A multi-key fully homomorphic encryption method supporting multi-hop

Abstract

This invention relates to a multi-key fully homomorphic encryption method supporting multiple hops, belonging to the field of computer application technology; a trusted third party selects public parameters and sends them to all participating users; each user i sends the first component b i Send to a trusted third party; the trusted third party calculates the federated public key pk; each user i calculates the ciphertext ct. i Each user i calculates the polynomial d. i,2 ; Generate ciphertext D i As an extended component; when a new user with sequence number N+1 is added, the update variable K is calculated. i And send it to user i; each original user i calculates the active update component L i,0 And send it to a trusted third party; calculate the passive update component L for user i. i,1 and all L i,1 PK with public key N+1 Send to a trusted third party; the trusted third party updates the new ciphertext to nct; update the new joint public key pk; this invention considers the additivity of ciphertext components of BFV-type multi-key fully homomorphic encryption without ciphertext expansion and the multiplicative property of secrets that can be realized by a single encryption, and can realize the update of ciphertext to include new users, and has a broader application prospect.

Description

Technical Field

[0001] This invention belongs to the field of computer application technology and relates to a multi-key fully homomorphic encryption method that supports multiple hops. Background Technology

[0002] In the era of big data and cloud computing, as users' demands for data privacy gradually increase, the need for encrypted data computation has become a crucial factor in data computing across various industries. Fully homomorphic encryption possesses the inherent property of ciphertext computation, meaning that computation on the ciphertext guarantees corresponding operations on the plaintext. In 2009, Gentry designed the first fully homomorphic encryption algorithm based on an ideal lattice, and since then, numerous algorithm designs and accelerated implementations have emerged.

[0003] Early fully homomorphic encryption only supported operations between ciphertexts belonging to the same user, while multi-key fully homomorphic encryption algorithms support operations between ciphertexts belonging to different users. This property perfectly meets the requirements of secure multi-party computation scenarios. Currently, multi-key fully homomorphic encryption algorithms require ciphertext expansion algorithms to ensure that ciphertexts from different users can be used for cryptomorphic computation. However, this step currently requires a large amount of storage space and is very inefficient, making it impractical to implement. In 2022, Daza et al. designed a multi-key fully homomorphic encryption algorithm without ciphertext expansion based on the BFV algorithm, which can achieve multi-user ciphertext computation with comparable efficiency to the BFV algorithm.

[0004] Currently, multi-key fully homomorphic encryption algorithms based on the BFV algorithm and ciphertext-free expansion algorithm cannot enable user addition, i.e., multi-hop functionality. The participating users need to be determined before the fully homomorphic encryption algorithm starts, which is very limiting in many application scenarios, such as the encrypted processing of medical data. Newly added patient data cannot be directly added for calculation, resulting in a reduction in its practicality and efficiency. Summary of the Invention

[0005] The technical problem solved by this invention is to overcome the shortcomings of the prior art and propose a multi-key fully homomorphic encryption method that supports multiple hops. It considers the additivity of ciphertext components in BFV-type multi-key fully homomorphic encryption without ciphertext expansion and the multiplicative property of a single encryption that can realize a secret. It can realize the update of ciphertext to include new users and has a broader application prospect.

[0006] The solution of the present invention is:

[0007] A multi-key fully homomorphic encryption method supporting multiple hops includes:

[0008] A trusted third party selects a public string 'a' as the user's public parameter; and sends the public parameter to all original users who participated in the calculation.

