts;

[0033] Obtaining a plaintext component and a public key component in the extended ciphertext, and adding the plaintext components to obtain a plaintext addition term;

[0034] Performing mask extension on each of the masked keys according to all the masked keys to obtain a masked extended key;

[0035] An extended update ciphertext corresponding to each extended ciphertext is obtained according to the plaintext addition item, the masked ciphertext and the masked extended key, and the addition ciphertext is obtained based on the extended update ciphertext.

[0036] To achieve the above-mentioned purpose, a third aspect of the embodiments of the present application provides a data encryption and decryption device, which is applied to a user terminal device, and the device includes:

[0037] Key generation module: used to obtain public parameters generated according to security parameters, and generate corresponding encryption public key, encryption private key and mask parameters according to the public parameters;

[0038] An encryption module configured to encrypt target data using the encryption public key to obtain encrypted data, and send the mask parameter, the encryption public key, and the encrypted data to a server device, so that the server device uses the encryption public key to expand the encrypted data to obtain an extended ciphertext, and perform homomorphic addition calculation on the expanded ciphertext based on the encryption public key and the mask parameter, and then send the obtained addition ciphertext to the user device;

[0039] Decryption module: used to partially decode the received addition ciphertext using the encryption private key to obtain the corresponding decoded plaintext.

[0040] To achieve the above-mentioned objectives, a fourth aspect of the embodiments of the present application provides a data encryption and decryption device, which is applied to a server device, and the device includes:

[0041] Parameter acquisition module: used to obtain at least one encrypted data and corresponding encryption public key and mask parameter from different user terminal devices;

[0042] Extension module: used for acquiring the encryption public key of at least one other user terminal device to obtain an extended public key, and extending the encrypted data based on the extended public key and the mask parameter to obtain an extended ciphertext;

[0043] Homomorphic calculation module: used to perform homomorphic addition calculation on at least two of the extended ciphertexts using the mask parameter to obtain the addition ciphertext of the corresponding user terminal device, and send the addition ciphertext to the corresponding user terminal device;

[0044] Plaintext aggregation module: used to obtain the decoded plaintext obtained by the user terminal device using the encryption private key to partially decode the addition ciphertext, and aggregate all the decoded plaintexts to obtain the target plaintext.

[0045] To achieve the above-mentioned purpose, the fifth aspect of an embodiment of the present application proposes an electronic device, which includes a memory and a processor, the memory stores a computer program, and the processor implements the method described in the first or second aspect above when executing the computer program.

[0046] To achieve the above-mentioned purpose, the sixth aspect of the embodiment of the present application proposes a storage medium, which is a storage medium. The storage medium stores a computer program, and when the computer program is executed by a processor, it implements the method described in the first or second aspect above.

[0047] The data encryption and decryption method, apparatus, device and storage medium proposed in the embodiment of the present application obtains public parameters generated according to security parameters, generates corresponding encryption public keys, encryption private keys and mask parameters according to the public parameters, encrypts the target data with the encryption public key to obtain encrypted data, and sends the mask parameters, encryption public key and encrypted data to the server device, so that the server device uses the encryption public key to expand the encrypted data to obtain extended ciphertext, and performs homomorphic addition calculation on the extended ciphertext based on the encryption public key and the mask parameters, and then sends the obtained addition ciphertext to the user-end device, and partially decodes the received addition ciphertext with the encryption private key to obtain the corresponding decoded plaintext. In the embodiment of the present application, each user-end device generates a corresponding mask parameter to participate in the subsequent calculation process. In the process of homomorphic addition, auxiliary data is introduced using the mask parameter to ensure that ciphertexts from different sources can be safely merged, and the calculation result still maintains semantic security. The attacker cannot distinguish whether two different ciphertexts correspond to the same plaintext, thereby preventing the leakage of sensitive plaintext information and enhancing the security of the multi-key encryption system. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 This is a flowchart of the data encryption and decryption method provided in an embodiment of the present application.

[0049] Figure 2 This is a flowchart provided by an embodiment of the present application for generating corresponding encrypted public keys, encrypted private keys and homomorphic addition parameters based on public parameters.

[0050] Figure 3 This is a flowchart of obtaining an encrypted public key based on key distribution, public reference string, ciphertext modulus, and Gaussian error distribution, provided in an embodiment of the present application.

[0051] Figure 4 This is a flowchart of encrypting target data based on a masked random polynomial and an encryption public key to obtain a masked ciphertext, as provided in an embodiment of the present application.

[0052] Figure 5 This is a flowchart of an embodiment of the present application for encrypting target data using an encryption public key to obtain encrypted data.

[0053] Figure 6 This is another flow chart of the data encryption and decryption method provided in an embodiment of the present application.

[0054] Figure 7 This is a flowchart of an embodiment of the present application for expanding an extended ciphertext based on an extended public key and a mask parameter to obtain an extended ciphertext.

[0055] Figure 8 This is a flowchart provided by an embodiment of the present application for performing homomorphic addition calculation on at least two extended ciphertexts using mask parameters to obtain the corresponding addition ciphertext of the user terminal device.

[0056] Figure 9 It is a schematic diagram of the overall process of the data encryption and decryption method provided in the embodiment of the present application.

[0057] Figure 10 This is a structural block diagram of a data encryption and decryption device provided in another embodiment of the present application.

[0058] Figure 11 This is another block diagram of the data encryption and decryption device structure provided by another embodiment of the present application.

[0059] Figure 12 This is a schematic diagram of the hardware structure of the electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0060] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0061] It should be noted that although the functional modules are divided in the device schematic and the logical order is shown in the flowchart, in some cases, the steps shown or described can be performed in a different order than the module division in the device or the order in the flowchart.

[0062] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application pertains. The terms used herein are for the purpose of describing the embodiments of this application only and are not intended to limit this application.

[0063] Homomorphic encryption (HE) is an encryption technology that allows computing operations to be performed directly on encrypted data without decrypting the data during the entire computing process. This protects data confidentiality while enabling secure processing of sensitive information.

[0064] In related technologies, multi-key homomorphic encryption (MKHE) schemes allow multiple parties to encrypt data using independent keys and conduct joint computations without decrypting the data. Ultimately, only authorized parties can decrypt the computation results. CKKS and BFV are two commonly used schemes for multi-key homomorphic encryption. However, in both schemes, attackers can potentially infer the original data by analyzing correlations (such as linear relationships) between ciphertexts, posing certain security risks.

