Lightweight homomorphic encrypted data transaction method supporting sparse key

Abstract

The invention discloses a lightweight homomorphic encrypted data transaction method supporting a sparse key, which is used for solving the problems of mutual mutual trust, high calculation overhead, difficulty in verification and the like in data transaction. According to the method, based on homomorphic encryption and ring learning error hypothesis, safe and efficient data transaction is realized through a sparseness threshold control mechanism and a double-label verification mechanism which are determined based on the relationship between ciphertext modulus and public key parameters. The method specifically comprises the following steps: a system initialization stage: generating public and private keys, setting encryption parameters, and determining a sparseness threshold through an experiment; the seller encrypts the data, binds the data with a verification label and uploads the data; after the buyer pays, the platform generates a sparse key according to a sparseness threshold value and issues an authorization label; and after the buyer verifies the label consistency, decrypting the ciphertext by using the sparse key to recover the original data. According to the method, secret key storage and calculation overhead is reduced while decryption correctness is guaranteed, tampering and replay attacks are effectively prevented, and the method is suitable for data transaction scenes with high privacy protection requirements and limited resources.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security and privacy protection, specifically to a lightweight data transaction method based on homomorphic encryption and supporting sparse keys, belonging to the application technology of cryptography, homomorphic encryption protocol and secure data transaction system, and suitable for data protection and access control in large-scale data transaction platforms, privacy computing, cloud computing and distributed storage environments. BACKGROUND

[0002] With the development of big data, cloud computing and distributed storage technology, data has become an important production factor and is widely used in data transaction platforms, privacy computing and joint analysis scenarios. Data transaction promotes the efficient circulation and value realization of data resources, but also faces serious security and trust problems in the transaction process: on the one hand, data sellers are worried about revealing the original data content in the transaction, causing privacy leakage or intellectual property loss; on the other hand, data buyers are reluctant to pay in advance without confirming the value of the data, which leads to mutual distrust between the two parties in the transaction, affecting the transaction efficiency and security.

[0003] To solve the above problems, the existing technology proposes a secure data transaction scheme based on homomorphic encryption. Through homomorphic encryption, data sellers can upload ciphertext to the platform without exposing the original data, and data buyers can decrypt the ciphertext after authorization, thereby ensuring the privacy and security of the data to a certain extent. This kind of scheme combines cryptography and data protection technology, and can support data storage and transmission without plaintext visibility.

[0004] However, the existing homomorphic encryption data transaction scheme still has many deficiencies. First of all, such a scheme usually requires large-scale keys and high computing resources, resulting in heavy storage and computing burden, which is difficult to adapt to resource-constrained environments and large-scale transaction scenarios. Secondly, there is a lack of reasonable optimization for different ciphertext modulus and public key parameters, which is prone to decryption failure. In addition, there is a lack of effective data and authorization consistency verification mechanism, which is difficult to effectively prevent replay attacks and data tampering. These deficiencies limit the application effect and promotion value of the existing scheme in resource-constrained environments and actual large-scale transaction platforms.

[0005] Therefore, there is an urgent need for a homomorphic encryption data transaction scheme that is lightweight, efficient and has strong verification capability to reduce key storage and computing overhead, ensure decryption correctness and data integrity, and meet the application needs of actual data transaction platforms. SUMMARY

[0006] In order to solve the above problems in the prior art, the application provides a lightweight homomorphic encryption data transaction method supporting sparse keys. The core innovation of the application is that a key sparsification mechanism based on the relationship between the ciphertext modulus and the public key parameter is proposed to determine the sparsity threshold, and key compression and lightweight decryption are realized under the premise of ensuring decryption correctness; a double-label verification mechanism is proposed to bind the data uploading process and the decryption authorization process, thereby simultaneously improving the data privacy protection, access control and data integrity verification capabilities. By reasonably designing the relationship between the ciphertext modulus and the public key parameter, using the sparse key generation mechanism and the double-label verification mechanism, efficient key compression and data integrity verification are realized while ensuring data privacy and decryption correctness. The method comprises the following steps:

[0007] Step 1) system initialization, the transaction platform selects the polynomial ring dimension, the plaintext modulus, the ciphertext modulus and the noise distribution parameter, under the premise of fixed plaintext modulus, noise distribution standard deviation and polynomial ring dimension, the relationship between the ciphertext modulus and the upper bound of the public key coefficient is obtained by experimental fitting, and the public key parameter is selected accordingly, and the sparsity threshold is further determined under the combination of the parameters; the main public key and the main key are generated, and the public key and the verification label generation seed are distributed to the data seller.