[0009] Assume the number of original users participating in the computation is N; for 1≤i≤N, each original user i randomly selects a private key sk. i From the n-ary discrete Gaussian distribution χ n Select error polynomial e i ←χ n Calculate the first component b of the public key i Using the public string 'a' as the second component of the public key, we obtain the public key 'pk'. i Each original user i participating in the calculation will use the first component b. i Send to a trusted third party; the trusted third party calculates the federated public key pk;

[0010] The underlying algorithm is chosen to be BFV-type multi-key homomorphic encryption; each participating user i selects the plaintext m to be encrypted. i Randomly select polynomial u i ∈R2, from the n-ary discrete Gaussian distribution χ n Select error polynomial e i,1 ,e i,2 ←χ n ;e i,1 The first error polynomial chosen for the original user i participating in the calculation, e i,2 The second error polynomial is selected for the original user i participating in the computation; the ciphertext ct is computed. i ;

[0011] In scenarios supporting multi-hop, multi-key, fully homomorphic encryption, each participating original user i follows an n-ary discrete Gaussian distribution χ. n The temporary polynomial r of the original user i selected to participate in the computation i and the first error component of the original user i involved in the calculation Randomly select polynomial d i,1 ∈R q ; Calculate polynomial d i,0 Each original user i participating in the calculation is derived from an n-ary discrete Gaussian distribution χ. n Select the second error component of the original user i to participate in the calculation. Calculate polynomial d i,2 ; Generate ciphertext D i =(d i,0 |d i,1 |d i,2 ), as an extended component, and as public data;

[0012] When a new user with sequence number N+1 joins, the private key sk is generated using the public string 'a'. N+1 =s N+1 PK with public key N+1 =(b N+1,a)=([-a·s N+1 +e N+1 ] q ,a);

[0013] For any original user i participating in the computation, 1≤i≤N, user N+1 uses b N+1 With polynomial d respectively i,0 and polynomial d i,1 Multiply to calculate the update variable K i and K i It is sent to the original user i who participated in the calculation;

[0014] Each original user i received K i =(k i,0 |k i,1 After that, the original user i who participated in the calculation actively updated component L. i,0 =[k i,0 +k i,1 s i ] q and L i,0 Send to a trusted third party;

[0015] For any original user i participating in the computation, user N+1 randomly selects the error polynomial. The original user i participating in the calculation passively updates component L. i,1 and all L i,1 PK with public key N+1 Send to a trusted third party;

[0016] For any ciphertext ct = (c0, c1) that can be decrypted by the original users 1, ..., N participating in the computation, the trusted third party computes a new ciphertext nct that can be decrypted by users 1, ..., N, N+1; updates the new ciphertext to nct; and updates the new joint public key pk.

[0017] When no new users are added, maintain the original encryption state and do not perform any processing.

[0018] In the aforementioned multi-key fully homomorphic encryption method that supports multiple hops, the public string 'a' is:

[0019]

[0020] In the formula, q represents the modulus;

[0021] Represents the set of integers modulo q;

[0022] R q Represents a polynomial ring with modulus q;

[0023] n represents the polynomial ring R.q dimensionality;

[0024] Any a = a0 + a1x + ... + a n-1 x n-1 ∈R q Represent a polynomial; all coefficients in, Represents the real number Rounding down.

[0025] In the aforementioned multi-key fully homomorphic encryption method that supports multiple hops, the private key sk i for:

[0026]

[0027] In the formula, s i This represents the private key of user i;

[0028] Represents a polynomial ring with a modulus of 2;

[0029] Represent the binary set {0,1};

[0030] First component b i for:

[0031] b i =[-a·s i +e i ] q

[0032] The public key pk i for:

[0033] pk i =(b i ,a)=([-as i +e i ] q ,a).

[0034] In the aforementioned multi-key fully homomorphic encryption method that supports multiple hops, the trusted third party... i All b i Add them together to get the joint public key pk:

[0035]

[0036] In the aforementioned multi-key fully homomorphic encryption method that supports multiple hops, the plaintext m i for:

[0037]

[0038] In the formula, t is the modulus of the plaintext;

[0039] R t Represents a polynomial ring with modulus t;

[0040] Let represent the set of integers modulo t.

[0041] In the aforementioned multi-key fully homomorphic encryption method that supports multiple hops, the ciphertext ct i for:

[0042] ct i =(ct i [0],ct i [1])

[0043] Among them, ct i [0] is:

[0044]

[0045] In the formula, Δ represents the scaling factor.

[0046] Among them, ct i [1] is:

[0047] ct i [1]=[a·u i +e i,2 ] q .