[0065] Based on this, the embodiments of the present application provide a data encryption and decryption method, apparatus, device and storage medium, in which each user-end device generates corresponding mask parameters to participate in the subsequent calculation process. During the homomorphic addition process, auxiliary data is introduced using the mask parameters to ensure that ciphertexts from different sources can be safely merged, and the calculation results still maintain semantic security. Attackers cannot distinguish whether two different ciphertexts correspond to the same plaintext, thereby preventing the leakage of sensitive plaintext information and enhancing the security of the multi-key encryption system.

[0066] The embodiments of the present application provide data encryption and decryption methods, devices, equipment and storage media, which are specifically illustrated by the following embodiments. First, the data encryption and decryption method in the embodiments of the present application is described.

[0067] The data encryption and decryption method provided in the embodiment of the present application relates to the field of data security technology. The data encryption and decryption method provided in the embodiment of the present application can be applied to a user-end device, can also be applied to a server-end device, and can also be a computer program running in a user-end device or a server-end device. For example, the computer program can be a native program or software module in the operating system; it can be a local (Native) application (Application, APP), that is, a program that needs to be installed in the operating system to run, such as a client that supports data encryption and decryption, that is, a program that only needs to be downloaded to a browser environment to run; it can also be a small program that can be embedded in any APP. In short, the above-mentioned computer program can be an application, module or plug-in in any form. Among them, the user-end device communicates with the server-end device through a network. The data encryption and decryption method can be executed by the user-end device or the server-end device, or by the user-end device and the server-end device in collaboration.

[0068] In some embodiments, the user-end device can be a smartphone, tablet, laptop, desktop computer, smartwatch, or server. The server-end device can be a standalone server or a cloud server device that provides basic cloud computing services, such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms. Alternatively, it can be a service node in a blockchain system, where each service node in the blockchain system forms a peer-to-peer (P2P) network. The P2P protocol is an application layer protocol that runs on top of the Transmission Control Protocol (TCP). The connection between the user-end device and the server-end device can be via Bluetooth, Universal Serial Bus (USB), or a network connection, but this embodiment does not impose any limitations on this.

[0069] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, servers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, and the like. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments in which tasks are performed by remote processing devices connected via a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media, including storage devices.

[0070] The following describes the data encryption and decryption method in the embodiment of the present application, first describing its execution process on the user terminal device.

[0071] Figure 1 This is an optional flowchart of the data encryption and decryption method provided in the embodiment of the present application. Figure 1 The method may include but is not limited to steps 110 to 130. It is also understood that this embodiment is for Figure 1 The order of step 110 to step 130 is not specifically limited, and the order of steps can be adjusted or some steps can be reduced or added according to actual needs.

[0072] Step 110: Obtain public parameters generated according to security parameters, and generate corresponding encryption public key, encryption private key and mask parameters according to the public parameters.

[0073] In one embodiment, multiple user-end devices can be connected to a server-end device over a network to perform a multi-key homomorphic encryption process. First, the server-end device can generate a public parameter based on the security parameter to define the specific execution process of the homomorphic encryption.

[0074] In one embodiment, the server device may generate public parameters based on security parameters using an initialization algorithm. The public parameters include at least a ciphertext modulus, a plaintext modulus, a key distribution, a Gaussian error distribution, and a public reference string. The initialization algorithm is expressed as:

[0075]

[0076] in, represents the initialization algorithm, Represents the safety parameters, Indicates public parameters. Specifically, , N represents the ring dimension of the polynomial ring R, Represents the ciphertext modulus in the CKKS / BFV scheme, is the plaintext modulus in the CKKS / BFV scheme, represents the key distribution, which is used to limit the probability distribution of the relevant key on the term ring R with a small boundary. represents a Gaussian error distribution, and , represents the number of terms in the polynomial, represents a public reference string, where is from a uniform distribution Randomly sampled from .

[0077] In one embodiment, the security parameters It can be set according to actual needs, for example , indicating 128-bit security. The ring dimension N can be For the CKKS scheme, the plaintext modulus t represents the scaling factor of the floating point encoding, such as t= ,For the BFV scheme, the plaintext modulus t represents the modulus of the integer plaintext, such as t=65537. The ciphertext modulus Q is used to control the noise growth and ensure the correctness of decryption, for example The key distribution can have a mean of 0 and a standard deviation of Gaussian distribution. Gaussian error distribution is used to define the distribution of encryption noise, the purpose is to enhance security, prevent linear algebra attacks, etc. For example, you can set , The value of needs to be large enough to improve security, for example , It is understood that the above is only an illustration of the public parameters and does not limit them. Different security parameters may correspond to different public parameters.

[0078] In one embodiment, a key calculation algorithm is used to obtain an encrypted public key, an encrypted private key, and mask parameters, wherein the key calculation algorithm is expressed as:

[0079]

[0080] in, Represents the encrypted private key, represents the encryption public key, Represents the mask parameter.

[0081] In one embodiment, the mask parameters include masked ciphertext and masked key. Figure 2 , Figure 2 This is a flowchart of generating corresponding encryption public keys, encryption private keys, and homomorphic addition parameters according to public parameters provided by an embodiment of the present application, which specifically includes the following steps:

[0082] Step 210: Obtain private key parameters according to the key distribution, obtain an encrypted private key according to the private key parameters, and obtain an encrypted public key according to the key distribution, the public reference string, the ciphertext modulus, and the Gaussian error distribution.

[0083] In one embodiment, the encrypted private key Expressed as:

[0084]

[0085] Among them, s represents the private key parameter, and the private key parameter s is distributed according to the key Get, expressed as , that is to say, random sampling is performed in the key distribution to obtain s, and then the encrypted private key is obtained.

[0086] Next, calculate the encryption public key. Figure 3 , Figure 3 This is a flowchart of obtaining an encrypted public key based on key distribution, public reference string, ciphertext modulus, and Gaussian error distribution, provided by an embodiment of the present application, specifically including the following steps:

[0087] Step 310: Generate a first noise term according to the Gaussian error distribution, and obtain a first intermediate term according to the first noise term and the ciphertext modulus.

