On-cloud semi-homomorphic encryption method capable of resisting private key tracking

Abstract

The invention discloses an on-cloud semi-homomorphic encryption method capable of resisting private key tracking, which comprises the following steps of: S1, generating a blind identity based on the real identity of a data user, and performing identity de-association processing; s2, the attribute authority generates a binding key pair based on the blind identity and returns the binding key pair; s3, the data user discloses a real identity and a public key to the data owner; s4, the data owner encrypts the plaintext after verifying the public key to form a ciphertext set; s5, uploading the ciphertext set to a cloud service provider, and performing classified storage; s6, the cloud service provider receives the analysis request and performs homomorphic addition aggregation on the ciphertext set to generate an aggregated ciphertext; and S7, the data user uses the private key to decrypt the aggregated ciphertext, and a plaintext analysis result is recovered. According to the method, the identity privacy of the user is protected while encrypted data analysis is realized, and the method has the characteristics of untraceability and lightweight deployment.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing security, and in particular to a cloud-based semi-homomorphic encryption method that is resistant to private key tracing. Background Art

[0002] In traditional cloud computing environments, an increasing number of solutions are adopting encrypted storage and computing to protect user data privacy. However, while most homomorphic encryption methods theoretically support ciphertext computing, they suffer from widespread practical issues such as low computational efficiency, fixed key structures, and the vulnerability of user identities to linking. These issues make it difficult to meet the real-world needs of balancing data sharing and computational privacy.

[0003] Some existing encryption mechanisms attempt to implement addition or multiplication without decryption, but they often rely on key generation mechanisms tied to fixed identities. This means that if the key is leaked, the user's true identity can be tracked or restored, making identity decoupling difficult. Furthermore, traditional methods fail to adequately protect identity information during key management, creating the risk of identity decoupling exploited during key authorization.

[0004] At the same time, while some solutions delegate encryption computations to cloud service providers, they still require them to participate in key distribution or possess some private key information, violating the design principle of data invisibility and increasing the system's attack surface and trust costs. The lack of a flexible and efficient identity mechanism during the upload and classified storage of encrypted data also limits the application of large-scale distributed computing platforms.

[0005] To this end, there is an urgent need for an encryption method that can simultaneously meet the requirements of ciphertext addition calculation, identity de-association, key anti-tracing and cloud computing executability, so as to break through the bottlenecks of existing technologies in security and practicality.

[0006] Therefore, how to provide a cloud-based semi-homomorphic encryption method that is resistant to private key tracing is an urgent problem that those skilled in the art need to solve. Summary of the Invention

[0007] One purpose of the present invention is to propose a cloud-based semi-homomorphic encryption method that is resistant to private key tracing. It adopts a blinded identity generation mechanism, a ring-structured key binding algorithm and an additive homomorphic computing strategy to achieve the authorization, storage and aggregate computing of ciphertext data without revealing the real identity. It has the advantages of strong identity irreversibility, untraceable keys, and safe and available cloud computing. It is suitable for data security computing and privacy protection scenarios under multi-party collaboration.

[0008] A cloud-based semi-homomorphic encryption method that resists private key tracing according to an embodiment of the present invention includes the following steps:

[0009] S1. Define the four entities in this method: Attribute Authority (AA), Data Owner (DO), Data User (DU), and Cloud Service Provider (CSP), where:

[0010] AA: The AA is an anonymous, semi-trusted key management center responsible for the entire key lifecycle, such as generating public and private keys for users and revoking certificates. DO: The DO owns the data, encrypts the data using the DU's public key and identity, and uploads the encrypted data to the CSP. DU: The DU publishes its public key and identity, obtains ciphertext from the CSP, and decrypts it using its private key. CSP: The CSP is honest and curious and is responsible for storing ciphertext. The DO uploads the ciphertext to the CSP and retrieves it from the CSP when the user needs it.

[0011] Based on the real identity of the data user, a hash identity is constructed, and the identity string is generated into a blinded identity through a one-way hash function. The blinded identity is then submitted to the attribute authority together with the public security parameters.

[0012] S2. Based on the blinded identity and public security parameters, the attribute authority receives the data, performs a polynomial sampling process, generates a key pair bound to the identity on the ring structure, and returns the key information containing the public key and private key to the data user;

[0013] S3. The data user receives and stores the key information returned by the attribute authority, and discloses the real identity and the corresponding public key to the data owner for encryption authorization;

[0014] S4. Based on the public identity and public key, the data owner receives the data and verifies the legitimacy of the public key structure. If the verification passes, the plaintext data is encrypted based on the received identity and public key to generate a ciphertext set.

[0015] S5. Based on the generated ciphertext set, the data owner uploads it to the cloud service provider, which then categorizes and stores the ciphertext according to the identity identifier.

[0016] S6. Based on the data user, a data computation request is initiated to the cloud service provider under a specified identity. The cloud service provider performs an additive aggregation operation on the target ciphertext set based on the additive homomorphic mechanism to obtain an aggregated ciphertext.

[0017] S7. The cloud service provider returns the aggregated ciphertext to the data user. The data user decrypts the aggregated ciphertext using the private key bound to the blinded identity to obtain the plaintext data corresponding to the analysis result.

[0018] Optionally, step S1 specifically includes:

[0019] S11. The data user obtains his / her real identity identifier, which is an identity string consisting of n characters, denoted as id;

[0020] S12. The data user invokes a cryptographically secure pseudo-random number generator (CSPRNG) to generate a one-time random perturbation factor r. The CSPRNG uses a high entropy source provided by the operating system, such as / dev / random or a deterministic random bit generation algorithm based on NIST SP800-90A, to ensure that the generated result is highly unpredictable and replay-resistant.