[0008] Step 2) data encryption and uploading, the data seller normalizes and quantizes the original data, encodes it into a plaintext polynomial, and encrypts it using the platform public key to obtain a ciphertext; a verification label is generated based on the data set identifier and the verification seed, and the ciphertext and the verification label are packaged into a data package and uploaded to the platform.

[0009] Step 3) payment and sparse key generation, after the data buyer pays, the platform generates a sparse key by applying a random mask to the main key according to the relationship between the ciphertext modulus and the public key coefficient obtained by experimental fitting and the sparsity threshold, and generates an authorization label, and sends the sparse key and the authorization label to the data buyer.

[0010] Step 4) verification and decryption, after receiving the data package, the sparse key and the authorization label, the data buyer first verifies whether the verification label in the data package is consistent with the authorization label; if the verification is passed, the sparse key is used to decrypt the ciphertext to restore the original data.

[0011] Further, the step 1) specifically comprises:

[0012] Step 1.1) selecting system parameters, wherein the system parameters include: the polynomial ring dimension n, the plaintext modulus t, the noise distribution standard deviation δ, the ciphertext modulus q and the upper bound of the public key coefficient C; wherein n is a power of 2 that satisfies the fast Fourier transform condition, t and δ are used to constrain the plaintext mapping and the noise size, q controls the ciphertext calculation space, and C constrains the public key coefficient amplitude, and the polynomial ring is defined as:

[0013] R q =Z q [X] / (X n +1)

[0014] Step 1.2) Under the condition of fixed n, t, and δ, explore the impact of different combinations of q and C on the decryption correctness through experiments to ensure that the infinite norm of the decryption residual noise term satisfies the following condition:

[0015]

[0016] Where Δ represents the total noise term introduced during the decryption process;

[0017] Step 1.3) With n, t, and δ fixed, for different values ​​of q, the upper bound C of the coefficient norm of the public key polynomial a satisfies ||a|| ∞ Under the constraint of ≤C, the minimum feasible C is measured experimentally for a given q. min Maximum feasible C max And take the midpoint C mid =(C min +C max ) / 2 is used as the recommended C parameter for this q;

[0018] Step 1.4) Record and fit log2q and log2C mid The empirical relationship between them, which approximately satisfies in experiments, is as follows:

[0019] log2C mid ≈k1·log2q+k2

[0020] Where k1 and k2 are coefficients obtained by least squares regression fitting, which are used to guide the subsequent platform to select an appropriate C when given q;

[0021] Step 1.5) In the determined qC mid Based on the combination, the sparsity threshold ρ under this qC was further determined through experiments. max That is, when the decryption noise satisfies Under the premise of [the above], the upper bound of the allowed proportion of randomly zeroing the master key is used to guide the sparse key generation process;

[0022] Step 1.6) Generate a public key and a private key that satisfy the selected n, q, t, δ, C, where the private key s∈R q Sampling is performed from a small-amplitude discrete distribution (such as a ternary distribution or a Gaussian distribution); the master public key (a, b) is generated according to the following formula:

[0023] b = -a·s + e mod q

[0024] Where a satisfies ||a|| ∞a random polynomial of degree ≤C, e is a noise polynomial

[0025] Step 1.7) Distribute the generated public key (a, b) and the seed SeedTag used to generate the verification tag to the data seller, and record the q-C relationship and sparsity threshold p obtained by experiment fitting on the platform side max for subsequent generation of sparse keys.