[0088] In one embodiment, from the Gaussian error distribution The first noise term is obtained by random sampling , expressed as: , where the first noise term is a random polynomial sampled from a Gaussian error distribution with coefficient mean 0 and standard deviation .

[0089] Then, in order to avoid noise expansion, the ciphertext modulus Q is used to prevent coefficient overflow. The first noise term is calculated only from the ciphertext modulus and mapped to the interval [-Q / 2, Q / 2). The first intermediate term is expressed as:

[0090]

[0091] Step 320: Obtain a second intermediate item based on the private key parameter and the public reference string, obtain a third intermediate item by summing the first intermediate item and the second intermediate item, and obtain an encrypted public key based on the third intermediate item and the public reference string.

[0092] In one embodiment, the second intermediate term is represented by:

[0093]

[0094] Therefore, the third intermediate term is expressed as:

[0095]

[0096] In one embodiment, the public key is encrypted ,and , and thus the encryption public key is obtained according to the third intermediate item and the public reference string .

[0097] Step 220: Gadget encrypt the masked random polynomial to obtain a masked key, and encrypt the target data based on the masked random polynomial and the encryption public key to obtain a masked ciphertext.

[0098] In one embodiment, a random polynomial is selected As a mask random polynomial, for the random polynomial Encrypt the gadget to get the mask key .

[0099] First, we introduce the gadget decomposition process. The gadget decomposition process can be defined as mapping , which satisfies the following conditions, for all :

[0100] 1) There exists a constant vector , making

[0101]

[0102] Among them, the constant vector Can be a power basis vector, for example: , where B is the decomposition basis, for example B=2, and the purpose is to represent any b by a linear combination of basis vectors.

[0103] And for each coefficient b of b k (k∈[0,N−1]), calculate its constant vector The following representation:

[0104]

[0105] in, Represent the coefficients and reorganize them into a polynomial: ,get:

[0106]

[0107] Where X represents the independent variable of the polynomial.

[0108] Therefore, we can get:

[0109]

[0110] 2) The coefficient is small, that is, there is a constant ,satisfy .

[0111] The above constant vector is called Gadget vector, and yes A compact representation with bounded coefficients, mapping Can be viewed as an inner product operation The right inverse of .

[0112] Next, the gadget encryption process is performed according to the gadget decomposition process described above.

[0113] For a given target data and encrypted private key ,in , the mask key obtained by gadget encryption of the masked random polynomial is defined as a pair of vectors If the following relationship is satisfied, then it is called for The mask key:

[0114]

[0115] in, Represents the inner product operation.

[0116] In one embodiment, after obtaining the mask key, the masked ciphertext can be calculated. Figure 4 , Figure 4 This is a flowchart of encrypting target data based on a masked random polynomial and an encryption public key to obtain a masked ciphertext, provided in an embodiment of the present application, which specifically includes the following steps:

[0117] Step 410: Obtain the product of the mask random polynomial and the encryption public key to obtain a first mask intermediate term, and generate a second noise term and a third noise term according to a Gaussian error distribution.

[0118] In one embodiment, the first mask middle term is represented as: , the second noise term is generated by sampling according to the Gaussian error distribution and the third noise term , expressed as .

[0119] Step 420: When the encryption algorithm is the first encryption algorithm, obtain a second masked intermediate term according to the second noise term and the third noise term, and obtain a masked ciphertext according to the sum of the first masked intermediate term and the second masked intermediate term.

[0120] In one embodiment, when selecting When the first encryption algorithm is used, a structured tuple is formed based on the second noise term and the third noise term, which is expressed as , the two-tuple is a two-variable polynomial vector, and the two-tuple modulo the ciphertext modulus is taken to obtain the second mask intermediate term, which is expressed as:

[0121]

[0122] Next, the masked ciphertext is obtained based on the sum of the first masked intermediate term and the second masked intermediate term, which is expressed as:

[0123]

[0124] in, Indicates masked ciphertext.

[0125] Step 430: When the encryption algorithm is the second encryption algorithm, obtain masked initial data according to the plaintext modulus, the ciphertext modulus and the target data, calculate the sum of the masked initial data and the second noise term to obtain the third masked intermediate term, obtain the fourth masked intermediate term according to the third masked intermediate term and the third noise term, and obtain the masked ciphertext according to the sum of the first masked intermediate term and the fourth masked intermediate term.

[0126] In one embodiment, the BFV algorithm is selected as the second encryption algorithm, and the masked initial data obtained according to the plaintext modulus, the ciphertext modulus and the target data is expressed as:

[0127]

[0128] Then the third mask intermediate term is obtained based on the sum of the mask initial data and the second noise term, which is expressed as:

[0129]

[0130] in, Indicates rounding to the nearest integer.

[0131] Next, a structured binary is formed based on the third masked intermediate term and the third noise term. The binary is then modulo-ed by the ciphertext modulus to obtain the fourth masked intermediate term, which is expressed as:

[0132]

[0133] Finally, the masked ciphertext is obtained based on the sum of the first masked intermediate term and the fourth masked intermediate term, which is expressed as:

[0134]

[0135] It is understandable that the encryption algorithm can be set according to actual needs, and the calculation process of the masked ciphertext for different encryption algorithms is as described above.

[0136] Step 120: Encrypt the target data using the encryption public key to obtain encrypted data, and send the mask parameter, encryption public key and encrypted data to the server device.

[0137] In one embodiment, the encryption process is described as , refer to Figure 5 , Figure 5 This is a flowchart of encrypting target data using an encryption public key to obtain encrypted data, provided in an embodiment of the present application, which specifically includes the following steps:

[0138] Step 510: Generate a fourth noise term and a fifth noise term according to the Gaussian error distribution, obtain an encryption distribution parameter according to the key distribution, and calculate the product of the encryption distribution parameter and the encryption public key to obtain a fifth masked intermediate term.

[0139] In one embodiment, the fourth noise term is first generated by sampling according to the Gaussian error distribution. and the fifth noise term , according to the key distribution Get encryption distribution parameters , expressed as Next, the product of the encryption distribution parameter and the encryption public key is calculated to obtain the fifth masked intermediate term, which is expressed as: .

[0140] Step 520: When the encryption algorithm is the first encryption algorithm, the target data is used as the encryption initial data; when the encryption algorithm is the second encryption algorithm, the masked initial data is used as the encryption initial data.