[0021] S13. Based on the real identity, the data user performs a one-way hash function calculation on it to obtain an intermediate identity representation H(ID):

[0022] H(ID)=h(id);

[0023] And perform bitwise XOR operation with the disturbance factor r to generate the blinded identity ID * , its calculation expression is:

[0024] ID * =H(ID)⊕r;

[0025] Where H is a secure hash function (such as SHA3), ⊕ represents a bitwise exclusive-OR operation, and the resulting blinded identity is a random string of fixed length;

[0026] Formula source:

[0027] The core idea of ​​the blinded identity generation method is derived from the theory of identity obfuscation and irreversible hash mapping in cryptography. This theory is widely used in fields such as anonymous identity authentication and blind signatures. The present invention does not make any mathematical changes to the formula structure itself, but instead applies it to new key generation scenarios, functionally replacing the direct participation of real identities.

[0028] S14. The data user constructs a key request structure with the generated blinded identity and the public security parameters, and sends it to the attribute authority through a secure channel for subsequent key generation processing.

[0029] S15. The perturbation factor r is temporarily stored locally in a secure memory structure and is only used during the generation of the blinded identity. It is destroyed immediately after generation and is not transmitted or shared with the attribute authority or other entities to ensure the irreversibility of the blinded identity.

[0030] S16. Even if the same data user requests the key multiple times, the perturbation factor generated each time is different, and the resulting blinded identities are information-theoretically independent of each other. The attribute authority cannot infer that they belong to the same data user based on the similarity between the blinded identities, thereby achieving the goal of resisting private key tracking.

[0031] Optionally, step S2 specifically includes:

[0032] S21. The attribute authority receives the blinded identity ID submitted by the data user * and public security parameters, and initialize the key generation process;

[0033] S22. In order to achieve effective binding of blinded identity to key structure and enhance the identity dependence of perturbation parameters in public key, the present invention proposes a perturbation seed polynomial construction mechanism based on blinded identity. Specifically, the blinded identity is a set of binary bit strings of fixed length, which are generated and saved locally by the data user. The bit string is divided into several equal-length sub-segments by bit slicing. Each sub-segment is represented as a binary vector, which is converted by the integer mapping function to generate a set of integer coefficients in the sense of modulo q. These coefficients will be used as polynomials in the polynomial ring in turn. The coefficients of the power terms in constitute the perturbation seed polynomial.

[0034] The perturbation seed polynomial is constructed as follows: the blinded identity is considered as a bit string sequence, assuming its total length is l bits, divided into n sub-segments, each sub-segment contains l / n bits. Each sub-segment is converted to an integer value c under the modulo q through a fixed binary to integer mapping function. i , and then the coefficients of the i-th order terms of the corresponding polynomials are sequentially generated to generate the following perturbation seed polynomials:

[0035] The i-th coefficient of the polynomial is the integer c obtained from the i-th subsegment of the blinded identity i , the corresponding polynomial is "from c0, c1, ..., c n-1 The polynomial expression of the coefficient is c0+c1x+c2x 2 +…+c n-1 x n-1 , defined over the polynomial ring superior".

[0036] Based on the perturbed seed polynomial, the attribute authority generates the noise polynomial e in the key through a built-in pseudo-random number generator and Gaussian sampler, and simultaneously samples the private key component s. Both are used as functions of the blinded identity mapping structure and are further used to generate parameters in the key pair that are implicitly bound to the identity.

[0037] S23, attribute authority randomly samples the following encryption parameters:

[0038] Public parameter polynomial The private key component polynomial s~χ, where χ is a discrete Gaussian distribution; the perturbation polynomial t~χ is used to generate the second perturbation term in the public key; then, the attribute authority constructs the first component b of the public key in the key pair, which is calculated as follows:

[0039] b=-(a·s+c·s+t·e)mod q;

[0040] in:

[0041] a: The system global random polynomial (or vector) used in the public key generation process is a public parameter; s: A secret polynomial randomly sampled from a Gaussian distribution or a uniform distribution in a ring structure or vector space, whose generation is independent of identity; c: An identity perturbation polynomial generated through an auxiliary perturbation path based on a blinded identity, which is used to enhance the unpredictability and anti-reconstruction properties of the key structure; t: The public plaintext modulus, which is used to map the plaintext to the scaling factor in the ciphertext domain, controls the relative ratio between the plaintext embedded term and the noise, thereby ensuring the correctness and solvability of the ciphertext under additive homomorphic operations. Appropriate selection of t can effectively improve the noise tolerance of the system and prevent decryption failures; e: The noise polynomial derived from the blinded identity; q: The modulus, defined in the polynomial ring upper bound on;

[0042] Formula source:

[0043] This formula originates from the RLWE-based (Ring Learning Congruence) encryption system in lattice cryptography. Its theoretical basis is: modular calculation on polynomial rings,

[0044] Original formula form (from the encryption system designed by Regev, Lyubashevsky and others):

[0045] b=-(a·s+e)mod q;

[0046] in:

[0047] a: a public randomly generated polynomial; s: private key polynomial sampled from a discrete Gaussian distribution; e: perturbation polynomial sampled from a discrete Gaussian distribution; that is, only one perturbation and one private key are introduced;

[0048] The present invention has made the following changes and engineering adaptations on this basis:

[0049] Two perturbation components, c·s and t·e, are introduced. This structure breaks through the traditional design of a single private key term and uses a double-multiplication structure to strengthen identity binding, significantly improving the ability to resist private key correlation attacks. The explicit inclusion of the identity-related error term c·s in the public key construction is a key innovation that distinguishes it from traditional schemes.