[0026] Further, the step 2) specifically comprises:

[0027] Step 2.1) The data seller receives the public key (a, b) and the seed SeedTag used to generate the verification tag distributed by the platform, and obtains the original data set D = {d1, d2,..., d L} to be encrypted;

[0028] Step 2.2) Normalizing each data sample d i in the data set D, so as to map it to the interval [0, 1], and the normalization formula is:

[0029]

[0030] where d min = min(D), d max = max(D);

[0031] Step 2.3) Quantize the normalized data sample d i norm to map it to an integer:

[0032]

[0033] where K∈Z + is a pre-set quantization amplification coefficient for amplifying decimals to integers;

[0034] Step 2.4) Encode the quantized integer sequence {d1', d2',..., d L '} into a plaintext polynomial M(X) ∈ R t , where R t = Z t [X] / (X n +1), the plaintext modulus is t, and the polynomial ring dimension is n;

[0035] Step 2.5) Sample a random polynomial r ∈ R q and two noise polynomials e1, e2 ∈ R q , the coefficients of which are independently drawn from a discrete distribution satisfying the standard deviation δ, to obtain random terms and noise terms to ensure semantic security of encryption;

[0036] Step 2.6) Calculate the ciphertext polynomial pair c = (c1, c2) according to the BFV encryption scheme:

[0037] c1= a · r + e1mod q

[0038] c2= b · r + M + e2mod q

[0039] where q is the ciphertext modulus;

[0040] Step 2.7) Generate a label Tag for verification packet The label is calculated by concatenating the data set identifier ID D and the seed SeedTag distributed by the platform, and then applying a hash function:

[0041] Tag packet = H(ID D || SeedTag)

[0042] where H(·) represents a secure hash function (e.g., SHA-256) selected by the platform;

[0043] Step 2.8) Package the complete data packet containing the verification label and the ciphertext pair as:

[0044] Packet = (Tag packet , c1, c2)

[0045] and upload the data packet to the platform for the buyer to evaluate the utility of the ciphertext data before payment.

[0046] Further, the step 3) specifically includes:

[0047] Step 3.1) After the data buyer completes the utility evaluation of the uploaded ciphertext data packet Packet = (Tag packet , c1, c2) and confirms payment, the platform authorizes the buyer to decrypt the corresponding data set ID D according to the payment result;

[0048] Step 3.2) After authorization, the platform selects the corresponding sparsity threshold ρ max based on the combined relationship of the ciphertext modulus q and the public key coefficient upper bound C obtained in step 1), and determines the zeroing proportion ρ ≤ ρ max for generating sparse keys; where ρ represents the proportion of random zeroing coefficients of the master key, used to ensure that the decryption noise satisfies:

[0049]

[0050] where Δ is the structured noise term introduced due to the sparsification of the master key;

[0051] Step 3.3) Platform for data set ID D Construct a random mask vector Mask ρ ∈{0,1} n , whose Hamming weight is about (1-ρ)·n, that is, about ρ·n positions are randomly selected to be zero, and the rest are one, which is used to control the distribution of non-zero items of the sparse key;

[0052] Step 3.4) Platform uses the mask Mask ρ and the master key s to generate a sparse key sk ID , the specific formula is:

[0053] sk ID =Mask ρ ⊙s

[0054] Where the symbol ⊙ represents the multiplication of the corresponding coefficients of the vectors, and sk ID is a polynomial with the same key dimension as the master key but with more sparse coefficients, which is used for decryption of a specific data set;

[0055] Step 3.5) To ensure that each data set corresponds to a unique sparse key, the platform maintains a sparse key allocation index table K dlst , which establishes a corresponding relationship between each data set identifier ID D and the generated sk ID , to prevent reuse or confusion;

[0056] Step 3.6) The platform calculates the authorization verification tag Tag D using the data set identifier ID auth and the seed SeedTag for verification, the formula is:

[0057] Tag auth =H(ID D ||SeedTag)

[0058] Where H(·) represents a secure hash function, which ensures that the authorization is consistent with the uploaded data;

[0059] Step 3.7) The platform encapsulates the sparse key sk ID and the corresponding authorization tag Tag auth into an authorization package and sends it to the data buyer, which is used for subsequent decryption and verification operations.

[0060] Further, the step 4) specifically includes:

[0061] Step 4.1) The data buyer receives the authorization package from the platform, which contains the sparse key sk ID and the authorization verification tag Tag authMeanwhile, the platform obtains the uploaded ciphertext packet Packet=(Tag packet , c1, c2).