[0141] In one embodiment, if the encryption algorithm is the first encryption algorithm When the target data As the encrypted initial data, when the encryption algorithm is the second encryption algorithm BFV, the masked initial data As the initial data for encryption.

[0142] Step 530: Obtain encrypted data according to the encrypted initial data, the fifth noise term, and the fifth mask intermediate term.

[0143] In one embodiment, in the first encryption algorithm When , the encrypted data is represented as:

[0144]

[0145] In the second encryption algorithm BFV, the encrypted data is expressed as:

[0146]

[0147] Once the encrypted data is obtained, the mask parameter, encryption public key, and encrypted data are sent to the server. The server may receive relevant data from multiple different client devices. It can then use the encryption public key to expand the different encrypted data to obtain the extended ciphertext corresponding to each client device. It then performs homomorphic addition on the expanded ciphertext based on the encryption public key and mask parameter, and sends the resulting addition ciphertext to the different client devices. The data processing process on the server will be described in detail in the following embodiments.

[0148] Step 130: Partially decode the received addition ciphertext using the encryption private key to obtain the corresponding decoded plaintext.

[0149] In one embodiment, it is assumed that a user terminal device receives an addition ciphertext The addition ciphertext also includes the ciphertext data corresponding to other user-end devices. At this time, after receiving the addition ciphertext, the user-end device uses the corresponding encryption private key to partially decode it. Partial decoding here means that the user-end device can only use its own encryption private key to decode the ciphertext component related to itself to obtain the corresponding decrypted plaintext. This process is expressed as:

[0150]

[0151] in, represents the encryption private key of the i-th user terminal device, Represents the ciphertext component corresponding to the i-th user terminal device in the addition ciphertext, Represents part of the decoding algorithm, Indicates the decoded plaintext corresponding to the i-th user terminal device.

[0152] Next, the execution process of the data encryption and decryption method in the embodiment of the present application on the server device is described.

[0153] In one embodiment, referring to Figure 6 , Figure 6 This is another flow chart of the data encryption and decryption method provided in an embodiment of the present application, comprising the following steps:

[0154] Step 610: Obtain at least one encrypted data from different user terminal devices and the corresponding encryption public key and mask parameter.

[0155] In one embodiment, the server device receives at least one piece of encrypted data and corresponding encryption public key and mask parameter from different client devices.

[0156] Step 620: Obtain the encryption public key of at least one other user terminal device to obtain an extended public key, and expand the encrypted data based on the extended public key and the mask parameter to obtain an extended ciphertext.

[0157] In one embodiment, for the i-th client device, its own encryption public key and the encryption public keys of other client devices are used as the extended public key, which is expressed as . Reference Figure 7 , Figure 7 This is a flowchart of obtaining an extended ciphertext by extending the extended ciphertext based on the extended public key and the mask parameter provided in an embodiment of the present application, which specifically includes the following steps:

[0158] Step 710: Calculate the difference between each extended public key and the corresponding encrypted public key, and accumulate the difference values ​​to obtain a total difference value.

[0159] In one embodiment, if the encryption public key is represented as , where b represents the key-related component in the encrypted public key, and a represents the noise term, which is the perturbation term of the key component. The difference between each extended public key and the key component in the corresponding encrypted public key is calculated as follows: ,in, represents the i-th extended public key, b represents the current encrypted public key, so the total difference value is expressed as:

[0160]

[0161] Here, n represents the number of extended public keys, that is, the number of user-end devices.

[0162] Step 720: Perform an outer product operation on the total difference value and the mask key to obtain the extended ciphertext.

[0163] In one embodiment, the ith encrypted ciphertext Expand to get the extended ciphertext The process is described as:

[0164]

[0165] in, Indicates encrypted ciphertext The corresponding encrypted public key. Extended ciphertext The calculation process is expressed as:

[0166]

[0167]

[0168]

[0169] in, represents the outer product operation, represents the result of key expansion between the encrypted public key and the i-th extended public key, and ,and , the rest The values ​​of are all 0. It can be understood that for For example, the result is .

[0170] It can be understood that in the above embodiment, the encrypted data is expanded using its own mask key, and the mask key is encrypted by Gadget. It is not a method of encrypting a single bit of data on the basis of a universal mask to add identity information, thereby avoiding the problem of high computational complexity caused by the increase in space and time complexity as a quadratic increase of N (the number of participants) as the bit length of the ciphertext increases.

[0171] Step 630: Perform homomorphic addition calculation on at least two extended ciphertexts using the mask parameter to obtain the addition ciphertext of the corresponding user terminal device, and send the addition ciphertext to the corresponding user terminal device.

[0172] In one embodiment, referring to Figure 8 , Figure 8 This is a flowchart of performing homomorphic addition calculation on at least two extended ciphertexts using mask parameters to obtain the corresponding addition ciphertext of the user terminal device, provided in an embodiment of the present application, which specifically includes the following steps:

[0173] Step 810: Obtain the encryption public key, mask ciphertext and mask key corresponding to each extended ciphertext.

[0174] In one embodiment, the ciphertext is expanded and For example, the corresponding encryption public key is , the mask parameters are: ,in, 、 Represent the masked ciphertext, 、 Represent the mask key respectively.

[0175] Step 820: Obtain the plaintext component and the public key component in the extended ciphertext, and add the plaintext components to obtain a plaintext addition item.

[0176] In one embodiment, the extended ciphertext includes a plaintext component and a public key component, which is expressed as ,Will As the plaintext part, As the public key component. Add the plaintext components to get the corresponding plaintext addition term, expressed as:

[0177]

[0178] Step 830: Perform mask extension on each mask key based on all mask keys to obtain a mask extension key.

[0179] In one embodiment, for the mask key , whose masked extended key is expressed as:

[0180]

[0181] For the mask key , whose masked extended key is expressed as:

[0182]

[0183] Step 840: Obtain the extended update ciphertext corresponding to each extended ciphertext according to the plaintext addition item, the masked ciphertext, and the masked extended key, and obtain the addition ciphertext based on the extended update ciphertext.