[0048] In the aforementioned multi-key fully homomorphic encryption method that supports multiple hops, the polynomial d... i,0 for:

[0049]

[0050] The polynomial d i,2 for:

[0051]

[0052] In the aforementioned multi-key fully homomorphic encryption method that supports multiple hops, the K... i The calculation method is as follows:

[0053] K i =(k i,0 |k i,1 )

[0054] In the formula, k i,0 For K i The first polynomial; k i,0 =[b N+1 ·d i,0 ] q ;

[0055] k i,1 For K i The second polynomial; k i,1 =[b N+1 ·d i,1 ] q .

[0056] In the aforementioned multi-key fully homomorphic encryption method that supports multiple hops, the L i,1 The calculation method is as follows:

[0057]

[0058] In the aforementioned multi-hop, fully homomorphic encryption method with multiple keys, the new ciphertext nct is:

[0059]

[0060] The new public key PK is:

[0061]

[0062] The advantages of this invention compared to the prior art are:

[0063] (1) This invention can support the addition of any new user and update the ciphertext and joint public key while ensuring that the ciphertext size remains unchanged, which is conducive to promoting the practical application of multi-key homomorphic encryption algorithms;

[0064] (2) When a user pre-joins the operation, the present invention updates the ciphertext using its own public and private keys and the extended components of the original user, so that the private key corresponding to the ciphertext contains the new user, thereby realizing the multi-hop function of multi-key fully homomorphic encryption.

[0065] (3) This invention takes into account the additivity of the ciphertext components of the BFV type multi-key fully homomorphic encryption without ciphertext expansion and the multiplicative property of the secret that can be realized by a single encryption, which can realize the update of the ciphertext to include new users and has a broader application prospect. Attached Figure Description

[0066] Figure 1 This is a flowchart illustrating the multi-hop, multi-key, fully homomorphic encryption process supported by the present invention.

[0067] Figure 2 This is a schematic diagram illustrating the interaction process between users and trusted third parties in this invention. Detailed Implementation

[0068] The present invention will be further described below with reference to the embodiments.

[0069] This invention provides a multi-key fully homomorphic encryption method that supports multiple hops. It considers the additivity of ciphertext components in BFV-type multi-key fully homomorphic encryption without ciphertext expansion and the multiplicative property of a single encryption that can realize a secret. It can realize the update of ciphertext to include new users and has a wider range of application prospects.

[0070] Multi-key fully homomorphic encryption methods that support multiple hops, such as Figure 1 As shown, the specific steps include the following:

[0071] A trusted third party selects a public string 'a' as the user's public parameter and sends this public parameter to all participating users. The public string 'a' is:

[0072]

[0073] In the formula, q represents the modulus;

[0074] Represents the set of integers modulo q;

[0075] R q Represents a polynomial ring with modulus q;

[0076] n represents the polynomial ring R. q dimensionality;

[0077] Any a = a0 + a1x + ... + a n-1 x n-1 ∈R q Represent a polynomial; all coefficients in, Represents the real number Rounding down.

[0078] Assume the number of original users participating in the computation is N; for 1≤i≤N, each original user i randomly selects a private key sk. i From the n-ary discrete Gaussian distribution χ n Select error polynomial e i ←χ n Calculate the first component b of the public key i Using the public string 'a' as the second component of the public key, we obtain the public key 'pk'. i Each original user i participating in the calculation will use the first component b. i Send to a trusted third party; the trusted third party calculates the joint public key pk.

[0079] Private key sk i for:

[0080]

[0081] In the formula, s iThis represents the private key of the original user i who participated in the computation;

[0082] Represents a polynomial ring with a modulus of 2;

[0083] Represent the binary set {0,1};

[0084] First component b i for:

[0085] b i =[-a·s i +e i ] q

[0086] The public key pk i for:

[0087] pk i =(b i ,a)=([-as i +e i ] q ,a).