[0050] The original formula is used for general encryption. This invention uses its structure directly for the generation of "identity-bound public key", making it not only a part of the encryption algorithm, but also a part of the key management and access control strategy.

[0051] S24, the formula is designed to blind the identity ID * The key structure is only indirectly embedded with the error distribution characteristics, and any third party (including the attribute authority) cannot recover the ID from the public key parameter b. * , thereby ensuring the privacy of data user identity and the untraceability of keys;

[0052] S25. Finally, the attribute authority represents the generated key pair as a structured tuple: public key pk = (a, b); private key in The blinded identity tag is used for decryption binding, and the key pair is sent to the data user, who then performs decryption binding locally.

[0053] Optionally, step S3 specifically includes:

[0054] S31. The data user receives key information including a public key and a private key from the attribute authority, wherein the public key structure includes a two-tuple consisting of a public parameter and a perturbation factor;

[0055] S32. The data user discloses his / her real identity and corresponding public key to the designated data owner through network broadcasting, ensuring that the data owner obtains the identity and key matching relationship before authorizing encryption;

[0056] S33. To ensure identity consistency and legitimacy, data users shall maintain a consistent binding relationship between the real identity identifier and the blinded identity used when generating it during the disclosure process, and shall not modify the perturbation components and parameter combinations contained in the identity structure or public key structure.

[0057] Optionally, step S4 specifically includes:

[0058] S41. The data owner receives the real identity and corresponding public key information disclosed by the data user, extracts the parameter components in the public key structure, and performs a validity check on the parameter range, ring structure format, and identity consistency identifier.

[0059] S42. After verification, the data owner randomly samples a set of encryption noise parameters for the plaintext data to be encrypted, including a temporary perturbation polynomial and a random weighting factor;

[0060] S43. Based on the received public key and the sampled noise parameter, the data owner performs the encryption operation under the ring structure and calculates multiple components of the ciphertext respectively. The ciphertext structure consists of the following three parts:

[0061] The first component is the sum of the plaintext embedded term and the perturbation term; the second component is the product of the public key parameter and the noise sampling term; the third component is the temporary perturbation parameter used in encryption;

[0062] S44. The above three components are combined to form an encrypted ciphertext structure as an item in the ciphertext set. After completing the encryption of each plaintext data, the data owner adds the corresponding generated ciphertext item to the ciphertext set to form a complete ciphertext set consisting of multiple structured ciphertexts for subsequent upload to the cloud service provider for processing.

[0063] Optionally, step S5 specifically includes:

[0064] S51. The data owner uploads the generated ciphertext set to the cloud service provider via network transmission, marking the corresponding data user's real identity during the upload process so that the cloud service provider can perform data classification;

[0065] S52. After receiving the ciphertext set, the cloud service provider indexes and manages the ciphertext items in the ciphertext set according to the identity identification fields carried therein, and establishes a ciphertext index structure corresponding to the identity.

[0066] S53. The cloud service provider does not perform any decryption operations during the storage process. The ciphertext is always encrypted to ensure the integrity and privacy of the ciphertext in the storage layer.

[0067] Optionally, step S6 specifically includes:

[0068] S61: The data user initiates a data request to the cloud service provider. The request includes a target real identity and a corresponding computing task identifier, and specifies to perform an additive aggregation operation on the ciphertext set under the identity identifier.

[0069] S62. The cloud service provider searches the stored ciphertext index structure for a ciphertext set that matches the specified identity identifier based on the data user's request, and extracts the encrypted components of all ciphertext items in the set.

[0070] S63. The cloud service provider performs corresponding addition operations on the extracted ciphertext components one by one without decryption based on a public additive homomorphic mechanism to obtain an aggregated ciphertext that remains encrypted. The aggregation process includes summing each component in the ciphertext structure to form an output ciphertext with a consistent structure.

[0071] S64. The cloud service provider encapsulates the generated aggregated ciphertext into a ciphertext calculation result and prepares to return it to the data user who initiated the request.

[0072] Optionally, step S7 specifically includes:

[0073] S71. After completing the calculation of the aggregated ciphertext, the cloud service provider encapsulates the encrypted aggregated ciphertext into a ciphertext response structure and sends it to the data user who initiated the request.

[0074] S72. After receiving the aggregated ciphertext, the data user invokes the private key bound to their blinded identity and performs a decryption process based on the identity tag field in the key structure, ensuring that only the original data user can recover the corresponding plaintext result. The private key is an identity-bound private key structure generated by the attribute authority based on the blinded identity.

[0075] S73. The data user recovers the corresponding plaintext statistical result based on the polynomial operation relationship between each component in the ciphertext structure and the matching parameters in the private key. The decryption operation is performed under the modular ring structure to ensure that the decryption result is correctly restored only when the identity matches and the key is intact.

[0076] S74. The data user obtains the aggregated plaintext output result, completes the analysis task, and does not disclose any intermediate values ​​of the plaintext or key to the cloud service provider during the entire decryption process.

[0077] The beneficial effects of the present invention are:

[0078] First, by introducing a blinded identity generation mechanism, the present invention breaks the limitation of direct binding of real identity and key in the traditional key system, effectively preventing attribute authorities from inferring user identity through key information, and realizing the untraceability and privacy isolation of identity information.