[0184] In one embodiment, the extended ciphertext The corresponding extended update ciphertext is expressed as:

[0185]

[0186] Extended ciphertext The corresponding extended update ciphertext is expressed as:

[0187]

[0188] Summarize all the extended updated ciphertexts to get the final additive ciphertext , this process is expressed as:

[0189]

[0190]

[0191] Step 640: Obtain the decoded plaintext obtained by partially decoding the addition ciphertext using the encryption private key of the user terminal device, aggregate all the decoded plaintexts, and obtain the target plaintext.

[0192] In one embodiment, after the addition ciphertext is obtained, the addition ciphertext is sent to the user terminal device, and the user terminal device partially decodes the ciphertext component related to itself to obtain the corresponding decoded plaintext. , then the user-end device sends the decoded plaintext to the server-end device, which aggregates the decoded plaintext to obtain the target plaintext. The process is expressed as:

[0193]

[0194] In one embodiment, referring to Figure 9 , Figure 9 It is a schematic diagram of the overall process of the data encryption and decryption method provided in the embodiment of the present application.

[0195] First, the server device or other server acts as the establishment end, responds to the request of the user device, and Generate public parameters , sending the public parameters to all user-end devices. Subsequently, different user-end devices use the key calculation algorithm to generate their corresponding encryption public key, encryption private key and mask parameters. The process is expressed as: The user device then executes In the process, the target data is encrypted using the encryption public key to obtain the encrypted data. The encrypted data is sent to the server device for evaluation.

[0196] At this time, the server device executes Process, at least one encrypted data from different user terminal devices is expanded to obtain the corresponding extended ciphertext. At the same time, different extended ciphertexts are executed This homomorphic addition operation yields the addition ciphertext The addition ciphertext is returned to the user end device as the calculation result ciphertext.

[0197] Next, the user terminal device performs the addition ciphertext Partial decoding to obtain the corresponding decoded plaintext , and the corresponding decoded plaintext Return to the server device. Executed by the server device , aggregate the decoded plaintext to obtain the target plaintext.

[0198] In this process, the specific execution process of the embodiment of the present application can be described as follows: the masked extended key is With masked ciphertext As the mask information (ciphertext) of the user terminal device, where the mask ciphertext With encrypted data Generated simultaneously by the same user-end device (e.g., user-end device P).

[0199] When a user terminal device P performs joint decryption with another user terminal device P', the decryption process is described as follows:

[0200]

[0201] in, and Decryption and The noise term generated, so the encrypted data of the user terminal device P Can be expanded to extended ciphertext , and is decrypted to:

[0202]

[0203] Assumptions Decryption noise , so the decryption process is described as:

[0204]

[0205] Therefore, if , then , decryption successful.

[0206] But because ,and:

[0207]

[0208] in, ,visible is a large non-negligible noise.

[0209] Therefore, the above equation In order to control the growth of noise and ensure the correctness of the multi-key ciphertext evaluation calculation after masking, the embodiment of this application adopts Gadget decomposition technology to reduce growth, ensuring , thus ensuring .

[0210] Among them, the purpose of Gadget decomposition is to represent the elements in the ring as a compact, structured linear combination of predefined basis elements. By using Gadget decomposition technology, any ring element can be multiplied efficiently in a homomorphic environment while avoiding excessive noise. Specifically in the embodiment of the present application, the masked expansion key is generated. ,in is the masked random polynomial The Gadget is encrypted and then based on the extended algorithm generate , so we can get: , decryption successful.

[0211] The encryption and decryption methods described below in the embodiments of the present application satisfy semantic security and correctness.

[0212] First, semantic security means that even if the attacker knows the public parameters and encrypted public key It is also impossible to infer any information about the plaintext from the ciphertext. Assume that the information that the attacker may obtain is distributed by composition.

[0213] For a given safety parameter , the encryption process of the embodiment of the present application can ensure the following computational indistinguishability:

[0214]

[0215]

[0216] in, Indicates that for data The encryption process, Indicates that for data The encryption process, Indicates use As the mask random polynomial for the masking process, Indicates use The masking process is performed using a random polynomial as the mask.

[0217] It can be seen that no matter whether the encrypted plaintext is μ or another random plaintext μ′, since the embodiment of the present application distributes the encrypted plaintext according to the key in the encryption process, Get encryption distribution parameters is unknown, and the random polynomial is no longer accessible after modification , so the final distribution of the encrypted data has nothing to do with the data itself, so the following relationship can be guaranteed to be satisfied: In addition, whether the masking process uses a random polynomial r or another random polynomial r′, The algorithm also satisfies the following computational indistinguishability . Able to achieve semantic security.

[0218] Speaking of correctness, correctness is to ensure that after the masking process and decryption process, the decrypted plaintext is still consistent with the target data as the original plaintext (possibly with controllable noise).

[0219] For any ,make , then:

[0220]

[0221] in, , and there is:

[0222]

[0223] in, .

[0224] Combining the above results, we can get:

[0225]

[0226] in, .

[0227] It can be seen that the data encryption and decryption method of the embodiment of the present application can also meet the accuracy requirements.

[0228] The core point of the embodiment of the present application is to introduce a new mask scheme, The mask decryption process, such that the encrypted data of the user terminal device P Can be masked as extended ciphertext , and is successfully decrypted as , thereby ensuring the privacy of encrypted data among multiple parties, effectively solving the security problem of data leakage in multi-key homomorphic encryption scenarios in related technologies, and using mask parameters to ensure the correctness of the homomorphic computing process, thereby significantly improving the security and practicality of the system.

[0229] For example, for square, equation ,in is Encrypted data encrypted by the party, They are and The encryption private key of the party. This decryption is used to mask the encrypted target data In this process, the attacker cannot obtain the masked key Get any data about the target The server-side device, as the evaluator, can effectively derive the solution for any selected identity. In summary, the masking scheme of the embodiment of the present application ensures that encrypted data from different user-end devices can be securely merged when performing homomorphic computation, while preventing the leakage of sensitive plaintext information, thereby enhancing the security of the multi-key encryption system.