[0088] Trusted third party for PK i All b i Add them together to get the joint public key pk:

[0089]

[0090] The underlying algorithm is chosen to be BFV-type multi-key homomorphic encryption; each participating user i selects the plaintext m to be encrypted. i Randomly select polynomial u i ∈R2, from the n-ary discrete Gaussian distribution χ n Select error polynomial e i,1 ,e i,2 ←χ n ;e i,1 The first error polynomial chosen for the original user i participating in the calculation, e i,2 The second error polynomial is selected for the original user i participating in the computation; the ciphertext ct is computed. i .

[0091] plaintext m i for:

[0092]

[0093] In the formula, t is the modulus of the plaintext.

[0094] R t Let represent a polynomial ring with modulus t.

[0095] Let represent the set of integers modulo t.

[0096] encrypted ct i for:

[0097] ct i =(ct i [0],ct i [1])

[0098] Among them, ct i [0] is:

[0099]

[0100] In the formula, Δ represents the scaling factor.

[0101] Among them, ct i [1] is:

[0102] ct i [1]=[a·u i +e i,2 ] q .

[0103] In scenarios supporting multi-hop, multi-key, fully homomorphic encryption, each participating original user i follows an n-ary discrete Gaussian distribution χ. n The temporary polynomial r of the original user i selected to participate in the computation i and the first error component of the original user i involved in the calculation Randomly select polynomial d i,1 ∈R q ; Calculate polynomial d i,0 Each original user i participating in the calculation is derived from an n-ary discrete Gaussian distribution χ. n Select the second error component of the original user i to participate in the calculation. Calculate polynomial d i,2 ; Generate ciphertext D i =(d i,0 |d i,1 |d i,2 ), as an extended component, and as public data.

[0104] Wherein, polynomial d i,0 for:

[0105]

[0106] polynomial d i,2 for:

[0107]

[0108] When a new user with sequence number N+1 joins, the private key sk is generated using the public string 'a'. N+1 =s N+1 PK with public key N+1 =(b N+1 ,a)=([-a·s N+1 +e N+1 ] q ,a).

[0109] For any original user i participating in the computation, 1≤i≤N, user N+1 uses b N+1 With polynomial d respectively i,0 and polynomial d i,1 Multiply to calculate the update variable K i and K i It is sent to the original user i who participated in the calculation.

[0110] Among them, K i The calculation method is as follows:

[0111] K i =(k i,0 |k i,1 )

[0112] In the formula, k i,0 For K i The first polynomial; k i,0 =[b N+1 ·d i,0 ] q ;

[0113] k i,1 For K i The second polynomial; k i,1 =[b N+1 ·d i,1 ] q .

[0114] Each original user i participating in the calculation receives K i =(k i,0 |k i,1 After that, the original user i who participated in the calculation actively updated component L. i,0 =[k i,0 +k i,1 s i ] q and L i,0 Send to a trusted third party.

[0115] For any original user i participating in the computation, user N+1 randomly selects the error polynomial. The original user i participating in the calculation passively updates component L. i,1 and all L i,1PK with public key N+1 Send to a trusted third party.

[0116] Among them, L i,1 The calculation method is as follows:

[0117]

[0118] For any ciphertext ct = (c0, c1) that can be decrypted by the original users 1, ..., N participating in the computation, the trusted third party computes a new ciphertext nct that can be decrypted by the original users 1, ..., N, N+1 participating in the computation; updates the new ciphertext to nct; and updates the new joint public key pk.

[0119] The new ciphertext NCT is:

[0120]

[0121] The new public key PK is:

[0122]

[0123] The interaction process between users and trusted third parties is as follows: Figure 2 As shown.

[0124] Example

[0125] For the requirement of three-way homomorphic operations, i.e., N=3, parameters n=2048 and q=2 can be used. 62 , For example, here This represents a discrete Gaussian sample with a standard deviation of 3.19 and an expected value of 0, and a safety level of λ = 128.

[0126] The trusted third party first calls a pseudo-random string generation algorithm to randomly select n seeds to generate n 62-bit random strings, denoted as a0, ..., a0. n-1 ,but Then send 'a' to N users.