[0062] Step 4.2) The buyer first verifies whether the tag Tag packet in the packet is consistent with the tag Tag auth in the authorized packet; if Tag packet ≠ Tag auth , it indicates inconsistency, and then decryption is rejected; if Tag packet = Tag auth , it indicates consistency, and then subsequent steps are continued.

[0063] Step 4.3) If the tag verification is passed, the buyer decrypts the ciphertext (c1, c2) by using the received sparse key sk ID , and calculates a decryption intermediate result:

[0064] M' = c2 + c1·sk ID mod q

[0065] wherein M' is a polynomial after decryption, containing an original message and accumulated noise.

[0066] Step 4.4) The noise term Δ in the decryption result is analyzed, wherein Δ represents the superposition of a structured error introduced by the sparse key and original noise in the decryption process, and the formula is:

[0067] M' = M + Δ

[0068] Δ = a·r·(sk ID -s) + e·r + e1 + e2·sk ID

[0069] wherein M is an original plaintext polynomial, s is a master key generated by the platform, and polynomials r, e, e1 and e2 are random terms and noise terms in the encryption process.

[0070] Step 4.5) The platform pre-selects the q-C parameter relationship and the sparsity threshold ρ max based on experiments, and reasonably selects the zero proportion ρ of the sparse key and the upper limit C of the public key coefficient, so as to ensure that the noise term Δ and under this condition, the buyer restores the original plaintext polynomial by using module reduction and rounding:

[0071]

[0072] so as to ensure that the finally restored M is consistent with the uploaded original plaintext.

[0073] Advantages of the application:

[0074] (1) The application determines the reasonable combination relationship between the ciphertext modulus and the public key coefficient in the system initialization stage through experiments, and measures the sparsity threshold, optimizes the parameter configuration from the source, reduces the key storage and calculation overhead, and improves the applicability and efficiency of homomorphic encryption in the actual data transaction scene.

[0075] (2) The sparse key generation mechanism proposed in the application generates a sparse key by applying a random mask to the master key, realizes key compression and access control while ensuring decryption correctness, and significantly reduces storage and calculation overhead.

[0076] (3) The application binds the data set identifier and the verification label by designing a double label verification mechanism, effectively prevents data tampering and replay attacks, and improves the integrity and verifiability in the data transaction process.

[0077] (4) The overall technical scheme of the application takes into account light weight, high efficiency, decryption correctness guarantee and data integrity verification, and is suitable for data transaction platforms with high privacy protection requirements and limited resources, and has good application value and promotion prospect. BRIEF DESCRIPTION OF DRAWINGS

[0078] In order to more clearly illustrate the technical solutions of the embodiments of the application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor.

[0079] Figure 1 The overall flowchart of the application supporting the lightweight homomorphic encryption data transaction method of sparse key;

[0080] Figure 2 The ciphertext data packet in the method of the application is shown in the figure;

[0081] Figure 3 The system architecture of the method of the application is shown in the figure; DETAILED DESCRIPTION

[0082] The application will be further described in detail below in combination with the drawings and specific embodiments:

[0083] Those skilled in the art can understand that, unless otherwise defined, all terms (including technical terms and scientific terms) used herein have the same meaning as generally understood by those skilled in the art to which the application belongs. It should also be understood that those terms such as definitions in general dictionaries should be understood as having meanings consistent with those in the prior art, and unless defined as here, should not be interpreted as idealized or overly formal meanings.

[0084] The present application provides a lightweight homomorphic encryption data transaction method supporting sparse keys, the overall flowchart is shown as Figure 1 The system architecture is shown as Figure 3 The method includes the following main processes:

[0085] In the system initialization phase, the encryption key is generated, the reasonable combination relationship of the ciphertext modulus and the public key coefficient is determined, and the sparsity threshold is measured, and the data verification mechanism is established. Then, the data seller normalizes, quantizes, encodes and encrypts the original data, uploads the encrypted data packet and the verification label to the transaction platform. Next, after the data buyer completes the payment, the platform generates a sparse key according to the measured parameter relationship and the sparsity threshold, and distributes the sparse key and the authorized verification label to the buyer. Finally, after the data buyer verifies that the verification label in the data packet is consistent with the authorized label, the original data is recovered by using the sparse key to decrypt the ciphertext. The method includes steps 1)~4), and each step is described as follows:

[0086] In this step, the transaction platform first selects the polynomial ring dimension, the plaintext modulus, the ciphertext modulus and the noise distribution parameters, and under the premise of fixed plaintext modulus, noise distribution standard deviation and polynomial ring dimension, the relationship between the ciphertext modulus and the upper bound of the public key coefficient is fitted by experiment, and the reasonable public key parameter combination is determined accordingly. On the basis of the selected parameter combination, the sparsity threshold is further measured to guide the generation of the subsequent sparse key. Then, the platform generates the main public key and the main key, and distributes the public key and the seed for generating the verification label to the data seller.

[0087] In this step, the data seller encodes the normalized and quantized original data into a plaintext polynomial, and then encrypts the plaintext polynomial using the public key issued by the platform to generate a ciphertext. Next, the data seller calculates the verification label based on the data set identifier and the verification label generation seed, and encapsulates the ciphertext and the verification label into a data packet and uploads it to the transaction platform. The uploaded ciphertext data packet is shown as Figure 2 .

[0088] In this step, after the data buyer completes the payment, the platform generates the corresponding sparse key by applying a random mask to the main key according to the relationship between the ciphertext modulus and the public key coefficient obtained by experiment fitting and the sparsity threshold. At the same time, the platform generates an authorized verification label and packs the sparse key and the authorized verification label together and issues them to the data buyer.

[0089] In this step, after receiving the data packet, the sparse key and the authorized verification label, the data buyer first verifies whether the verification label in the data packet is consistent with the authorized label. If the verification is passed, the data buyer uses the sparse key to decrypt the ciphertext and recovers the original data.

[0090] In the present embodiment, the step 1) specifically comprises:

[0091] Step 1.1) selecting system parameters, wherein the system parameters comprise: a polynomial ring dimension n, a plaintext modulus t, a noise distribution standard deviation δ, a ciphertext modulus q, and a public key coefficient upper bound C; wherein n is a power of 2 that satisfies the condition of fast Fourier transform, t and δ are used to constrain the plaintext mapping and the noise size, q controls the ciphertext calculation space, and C constrains the public key coefficient amplitude, and the polynomial ring is defined as:

[0092] R q =Z q [X] / (X n +1)

[0093] Step 1.2) under the condition of fixing n, t, and δ, the influence of different q and C combinations on decryption correctness is explored through experiments to ensure that the infinite norm of the decryption residual noise term satisfies the following condition:

[0094]

[0095] Where Δ is the total noise term introduced in the decryption process;

[0096] Step 1.3) under the condition of fixing n, t, and δ, for different q values, under the constraint that the coefficient norm upper limit C of the public key polynomial a satisfies ||a|| ∞ ≤C, the minimum feasible C min , the maximum feasible C max under a given q are measured through experiments in sequence, and the midpoint C mid =(C min +C max ) / 2 is taken as the recommended C parameter under the q;

[0097] Step 1.4) record and fit the empirical relationship between log2q and log2C mid , which approximately satisfies the following relationship in experiments:

[0098] log2C mid ≈k1·log2q+k2

[0099] Where k1 and k2 are coefficients obtained by least squares regression fitting, used to guide the selection of appropriate C when a given q is selected on the subsequent platform;

[0100] Step 1.5) based on the determined q-C mid combination, the sparsity threshold ρ max under the q-C is further determined through experiments, that is, the decryption noise satisfies Under the premise that the allowed master key random zeroing proportion upper bound is used to guide the sparse key generation process;

[0101] Step 1.6) generating a master public key and a master key that meet the selected n, q, t, δ, C, wherein the master key s ∈ R q Sampling from a small amplitude discrete distribution (such as a ternary distribution or a Gaussian distribution); the master public key (a, b) is generated according to the following formula:

[0102] b = -a·s + e mod q

[0103] Wherein a is a random polynomial that satisfies ||a|| ∞ ≤C, and e is a noise polynomial;

[0104] Step 1.7) distributing the generated public key (a, b) and the seed SeedTag used to generate the verification tag to the data seller, and recording the q-C relationship and the sparsity threshold ρ obtained by experiment fitting on the platform side max , for subsequent generation of sparse keys.