[0230] The technical solution provided by the embodiment of the present application obtains public parameters generated according to security parameters, generates corresponding encryption public keys, encryption private keys and mask parameters according to the public parameters, encrypts the target data using the encryption public key to obtain encrypted data, and sends the mask parameters, encryption public key and encrypted data to the server device, so that the server device uses the encryption public key to expand the encrypted data to obtain extended ciphertext, and performs homomorphic addition calculation on the extended ciphertext based on the encryption public key and the mask parameters, and then sends the obtained addition ciphertext to the user terminal device, and partially decodes the received addition ciphertext using the encryption private key to obtain the corresponding decoded plaintext. In the embodiment of the present application, each user terminal device generates corresponding mask parameters to participate in the subsequent calculation process. In the process of homomorphic addition, auxiliary data is introduced using the mask parameters to ensure that ciphertexts from different sources can be safely merged, and the calculation result still maintains semantic security. The attacker cannot distinguish whether two different ciphertexts correspond to the same plaintext, thereby preventing the leakage of sensitive plaintext information and enhancing the security of the multi-key encryption system.

[0231] The present application also provides a data encryption and decryption device, which is applied to a user terminal device and can implement the above data encryption and decryption method. Figure 10 , the device comprises:

[0232] The key generation module 1010 is used to obtain public parameters generated according to security parameters, and generate corresponding encryption public keys, encryption private keys and mask parameters according to the public parameters.

[0233] Encryption module 1020: used to encrypt the target data using the encryption public key to obtain encrypted data, and send the mask parameter, encryption public key and encrypted data to the server device, so that the server device uses the encryption public key to expand the encrypted data to obtain extended ciphertext, and after performing homomorphic addition calculation on the extended ciphertext based on the encryption public key and the mask parameter, the obtained addition ciphertext is sent to the user device.

[0234] Decryption module 1030: used to partially decode the received addition ciphertext using the encryption private key to obtain the corresponding decoded plaintext.

[0235] In one embodiment, the public parameters include at least a ciphertext modulus, a key distribution, a Gaussian error distribution, and a public reference string. The key generation module 1010 is further configured to:

[0236] Obtaining private key parameters according to the key distribution, obtaining the encrypted private key according to the private key parameters, and obtaining the encrypted public key according to the key distribution, the public reference string, the ciphertext modulus, and the Gaussian error distribution;

[0237] Gadget encryption is performed on the masked random polynomial to obtain the masked key, and target data is encrypted based on the masked random polynomial and the encryption public key to obtain the masked ciphertext.

[0238] In one embodiment, the key generation module 1010 is further configured to:

[0239] generating a first noise term according to the Gaussian error distribution, and obtaining a first intermediate term according to the first noise term and the ciphertext modulus;

[0240] A second intermediate item is obtained based on the private key parameter and the public reference string, a third intermediate item is obtained by summing the first intermediate item and the second intermediate item, and the encrypted public key is obtained according to the third intermediate item and the public reference string.

[0241] In one embodiment, the key generation module 1010 is further configured to:

[0242] Obtaining a product of the masked random polynomial and the encryption public key to obtain a first masked intermediate term, and generating a second noise term and a third noise term according to the Gaussian error distribution;

[0243] When the encryption algorithm is the first encryption algorithm, obtaining a second masked intermediate term according to the second noise term and the third noise term, and obtaining the masked ciphertext according to the sum of the first masked intermediate term and the second masked intermediate term;

[0244] When the encryption algorithm is the second encryption algorithm, masked initial data is obtained according to the plaintext modulus, the ciphertext modulus and the target data, the sum of the masked initial data and the second noise term is calculated to obtain a third masked intermediate term, a fourth masked intermediate term is obtained according to the third masked intermediate term and the third noise term, and the masked ciphertext is obtained according to the sum of the first masked intermediate term and the fourth masked intermediate term.

[0245] In one embodiment, the encryption module 1020 is further configured to:

[0246] generating a fourth noise term and a fifth noise term according to the Gaussian error distribution, obtaining an encryption distribution parameter according to the key distribution, and calculating a product of the encryption distribution parameter and the encryption public key to obtain a fifth masked intermediate term;

[0247] When the encryption algorithm is the first encryption algorithm, the target data is used as the encryption initial data; when the encryption algorithm is the second encryption algorithm, the masked initial data is used as the encryption initial data;

[0248] The encrypted data is obtained according to the encrypted initial data, the fifth noise term and the fifth mask intermediate term.

[0249] The specific implementation of the data encryption and decryption device of this embodiment is basically the same as the specific implementation of the data encryption and decryption method applied to the user terminal device mentioned above, and will not be repeated here.

[0250] The present application also provides a data encryption and decryption device, which is applied to a server device and can implement the above data encryption and decryption method. Figure 11 , the device comprises:

[0251] Parameter acquisition module 1110: used to obtain at least one piece of encrypted data and corresponding encryption public key and mask parameter from different user terminal devices.

[0252] Extension module 1120: used to obtain the encryption public key of at least one other user terminal device to obtain an extended public key, and expand the encrypted data based on the extended public key and the mask parameter to obtain an extended ciphertext.

[0253] Homomorphic calculation module 1130: used to perform homomorphic addition calculation on at least two extended ciphertexts using mask parameters to obtain the addition ciphertext of the corresponding user terminal device, and send the addition ciphertext to the corresponding user terminal device.

[0254] The plaintext aggregation module 1140 is used to obtain the decoded plaintext obtained by partially decoding the addition ciphertext using the encryption private key of the user terminal device, and aggregate all the decoded plaintexts to obtain the target plaintext.

[0255] In one embodiment, the expansion module 1120 is further configured to:

[0256] Calculating the difference between each of the extended public keys and the corresponding encrypted public key, and accumulating the difference values ​​to obtain a total difference value;

[0257] An outer product operation is performed on the total difference value and the mask key to obtain the extended ciphertext, where the extended ciphertext includes a plaintext component and a public key component.

[0258] In one embodiment, the mask parameter further includes a masked ciphertext, and the homomorphic computing module 1130 is further configured to:

[0259] Obtaining the encryption public key, the masked ciphertext, and the masked key corresponding to each of the extended ciphertexts;

[0260] Obtaining a plaintext component and a public key component in the extended ciphertext, and adding the plaintext components to obtain a plaintext addition term;

[0261] Performing mask extension on each of the masked keys according to all the masked keys to obtain a masked extended key;

[0262] An extended update ciphertext corresponding to each extended ciphertext is obtained according to the plaintext addition item, the masked ciphertext and the masked extended key, and the addition ciphertext is obtained based on the extended update ciphertext.