[0127] After receiving a, each original user i participating in the computation randomly selects a binary private key. That is, each coefficient of the private key is selected from 0 and 1. Then the public key pk is calculated. i =(b i ,a)=([-(a·s i +e i )] q a), and pk i Send to a trusted third party.

[0128] A trusted third party sums the first components of all users' public keys to obtain the joint public key. The pk is then sent to all original users who participated in the calculation.

[0129] Each original user i participating in the computation for plaintext Randomly select u i ∈R2 and error perturbation e i,1 ,e i,2 ←X n Where X is a discrete Gaussian distribution over integers, the ciphertext is obtained.

[0130] The following requires each participating original user i to use a single encryption method with s. i For u i Encrypt it.

[0131] From the discrete Gaussian distribution χ n Choose polynomial r and perturbation Randomly select polynomial d1∈R q ,calculate From the discrete Gaussian distribution χ n Select perturbation calculate Generate ciphertext D i =(d i,0 |d i,1 |d i,2 ) as an extended component and as public data.

[0132] For the newly joined user N+1, the private key sk is generated using the public string 'a'. N+1 =s N+1 PK with public key N+1 =(b N+1 ,a)=([-as N+1 +e N+1 ] q ,a).

[0133] For all original users i involved in the computation, 1≤i≤N, user N+1 utilizes b N+1 respectively with d i,0 and d i,1 Multiply to get K i =(k i,0 |k i,1 )=.[b N+1 d i,0 ] q |[b N+1 d i,1 ] q / and send it to the original user i who participated in the calculation.

[0134] For all original users i participating in the calculation, 1≤i≤N, user N+1 randomly selects a perturbation e. N+1 ←χ n Calculate L i,1 =[d i,2 s N+1 +2e N+1 ] q and all k i,2 PK with public key N+1 Send to a trusted third party.

[0135] Each original user i participating in the calculation receives K i =(k i,0 |k i,1 After that, calculate L. i,0 =[k i,0 +k i,1 s i ] q and L i,0 Send to a trusted third party.

[0136] Trusted third-party computation: For any ciphertext (including ciphertext from each user or ciphertext that has already undergone homomorphic computation) ct = (c0, c1), compute... Then update the ciphertext to nct, and the joint public key is... And send it to all users who participated in the calculation.

[0137] When no new users are added, maintain the original encryption state and do not perform any processing.

[0138] Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make possible changes and modifications to the technical solutions of the present invention by utilizing the methods and techniques disclosed above without departing from the spirit and scope of the present invention. Therefore, any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solutions of the present invention shall fall within the protection scope of the technical solutions of the present invention.