[0079] Secondly, the present invention is based on a ring structure key generation strategy and a polynomial sampling mechanism, which enables the key generation process to have structural complexity and security randomness, improves the key's ability to resist attacks during the encryption calculation process, and enhances the overall security protection level of the system.

[0080] In addition, the present invention designs an additive homomorphic computing process that can be completed in an encrypted state, allowing cloud service providers to complete ciphertext aggregation operations without decryption, ensuring the confidentiality and integrity of data throughout the entire transmission and computing process, and having good scalability and practicality. BRIEF DESCRIPTION OF THE DRAWINGS

[0081] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0082] Figure 1 This is the overall flow chart of the cloud-based semi-homomorphic encryption method that is resistant to private key tracing proposed by the present invention;

[0083] Figure 2 Schematic diagram of a blind identity generation mechanism for achieving anti-identity tracking in the present invention;

[0084] Figure 3 This is a structural diagram of the public key generation mechanism combined with blinded identity input in the present invention;

[0085] Figure 4 Schematic diagram of the system model of the present invention;

[0086] Figure 5 Schematic diagram of a system corresponding to an embodiment of the present invention. DETAILED DESCRIPTION

[0087] The present invention will now be described in further detail with reference to the accompanying drawings, which are simplified schematic diagrams that illustrate the basic structure of the present invention in a schematic manner.

[0088] refer to Figure 1-3 A cloud-based semi-homomorphic encryption method that resists private key tracing includes the following steps:

[0089] S1. Based on the real identity of the data user, a hash identity is constructed. The identity string is passed through a one-way hash function to generate a blinded identity. The blinded identity is then submitted to the attribute authority along with the public security parameters.

[0090] S2. Based on the blinded identity and public security parameters, the attribute authority receives the data, performs a polynomial sampling process, generates a key pair bound to the identity on the ring structure, and returns the key information containing the public key and private key to the data user;

[0091] S3. The data user receives and stores the key information returned by the attribute authority, and discloses the real identity and the corresponding public key to the data owner for encryption authorization;

[0092] S4. Based on the public identity and public key, the data owner receives the data and verifies the legitimacy of the public key structure. If the verification passes, the plaintext data is encrypted based on the received identity and public key to generate a ciphertext set.

[0093] S5. Based on the generated ciphertext set, the data owner uploads it to the cloud service provider, which then categorizes and stores the ciphertext according to the identity identifier.

[0094] S6. Based on the data user, a data computation request is initiated to the cloud service provider under a specified identity. The cloud service provider performs an additive aggregation operation on the target ciphertext set based on the additive homomorphic mechanism to obtain an aggregated ciphertext.

[0095] S7. The cloud service provider returns the aggregated ciphertext to the data user. The data user decrypts the aggregated ciphertext using the private key bound to the blinded identity to obtain the plaintext data corresponding to the analysis result.

[0096] This system is collaboratively participated by four core entities, Figure 4 : The attribute authority (AA), data user (DU), data owner (DO) and cloud service provider (CSP) complete the entire encryption, storage and calculation process according to the following steps:

[0097] (1) The data user DU first constructs a blinded identity h(id) based on its real identity ID and submits it to the attribute authority AA together with the public security parameter λ. The construction process of the blinded identity includes hashing the real identity and introducing a random perturbation factor to prevent the leakage of identity association;

[0098] (2) After receiving h(id) and λ, the attribute authority AA constructs a key pair based on the ring structure key generation mechanism, including the private key sk_HID bound to the blinded identity and the corresponding public key pk, and sends (pk, sk_HID) back to the DU. This key pair is only bound to the blinded identity, and the AA cannot reversely deduce the true identity from it, ensuring the anti-traceability of the key generation process;

[0099] (3) After receiving the key pair from AA, the data user DU discloses its real identity ID and the corresponding public key pk to the data owner DO. The public key will be used as the key parameter for encrypting the data, while the real identity is used to identify the data owner;

[0100] (4) After receiving the pk, the data owner DO verifies its legitimacy to ensure that its source is authentic and its structure is valid, thus preventing man-in-the-middle attacks or identity forgery;

[0101] (5) After verification, DO uses pk to homomorphically encrypt the plaintext data m, generate the ciphertext ct, and upload the ciphertext to the cloud service provider CSP for storage, while marking the relevant ID for subsequent retrieval;

[0102] (6) When the DU needs to initiate a data analysis task, it submits a data request containing an ID to the CSP. The CSP retrieves the corresponding ciphertext ct based on the storage index structure and performs aggregation operations on the ciphertext based on the additive homomorphic algorithm. Statistical analysis can be completed without decryption. The CSP returns the aggregated encrypted result ct_sum to the DU. The DU uses the locally stored private key sk_HID to decrypt ct_sum and restore the plaintext representation of the encrypted analysis result.

[0103] Through the above steps, all participating entities collaborate to complete the anonymous encrypted storage and cloud computing tasks of the data, while ensuring that the real identity cannot be reversed by the attribute authority, data owner or cloud service provider during the key generation and encryption process, effectively achieving the goal of resisting private key tracking.

[0104] In this embodiment, step S1 specifically includes:

[0105] S11. The data user obtains his / her real identity identifier, which is an identity string consisting of n characters, denoted as id;

[0106] S12. The data user invokes a cryptographically secure pseudo-random number generator (CSPRNG) to generate a one-time random perturbation factor r. The CSPRNG uses a high entropy source provided by the operating system, such as / dev / random or a deterministic random bit generation algorithm based on NIST SP800-90A, to ensure that the generated result is highly unpredictable and replay-resistant.