[0263] The specific implementation of the data encryption and decryption device of this embodiment is basically the same as the specific implementation of the data encryption and decryption method applied to the server device described above, and will not be repeated here.

[0264] An embodiment of the present application further provides an electronic device, including:

[0265] at least one memory;

[0266] at least one processor;

[0267] at least one program;

[0268] The program is stored in the memory, and the processor executes the at least one program to implement the data encryption and decryption method implemented in this application. The electronic device can be any smart terminal including a mobile phone, a tablet computer, a personal digital assistant (PDA), an in-vehicle computer, etc.

[0269] See also Figure 12 , Figure 12 The hardware structure of an electronic device according to another embodiment is shown. The electronic device includes:

[0270] The processor 1201 may be implemented as a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is configured to execute relevant programs to implement the technical solutions provided in the embodiments of the present application.

[0271] The memory 1202 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1202 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 1202 and is called by the processor 1201 to execute the data encryption and decryption method of the embodiments of this application;

[0272] Input / output interface 1203, used to implement information input and output;

[0273] Communication interface 1204, used to implement communication interaction between this device and other devices, which can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WiFi, Bluetooth, etc.);

[0274] Bus 1205 , which transmits information between various components of the device (e.g., processor 1201 , memory 1202 , input / output interface 1203 , and communication interface 1204 );

[0275] The processor 1201 , the memory 1202 , the input / output interface 1203 and the communication interface 1204 are connected to each other in communication within the device via the bus 1205 .

[0276] An embodiment of the present application further provides a storage medium, which is a storage medium storing a computer program. When the computer program is executed by a processor, the above-mentioned data encryption and decryption method is implemented.

[0277] The memory, as a non-transient storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0278] The data encryption and decryption method, apparatus, device and storage medium proposed in the embodiment of the present application obtains public parameters generated according to security parameters, generates corresponding encryption public keys, encryption private keys and mask parameters according to the public parameters, encrypts the target data with the encryption public key to obtain encrypted data, and sends the mask parameters, encryption public key and encrypted data to the server device, so that the server device uses the encryption public key to expand the encrypted data to obtain extended ciphertext, and performs homomorphic addition calculation on the extended ciphertext based on the encryption public key and the mask parameters, and then sends the obtained addition ciphertext to the user-end device, and partially decodes the received addition ciphertext with the encryption private key to obtain the corresponding decoded plaintext. In the embodiment of the present application, each user-end device generates a corresponding mask parameter to participate in the subsequent calculation process. In the process of homomorphic addition, auxiliary data is introduced using the mask parameter to ensure that ciphertexts from different sources can be safely merged, and the calculation result still maintains semantic security. The attacker cannot distinguish whether two different ciphertexts correspond to the same plaintext, thereby preventing the leakage of sensitive plaintext information and enhancing the security of the multi-key encryption system.

[0279] The embodiments described in the embodiments of this application are intended to more clearly illustrate the technical solutions of the embodiments of this application and do not constitute a limitation on the technical solutions provided by the embodiments of this application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0280] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0281] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, i.e., they may be located in one place or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of this embodiment.

[0282] Those skilled in the art will appreciate that all or some of the steps in the methods, systems, and functional modules / units in the devices disclosed above may be implemented as software, firmware, hardware, or appropriate combinations thereof.

[0283] The terms "first," "second," "third," "fourth," and the like (if any) in the specification of the present application and the accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a particular order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in orders other than those illustrated or described herein. In addition, the terms "including" and "having," and any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such process, method, product, or apparatus.

[0284] It should be understood that in this application, "at least one (item)" means one or more, and "more" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships can exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or plural.

[0285] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the above-mentioned units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0286] The units described above as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0287] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0288] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes multiple instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store programs.

[0289] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but are not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and essence of the present invention should be within the scope of the present invention.

Claims

1. A data encryption and decryption method, characterized in that: Applied to a user terminal device, the method includes: Obtaining public parameters generated according to security parameters, and generating corresponding encryption public key, encryption private key and mask parameters according to the public parameters; encrypting the target data using the encryption public key to obtain encrypted data, and sending the mask parameter, the encryption public key, and the encrypted data to the server device, so that the server device uses the encryption public key to expand the encrypted data to obtain extended ciphertext, and performs homomorphic addition calculation on the extended ciphertext based on the encryption public key and the mask parameter, and then sends the obtained addition ciphertext to the user device; Partially decoding the received addition ciphertext using the encryption private key to obtain corresponding decoded plaintext; The public parameters include at least a ciphertext modulus, a key distribution, a Gaussian error distribution, and a public reference string; the mask parameters include a masked ciphertext and a masked key; and generating corresponding encrypted public keys, encrypted private keys, and mask parameters according to the public parameters includes: obtaining private key parameters according to the key distribution, obtaining the encrypted private key according to the private key parameters, and obtaining the encrypted public key according to the key distribution, the public reference string, the ciphertext modulus, and the Gaussian error distribution; performing Gadget encryption on a masked random polynomial to obtain the masked key, and encrypting target data based on the masked random polynomial and the encrypted public key to obtain the masked ciphertext, wherein the masked random polynomial is a random polynomial. The method of encrypting the target data using the encryption public key to obtain encrypted data includes: generating a fourth noise term and a fifth noise term according to the Gaussian error distribution, obtaining an encryption distribution parameter according to the key distribution, and calculating the product of the encryption distribution parameter and the encryption public key to obtain a fifth masked intermediate term; when the encryption algorithm is the first encryption algorithm, using the target data as the encryption initial data, and when the encryption algorithm is the second encryption algorithm, using the masked initial data as the encryption initial data; and obtaining the encrypted data according to the encryption initial data, the fifth noise term and the fifth masked intermediate term.

2. The data encryption and decryption method according to claim 1, characterized in that: The obtaining the encrypted public key according to the key distribution, the public reference string, the ciphertext modulus, and the Gaussian error distribution includes: generating a first noise term according to the Gaussian error distribution, and obtaining a first intermediate term according to the first noise term and the ciphertext modulus; A second intermediate item is obtained based on the private key parameter and the public reference string, a third intermediate item is obtained by summing the first intermediate item and the second intermediate item, and the encrypted public key is obtained according to the third intermediate item and the public reference string.