Claims

1. A multi-key fully homomorphic encryption method supporting multiple hops, characterized in that: include: A trusted third party selects the public string 'a' as the user's public parameter. Send the public parameters to all original users who participated in the calculation; Assume the number of original users participating in the computation is N; for 1≤i≤N, each original user i randomly selects a private key sk. i From the n-ary discrete Gaussian distribution χ n Select error polynomial e i ←χ n Calculate the first component b of the public key i Using the public string 'a' as the second component of the public key, we obtain the public key 'pk'. i Each original user i participating in the calculation will use the first component b. i Send to a trusted third party; Trusted third-party computation of federated public key pk; The underlying algorithm is chosen to be BFV-type multi-key homomorphic encryption; each participating user i selects the plaintext m to be encrypted. i Randomly select polynomial u i ∈R2, from the n-ary discrete Gaussian distribution χ n Select error polynomial e i,1 ,e i,2 ←χ n ; e i,1 The first error polynomial chosen for the original user i participating in the calculation, e i,2 The second error polynomial is selected for the original user i participating in the computation; the ciphertext ct is computed. i ; In scenarios supporting multi-hop, multi-key, fully homomorphic encryption, each participating original user i follows an n-ary discrete Gaussian distribution χ. n The temporary polynomial r of the original user i selected to participate in the computation i and the first error component of the original user i involved in the calculation Randomly select polynomial d i,1 ∈R q ; Calculate polynomial d i,0 Each original user i participating in the calculation is derived from an n-ary discrete Gaussian distribution χ. n Select the second error component of the original user i to participate in the calculation. Calculate polynomial d i,2 ; Generate ciphertext D i =(d i,0 |d i,1 |d i,2 ), as an extended component, and as public data; When a new user with sequence number N+1 joins, the private key sk is generated using the public string 'a'. N+1 =s N+1 PK with public key N+1 =(b N+1 ,a)=([-a·s N+1 +e N+1 ] q ,a); For any original user i participating in the computation, 1≤i≤N, user N+1 uses b N+1 With polynomial d respectively i,0 and polynomial d i,1 Multiply to calculate the update variable K i and K i It is sent to the original user i who participated in the calculation; Each original user i received K i =(k i,0 |k i,1 After that, the original user i who participated in the calculation actively updated component L. i,0 =[k i,0 +k i,1 s i ] q and L i,0 Send to a trusted third party; For any original user i participating in the computation, user N+1 randomly selects the error polynomial. The original user i participating in the calculation passively updates component L. i,1 and all L i,1 PK with public key N+1 Send to a trusted third party; For any ciphertext ct = (c0, c1) that can be decrypted by the original users 1, ..., N participating in the computation, the trusted third party computes a new ciphertext nct that can be decrypted by users 1, ..., N, N+1; updates the new ciphertext to nct; and updates the new joint public key pk. When no new users are added, maintain the original encryption state and do not perform any processing.

2. The multi-key fully homomorphic encryption method supporting multiple hops according to claim 1, characterized in that: The public string 'a' is: In the formula, q represents the modulus; Represents the set of integers modulo q; R q Represents a polynomial ring with modulus q; n represents the polynomial ring R. q dimensionality; Any a = a0 + a1x + ... + a n-1 x n-1 ∈R q Represent a polynomial; all coefficients i = 0, 1, ..., n-1; where, Represents the real number Rounding down.

3. The multi-key fully homomorphic encryption method supporting multiple hops according to claim 2, characterized in that: The private key sk i for: In the formula, s i This represents the private key of user i; Represents a polynomial ring with a modulus of 2; Represent the binary set {0,1}; First component b i for: b i =[-a·s i +e i ] q The public key pk i for: pk i =(b i ,a)=([-as i +e i ] q ,a)。 4. The multi-key fully homomorphic encryption method supporting multiple hops according to claim 3, characterized in that: The trusted third party regarding pk i All b i Add them together to get the joint public key pk:

5. A multi-key fully homomorphic encryption method supporting multiple hops according to claim 3, characterized in that: The plaintext m i for: In the formula, t is the modulus of the plaintext; R t Represents a polynomial ring with modulus t; Let represent the set of integers modulo t.

6. A multi-key fully homomorphic encryption method supporting multiple hops according to claim 5, characterized in that: The encrypted ct i for: ct i =(ct i [0],ct i [1]) Among them, ct i [0] is: In the formula, Δ represents the scaling factor. Among them, ct i [1] is: ct i [1]=[a·u i +e i,2 ] q 。 7. A multi-key fully homomorphic encryption method supporting multiple hops according to claim 6, characterized in that: The polynomial d i,0 for: The polynomial d i,2 for:

8. A multi-key fully homomorphic encryption method supporting multiple hops according to claim 7, characterized in that: The K i The calculation method is as follows: K i =(k i,0 |k i,1 ) In the formula, k i,0 For K i The first polynomial; k i,0 =[b N+1 ·d i,0 ] q ; k i,1 For K i The second polynomial; k i,1 =[b N+1 ·d i,1 ] q .

9. A multi-key fully homomorphic encryption method supporting multiple hops according to claim 8, characterized in that: The L i,1 The calculation method is as follows:

10. A multi-key fully homomorphic encryption method supporting multiple hops according to claim 9, characterized in that: The new ciphertext NCT is: The new public key PK is:

Images