[0107] S13. Based on the real identity, the data user performs a one-way hash function calculation on it to obtain an intermediate identity representation H(ID):

[0108] H(ID)=h(id);

[0109] And perform bitwise XOR operation with the disturbance factor r to generate the blinded identity ID * , its calculation expression is:

[0110] ID * =H(ID)⊕r;

[0111] Where H is a secure hash function (such as SHA3), ⊕ represents a bitwise exclusive-OR operation, and the resulting blinded identity is a random string of fixed length;

[0112] Formula source:

[0113] The core idea of ​​the blinded identity generation method is derived from the theory of identity obfuscation and irreversible hash mapping in cryptography. This theory is widely used in fields such as anonymous identity authentication and blind signatures. The present invention does not make any mathematical changes to the formula structure itself, but instead applies it to new key generation scenarios, functionally replacing the direct participation of real identities.

[0114] S14. The data user constructs a key request structure with the generated blinded identity and the public security parameters, and sends it to the attribute authority through a secure channel for subsequent key generation processing.

[0115] S15. The perturbation factor r is temporarily stored locally in a secure memory structure and is only used during the generation of the blinded identity. It is destroyed immediately after generation and is not transmitted or shared with the attribute authority or other entities to ensure the irreversibility of the blinded identity.

[0116] S16. Even if the same data user requests the key multiple times, the perturbation factor generated each time is different, and the resulting blinded identities are information-theoretically independent of each other. The attribute authority cannot infer that they belong to the same data user based on the similarity between the blinded identities, thereby achieving the goal of resisting private key tracking.

[0117] This step innovatively proposes a blinded identity construction process. By introducing perturbation randomness into the one-way hash function, it ensures that the hash output has anti-collision and anti-tracing capabilities, and combines the identity string with the perturbation factor to generate a fixed-length blinded identity, effectively preventing attribute authorities or other entities from inferring the user's true identity, and providing an identity anonymity foundation for subsequent key binding.

[0118] In this embodiment, step S2 specifically includes:

[0119] S21. The attribute authority receives the blinded identity ID submitted by the data user * and public security parameters, and initialize the key generation process;

[0120] S22. In order to achieve effective binding of blinded identity to key structure and enhance the identity dependence of perturbation parameters in public key, the present invention proposes a perturbation seed polynomial construction mechanism based on blinded identity. Specifically, the blinded identity is a set of binary bit strings of fixed length, which are generated and saved locally by the data user. The bit string is divided into several equal-length sub-segments by bit slicing. Each sub-segment is represented as a binary vector, which is converted by the integer mapping function to generate a set of integer coefficients in the sense of modulo q. These coefficients will be used as polynomials in the polynomial ring in turn. The coefficients of the power terms in constitute the perturbation seed polynomial.

[0121] The perturbation seed polynomial is constructed as follows: the blinded identity is considered as a bit string sequence, assuming its total length is l bits, divided into n sub-segments, each sub-segment contains l / n bits. Each sub-segment is converted to an integer value c under the modulo q through a fixed binary to integer mapping function. i , and then the coefficients of the i-th order terms of the corresponding polynomials are sequentially generated to generate the following perturbation seed polynomials:

[0122] The i-th coefficient of the polynomial is the integer c obtained from the i-th subsegment of the blinded identity i , the corresponding polynomial is "from c0, c1, ..., c n-1 The polynomial expression of the coefficient is c0+c1x+c2x 2 +…+c n-1 x n-1 , defined over the polynomial ring superior".

[0123] Based on the perturbed seed polynomial, the attribute authority generates the noise polynomial e in the key through a built-in pseudo-random number generator and Gaussian sampler, and simultaneously samples the private key component s. Both are used as functions of the blinded identity mapping structure and are further used to generate parameters in the key pair that are implicitly bound to the identity.

[0124] S23, attribute authority randomly samples the following encryption parameters:

[0125] Public parameter polynomial The private key component polynomial s~χ, where χ is a discrete Gaussian distribution; the perturbation polynomial t~χ is used to generate the second perturbation term in the public key; then, the attribute authority constructs the first component b of the public key in the key pair, which is calculated as follows:

[0126] b=-(a·s+c·s+t·e)mod q;

[0127] in:

[0128] a: The system global random polynomial (or vector) used in the public key generation process is a public parameter; s: A secret polynomial randomly sampled from a Gaussian distribution or a uniform distribution in a ring structure or vector space, whose generation is independent of identity; c: An identity perturbation polynomial generated through an auxiliary perturbation path based on a blinded identity, which is used to enhance the unpredictability and anti-reconstruction properties of the key structure; t: The public plaintext modulus, which is used to map the plaintext to the scaling factor in the ciphertext domain, controls the relative ratio between the plaintext embedded term and the noise, thereby ensuring the correctness and solvability of the ciphertext under additive homomorphic operations. Appropriate selection of t can effectively improve the noise tolerance of the system and prevent decryption failures; e: The noise polynomial derived from the blinded identity; q: The modulus, defined in the polynomial ring upper bound on;

[0129] Formula source:

[0130] This formula originates from the RLWE-based (Ring Learning Congruence) encryption system in lattice cryptography. Its theoretical basis is: modular calculation on polynomial rings,

[0131] Original formula form (from the encryption system designed by Regev, Lyubashevsky and others):

[0132] b=-(a·s+e)mod q;

[0133] in:

[0134] a: a public randomly generated polynomial; s: private key polynomial sampled from a discrete Gaussian distribution; e: perturbation polynomial sampled from a discrete Gaussian distribution; that is, only one perturbation and one private key are introduced;

[0135] The present invention has made the following changes and engineering adaptations on this basis:

[0136] Two perturbation components, c·s and t·e, are introduced. This structure breaks through the traditional design of a single private key term and uses a double-multiplication structure to strengthen identity binding, significantly improving the ability to resist private key correlation attacks. The explicit inclusion of the identity-related error term c·s in the public key construction is a key innovation that distinguishes it from traditional schemes.