3. The data encryption and decryption method according to claim 1, wherein: The public parameter also includes a plaintext modulus, and the target data is encrypted based on the masked random polynomial and the encryption public key to obtain the masked ciphertext, including: Obtaining a product of the masked random polynomial and the encryption public key to obtain a first masked intermediate term, and generating a second noise term and a third noise term according to the Gaussian error distribution; When the encryption algorithm is the first encryption algorithm, obtaining a second masked intermediate term according to the second noise term and the third noise term, and obtaining the masked ciphertext according to the sum of the first masked intermediate term and the second masked intermediate term; When the encryption algorithm is the second encryption algorithm, masked initial data is obtained according to the plaintext modulus, the ciphertext modulus and the target data, the sum of the masked initial data and the second noise term is calculated to obtain a third masked intermediate term, a fourth masked intermediate term is obtained according to the third masked intermediate term and the third noise term, and the masked ciphertext is obtained according to the sum of the first masked intermediate term and the fourth masked intermediate term.

4. A data encryption and decryption method, characterized in that: Applied to a server device, the method includes: Obtaining at least one encrypted data and a corresponding encryption public key and mask parameter from a different user terminal device, wherein the encrypted data and the corresponding encryption public key and mask parameter are generated by the user terminal device using the data encryption and decryption method according to any one of claims 1 to 3; Acquire the encryption public key of at least one other user terminal device to obtain an extended public key, and expand the encrypted data based on the extended public key and the mask parameter to obtain an extended ciphertext; Performing homomorphic addition calculation on at least two of the extended ciphertexts using the mask parameter to obtain an addition ciphertext corresponding to the user terminal device, and sending the addition ciphertext to the corresponding user terminal device; Obtain decoded plaintexts obtained by partially decoding the addition ciphertexts using the encryption private key on the user terminal device, aggregate all the decoded plaintexts, and obtain target plaintexts.

5. The data encryption and decryption method according to claim 4, characterized in that: The mask parameter includes a mask key, and the step of extending the extended ciphertext based on the extended public key and the mask parameter to obtain the extended ciphertext includes: Calculating the difference between each of the extended public keys and the corresponding encrypted public key, and accumulating the difference values ​​to obtain a total difference value; An outer product operation is performed on the total difference value and the mask key to obtain the extended ciphertext, where the extended ciphertext includes a plaintext component and a public key component.

6. The data encryption and decryption method according to claim 5, characterized in that: The mask parameter also includes a mask ciphertext, and the step of performing homomorphic addition calculation on at least two extended ciphertexts using the mask parameter to obtain the corresponding addition ciphertext of the user terminal device includes: Obtaining the encryption public key, the masked ciphertext, and the masked key corresponding to each of the extended ciphertexts; Obtaining a plaintext component and a public key component in the extended ciphertext, and adding the plaintext components to obtain a plaintext addition term; Performing mask extension on each of the masked keys according to all the masked keys to obtain a masked extended key; An extended update ciphertext corresponding to each extended ciphertext is obtained according to the plaintext addition item, the masked ciphertext and the masked extended key, and the addition ciphertext is obtained based on the extended update ciphertext.

7. A data encryption and decryption device, characterized in that: Applied to a user terminal device, the device comprises: Key generation module: used to obtain public parameters generated according to security parameters, and generate corresponding encryption public key, encryption private key and mask parameters according to the public parameters; An encryption module configured to encrypt target data using the encryption public key to obtain encrypted data, and send the mask parameter, the encryption public key, and the encrypted data to a server device, so that the server device uses the encryption public key to expand the encrypted data to obtain an extended ciphertext, and perform homomorphic addition calculation on the expanded ciphertext based on the encryption public key and the mask parameter, and then send the obtained addition ciphertext to the user device; Decryption module: used to partially decode the received addition ciphertext using the encryption private key to obtain the corresponding decoded plaintext; The public parameters include at least a ciphertext modulus, a key distribution, a Gaussian error distribution, and a public reference string; the mask parameters include a masked ciphertext and a masked key; and generating corresponding encrypted public keys, encrypted private keys, and mask parameters according to the public parameters includes: obtaining private key parameters according to the key distribution, obtaining the encrypted private key according to the private key parameters, and obtaining the encrypted public key according to the key distribution, the public reference string, the ciphertext modulus, and the Gaussian error distribution; performing Gadget encryption on a masked random polynomial to obtain the masked key, and encrypting target data based on the masked random polynomial and the encrypted public key to obtain the masked ciphertext, wherein the masked random polynomial is a random polynomial. The method of encrypting the target data using the encryption public key to obtain encrypted data includes: generating a fourth noise term and a fifth noise term according to the Gaussian error distribution, obtaining an encryption distribution parameter according to the key distribution, and calculating the product of the encryption distribution parameter and the encryption public key to obtain a fifth masked intermediate term; when the encryption algorithm is the first encryption algorithm, using the target data as the encryption initial data, and when the encryption algorithm is the second encryption algorithm, using the masked initial data as the encryption initial data; and obtaining the encrypted data according to the encryption initial data, the fifth noise term and the fifth masked intermediate term.

8. A data encryption and decryption device, characterized in that: Applied to a server device, the device includes: A parameter acquisition module: configured to acquire at least one piece of encrypted data and a corresponding encryption public key and mask parameters from different user-end devices, wherein the encrypted data and the corresponding encryption public key and mask parameters are generated by the user-end devices using the data encryption and decryption method according to any one of claims 1 to 3; Extension module: used for acquiring the encryption public key of at least one other user terminal device to obtain an extended public key, and extending the encrypted data based on the extended public key and the mask parameter to obtain an extended ciphertext; Homomorphic calculation module: used to perform homomorphic addition calculation on at least two of the extended ciphertexts using the mask parameter to obtain the addition ciphertext of the corresponding user terminal device, and send the addition ciphertext to the corresponding user terminal device; Plaintext aggregation module: used to obtain the decoded plaintext obtained by the user terminal device using the encryption private key to partially decode the addition ciphertext, and aggregate all the decoded plaintexts to obtain the target plaintext.

9. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the data encryption and decryption method according to any one of claims 1 to 6 when executing the computer program.

10. A storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the data encryption and decryption method according to any one of claims 1 to 6 is implemented.

Images