[0137] The original formula is used for general encryption. This invention uses its structure directly for the generation of "identity-bound public key", making it not only a part of the encryption algorithm, but also a part of the key management and access control strategy.

[0138] S24, the formula is designed to blind the identity ID * The key structure is only indirectly embedded with the error distribution characteristics, and any third party (including the attribute authority) cannot recover the ID from the public key parameter b. * , thereby ensuring the privacy of data user identity and the untraceability of keys;

[0139] S25. Finally, the attribute authority represents the generated key pair as a structured tuple: public key pk = (a, b); private key in The blinded identity tag is used for decryption binding, and the key pair is sent to the data user, who then performs decryption binding locally.

[0140] This step defines in detail the mechanism by which the attribute authority performs key generation based on the blinded identity on the polynomial ring structure. It innovatively embeds the blinded identity into the public key generation process, binds the identity privacy through the error polynomial and combines the perturbation parameters to generate a multi-component public key structure, thus achieving the joint protection of key correctness and security under the premise of untraceable identity.

[0141] In this embodiment, step S3 specifically includes:

[0142] S31. The data user receives key information including a public key and a private key from the attribute authority, wherein the public key structure includes a two-tuple consisting of a public parameter and a perturbation factor;

[0143] S32. The data user discloses his / her real identity and corresponding public key to the designated data owner through network broadcasting, ensuring that the data owner obtains the identity and key matching relationship before authorizing encryption;

[0144] S33. To ensure identity consistency and legitimacy, data users shall maintain a consistent binding relationship between the real identity identifier and the blinded identity used when generating it during the disclosure process, and shall not modify the perturbation components and parameter combinations contained in the identity structure or public key structure.

[0145] This step clarifies the authorization process for data users to disclose their real identity and public key to the data owner. It innovatively designs the consistency binding logic between the real identity and the blinded identity to ensure that sensitive identity information is not exposed during the authorization process, further enhancing the privacy protection capabilities of the key distribution stage.

[0146] In this embodiment, step S4 specifically includes:

[0147] S41. The data owner receives the real identity and corresponding public key information disclosed by the data user, extracts the parameter components in the public key structure, and performs a validity check on the parameter range, ring structure format, and identity consistency identifier.

[0148] S42. After verification, the data owner randomly samples a set of encryption noise parameters for the plaintext data to be encrypted, including a temporary perturbation polynomial and a random weighting factor;

[0149] S43. Based on the received public key and the sampled noise parameter, the data owner performs the encryption operation under the ring structure and calculates multiple components of the ciphertext respectively. The ciphertext structure consists of the following three parts:

[0150] The first component is the sum of the plaintext embedded term and the perturbation term; the second component is the product of the public key parameter and the noise sampling term; the third component is the temporary perturbation parameter used in encryption;

[0151] S44. The above three components are combined to form an encrypted ciphertext structure as an item in the ciphertext set. After completing the encryption of each plaintext data, the data owner adds the corresponding generated ciphertext item to the ciphertext set to form a complete ciphertext set consisting of multiple structured ciphertexts for subsequent upload to the cloud service provider for processing.

[0152] This step proposes a specific mechanism for the data owner to encrypt plaintext data and generate a structured ciphertext set. It uses perturbation parameters and noise sampling to construct a multi-component ciphertext structure, innovatively implementing a structural hierarchical ciphertext organization method. This not only enhances the security of the ciphertext data, but also provides scalable ciphertext component support for subsequent homomorphic aggregation calculations.

[0153] In this embodiment, step S5 specifically includes:

[0154] S51. The data owner uploads the generated ciphertext set to the cloud service provider via network transmission, marking the corresponding data user's real identity during the upload process so that the cloud service provider can perform data classification;

[0155] S52. After receiving the ciphertext set, the cloud service provider indexes and manages the ciphertext items in the ciphertext set according to the identity identification fields carried therein, and establishes a ciphertext index structure corresponding to the identity.

[0156] S53. The cloud service provider does not perform any decryption operations during the storage process. The ciphertext is always encrypted to ensure the integrity and privacy of the ciphertext in the storage layer.

[0157] This step proposes a method for ciphertext indexing and classified storage based on identity identification. Cloud service providers can manage ciphertext collections without decryption. The innovative introduction of identity mapping index structure enables refined organization and access control of ciphertext, effectively improving the searchability and privacy protection of the ciphertext storage layer.

[0158] In this embodiment, step S6 specifically includes:

[0159] S61: The data user initiates a data request to the cloud service provider. The request includes a target real identity and a corresponding computing task identifier, and specifies to perform an additive aggregation operation on the ciphertext set under the identity identifier.

[0160] S62. The cloud service provider searches the stored ciphertext index structure for a ciphertext set that matches the specified identity identifier based on the data user's request, and extracts the encrypted components of all ciphertext items in the set.

[0161] S63. The cloud service provider performs corresponding addition operations on the extracted ciphertext components one by one without decryption based on a public additive homomorphic mechanism to obtain an aggregated ciphertext that remains encrypted. The aggregation process includes summing each component in the ciphertext structure to form an output ciphertext with a consistent structure.

[0162] S64. The cloud service provider encapsulates the generated aggregated ciphertext into a ciphertext calculation result and prepares to return it to the data user who initiated the request.

[0163] This step defines the operational process for cloud service providers to perform additive aggregation on ciphertext sets under the additive homomorphic mechanism. It innovatively uses addition operations without decryption to preserve the ciphertext state, achieving the coexistence of data aggregation and privacy protection, and providing a new paradigm for data analysis scenarios under secure computing.

[0164] In this embodiment, step S7 specifically includes:

[0165] S71. After completing the calculation of the aggregated ciphertext, the cloud service provider encapsulates the encrypted aggregated ciphertext into a ciphertext response structure and sends it to the data user who initiated the request.

[0166] S72. After receiving the aggregated ciphertext, the data user invokes the private key bound to their blinded identity and performs a decryption process based on the identity tag field in the key structure, ensuring that only the original data user can recover the corresponding plaintext result. The private key is an identity-bound private key structure generated by the attribute authority based on the blinded identity.

[0167] S73. The data user recovers the corresponding plaintext statistical result based on the polynomial operation relationship between each component in the ciphertext structure and the matching parameters in the private key. The decryption operation is performed under the modular ring structure to ensure that the decryption result is correctly restored only when the identity matches and the key is intact.

[0168] S74. The data user obtains the aggregated plaintext output result, completes the analysis task, and does not disclose any intermediate values ​​of the plaintext or key to the cloud service provider during the entire decryption process.

[0169] This step describes the process by which data users recover plaintext results through private key decryption after receiving aggregated ciphertext. It innovatively deconstructs the ciphertext structure design and private key parameters in a linked manner, achieving a secure and reliable decryption output process, ensuring the correctness of the analysis results and the terminal controllability of sensitive data.

[0170] Example 1:

[0171] In order to verify the feasibility of the present invention in practice, the present invention is applied to the cloud data statistics service system of a city's medical and health data center. Figure 4The system consists of four types of participants: data analysts, data providers, attribute authorities, and cloud service providers. Among them, the attribute authority is undertaken by a government regulatory node with partial trust capabilities, which is responsible for generating keys and ensuring identity anonymity. The data analyst is the Municipal Public Health Research Institute, the data provider is the 10 large hospitals in the jurisdiction, and the cloud service provider deploys the data storage and computing platform. The attribute authority is undertaken by a government regulatory node with partial trust capabilities. The scenario requirement is: Without knowing the real identity of the user, the Municipal Public Health Research Institute conducts statistical analysis on patient-specific indicator data from multiple medical institutions to evaluate the risk distribution characteristics of a chronic disease.

[0172] During the actual deployment, the Municipal Institute of Public Health, acting as the data analyst, first hashed the analyst's real-world identity using the proposed method. This hashed the identity, combined with random perturbation information, to generate an irreversible blinded identity (HID) and submitted it to the attribute authority. Based on a ring-structured encryption model, the attribute authority used the blinded identity as the identifier variable, performed key generation within a polynomial ring, and returned the corresponding key pair (pk, sk_HID) to the data analyst. To prevent identity tracking, the entire generation and transmission process did not expose any plaintext identity information.

[0173] The data analysis provider issued a public key, pk, and a real-world identity for authorization to 10 hospitals. The hospitals used this public key to encrypt patient data, including blood sugar levels, blood pressure, and BMI, with a sampling frequency of once per minute, covering approximately 8,000 patients. Each hospital uploaded approximately 40MB of encrypted data to the cloud service platform daily. The cloud platform did not decrypt or categorize the received data, but instead indexed the encrypted data based on the identification fields and aggregated the ciphertexts upon request. Each analysis request aggregated approximately 100,000 ciphertexts, with the additive homomorphic aggregation operation completing in under 1.5 seconds. The aggregated ciphertext remained encrypted and was returned to the analyst. The analyst then decrypted the data using the private key sk_HID to recover the statistical analysis results.

[0174] The experiment ran for four weeks, processing approximately 540 million encrypted data entries, with an average plaintext size of 32 bytes per entry. The encrypted data was not leaked or tampered with, and no information that could be used to trace identities was generated between the cloud and the endpoint. Experimental results demonstrated that while maintaining encryption accuracy at 99.9%, the mean deviation of the aggregated decryption results was kept within 0.02, meeting the requirements for high-accuracy statistical analysis. Furthermore, the system demonstrated robustness against identity leakage and private key reconstruction throughout the entire process, overcoming the challenges of insecure identity binding and inefficient cryptographic computations in traditional homomorphic encryption schemes.

[0175] The above description is only a preferred specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any technician familiar with the technical field, within the technical scope disclosed by the present invention, who makes equivalent replacements or changes based on the technical solution and inventive concept of the present invention, should be covered by the scope of protection of the present invention.

Claims

1. A cloud-based semi-homomorphic encryption method that resists private key tracing, characterized in that: The steps include: S1. Based on the real identity of the data user, a hash identity is constructed and the identity string is generated into a blinded identity through a one-way hash function; S2. Based on the blinded identity and public security parameters, the attribute authority receives the data, performs a polynomial sampling process, generates a key pair bound to the identity on the ring structure, and returns the key information containing the public key and private key to the data user; S3. The data user receives and stores the key information returned by the attribute authority, and discloses the real identity and the corresponding public key to the data owner; S4. Based on the public identity and public key, the data owner receives and encrypts the plaintext data to generate a ciphertext set; S5. Based on the generated ciphertext set, the data owner uploads it to the cloud service provider; S6. Based on the data user, a data computation request is initiated to the cloud service provider under a specified identity. The cloud service provider performs an additive aggregation operation on the target ciphertext set based on the additive homomorphic mechanism to obtain an aggregated ciphertext. S7. The cloud service provider returns the aggregated ciphertext to the data user. The data user decrypts the aggregated ciphertext using the private key bound to the blinded identity to obtain the plaintext data corresponding to the analysis result.

2. A cloud-based semi-homomorphic encryption method that resists private key tracing according to claim 1, characterized in that: The step S1 specifically includes: S11. Data users obtain their real identity; S12. Based on its own real identity, the data user executes an irreversible one-way hash function h(·) to perform a hash calculation on the identity: H(ID)=h(id); Combined with the random perturbation factor, a fixed-length blinded identity is generated, which is expressed as: ID * =H(ID)⊕r; Where H(ID) is the output of the one-way hash function, r is the random perturbation factor, and ⊕ represents the XOR operation. This structure introduces unpredictable perturbation r on the basis of traditional hashing.

3. The cloud-based semi-homomorphic encryption method for resisting private key tracing according to claim 1 is characterized in that: The step S2 specifically includes: S21. The attribute authority receives the blinded identity and public security parameters submitted by the data user and performs a key generation operation on the polynomial ring structure based on the blinded identity. S22. The attribute authority samples the error polynomial for key binding from the polynomial ring according to the blinded identity, denoted as c∈R q , where R q is the polynomial ring structure modulo q; S23. The attribute authority randomly samples encryption parameters, including the public parameter polynomial a, the private key component polynomial s, and the perturbation polynomial e, and constructs the first component of the public key in the key pair. The generation rule is: b=-(a·s+c·s+t·e)modq; Two perturbation components are introduced: c·s and t·e; where c is the identity perturbation polynomial generated based on the blinded identity via the auxiliary perturbation path; t is the public plaintext modulus, which is used as a scaling factor to map the plaintext to the ciphertext domain. S24. The public key in the key pair is represented as a tuple (b, a), and the private key is represented as a tuple (s, c), and the complete key information is sent to the data user.

4. The cloud-based semi-homomorphic encryption method for resisting private key tracing according to claim 1 is characterized in that: The step S3 specifically includes: S31. The data user receives key information including a public key and a private key from the attribute authority; S32. The data user discloses his / her real identity and corresponding public key to the designated data owner; S33. To ensure identity consistency and legitimacy, data users must maintain a consistent binding relationship between their real identity and the blinded identity used when generating it during the disclosure process.

5. The cloud-based semi-homomorphic encryption method for resisting private key tracing according to claim 1 is characterized in that: The step S4 specifically includes: S41. The data owner receives the real identity identifier and corresponding public key information disclosed by the data user, extracts the parameter components in the public key structure, and performs a legitimacy verification on them; S42. After verification, the data owner randomly samples a set of encryption noise parameters for the plaintext data to be encrypted; S43. Based on the received public key and the sampled noise parameter, the data owner performs the encryption operation under the ring structure and calculates multiple components of the ciphertext respectively. The ciphertext structure consists of the following three parts: The first component is the sum of the plaintext embedded term and the perturbation term; the second component is the product of the public key parameter and the noise sampling term; the third component is the temporary perturbation parameter used in encryption; S44. The above three components are combined to form an encrypted ciphertext structure as an item in the ciphertext set. After completing the encryption of each plaintext data, the data owner adds the corresponding generated ciphertext item to the ciphertext set to form a complete ciphertext set consisting of multiple structured ciphertexts.

6. The cloud-based semi-homomorphic encryption method for resisting private key tracing according to claim 1 is characterized in that: The step S5 specifically includes: S51. The data owner uploads the generated ciphertext set to the cloud service provider, marking the corresponding data user's real identity during the upload process; S52. After receiving the ciphertext set, the cloud service provider indexes and manages the ciphertext items in the ciphertext set according to the identity identification fields carried therein, and establishes a ciphertext index structure corresponding to the identity. S53. The cloud service provider does not perform any decryption operations during the storage process. The ciphertext is always encrypted to ensure the integrity and privacy of the ciphertext in the storage layer.

7. The cloud-based semi-homomorphic encryption method for resisting private key tracing according to claim 1 is characterized in that: The step S6 specifically includes: S61. The data user initiates a data request to the cloud service provider. The request includes a real identity of the target and specifies to perform an additive aggregation operation on the ciphertext set under the identity. S62. The cloud service provider searches the stored ciphertext index structure for a ciphertext set that matches the specified identity identifier based on the data user's request, and extracts the encrypted components of all ciphertext items in the set. S63. The cloud service provider performs corresponding addition operations on the extracted ciphertext components one by one without decryption based on a public additive homomorphic mechanism to obtain an aggregated ciphertext that remains encrypted. S64. The cloud service provider encapsulates the generated aggregated ciphertext as a ciphertext calculation result.

8. The cloud-based semi-homomorphic encryption method for resisting private key tracing according to claim 1 is characterized in that: The step S7 specifically includes: S71. After completing the calculation of the aggregated ciphertext, the cloud service provider sends the encrypted aggregated ciphertext to the data user who initiated the request. S72. After receiving the aggregated ciphertext, the data user calls the private key bound to their blinded identity and performs the decryption process based on the identity tag field in the key structure, ensuring that only the original data user can recover the corresponding plaintext result; S73. The data user recovers the corresponding plaintext statistical results based on the polynomial operation relationship between each component in the ciphertext structure and the matching parameters in the private key; S74. The data user obtains the aggregated plaintext output result.

Images