[0105] In this embodiment, the step 2) specifically comprises:

[0106] Step 2.1) the data seller receives the public key (a, b) and the seed SeedTag used to generate the verification tag distributed by the platform, and obtains the original data set D = {d1, d2,..., d L} to be encrypted;

[0107] Step 2.2) normalizing each data sample d i in the data set D, so as to map it to the interval [0, 1], and the normalization formula is:

[0108]

[0109] Wherein d min = min(D), d max = max(D);

[0110] Step 2.3) quantizing the normalized data sample d i norm , and mapping it to an integer:

[0111]

[0112] Wherein K ∈ Z + is a pre-set quantization amplification coefficient for amplifying a decimal to an integer;

[0113] Step 2.4) quantizing the integer sequence {d1', d2',..., d LThe plaintext polynomial M(X) e R t , where R t = Z i [X] / (X n + 1), the plaintext modulus is t, and the polynomial ring dimension is n;

[0114] Step 2.5) Sample a random polynomial r e R q and two noise polynomials e1, e2 e R q , the coefficients of which are independently drawn from a discrete distribution satisfying the standard deviation δ, to obtain random terms and noise terms for ensuring the security of the encryption semantics;

[0115] Step 2.6) Calculate the ciphertext polynomial pair c = (c1, c2) according to the BFV encryption scheme:

[0116] c1 = a r + e1 mod q

[0117] c2 = b r + M + e2 mod q

[0118] where q is the ciphertext modulus;

[0119] Step 2.7) Generate a label Tag for verification packet , which is obtained by concatenating the data set identifier ID D and the seed SeedTag distributed by the platform and then calculating it through a hash function:

[0120] Tag packet = H(ID D || SeedTag)

[0121] where H(·) represents a secure hash function (such as SHA-256) selected by the platform;

[0122] Step 2.8) Pack the complete data packet containing the verification label and the ciphertext pair as:

[0123] Packet = (Tag packet , c1, c2)

[0124] and upload the data packet to the platform for the buyer to evaluate the utility of the ciphertext data before payment.

[0125] In this embodiment, the step 3) specifically includes:

[0126] Step 3.1) After the data buyer completes the utility evaluation of the uploaded ciphertext data packet Packet = (Tag packet , c1, c2) and confirms the payment, the platform authorizes the buyer to decrypt the corresponding data set ID D according to the payment result;

[0127] Step 3.2) After authorization, the platform selects the corresponding sparsity threshold ρ based on the combination of the ciphertext modulus q obtained in step 1) and the upper bound C of the public key coefficient max , to determine the zeroing proportion ρ ≤ ρ max ; where ρ represents the proportion of random zeroing coefficients of the master key, used to ensure that the decryption noise satisfies:

[0128]

[0129] where Δ is the structured noise term introduced by the sparsified master key;

[0130] Step 3.3) The platform constructs a random mask vector Mask D for the data set ID ρ ∈{0,1} n , with a Hamming weight of approximately (1-ρ)·n, i.e., randomly selecting approximately ρ·n positions to zero and the rest to one, for controlling the distribution of non-zero terms in the sparse key;

[0131] Step 3.4) The platform generates the sparse key sk ρ by multiplying the mask Mask ID and the master key s bit by bit, with the specific formula:

[0132] sk ID =Mask ρ ⊙s

[0133] where the symbol ⊙ represents the multiplication of corresponding coefficients of vectors, and sk ID is a polynomial with the same key dimension as the master key but with more sparse coefficients, used for decryption of specific data sets;

[0134] Step 3.5) To ensure that each data set corresponds to a unique sparse key, the platform maintains a sparse key allocation index table K dist , establishing a corresponding relationship between each data set identifier ID D and the generated sk ID , preventing reuse or confusion;

[0135] Step 3.6) The platform simultaneously calculates the authorization verification tag Tag D using the data set identifier ID auth and the seed SeedTag for verification, with the formula:

[0136] Tag auth =H(ID D ||SeedTag)

[0137] where H(·) represents a secure hash function, ensuring that the authorization and uploaded data are consistent.

[0138] Step 3.7) The platform sends the sparse key sk ID and the corresponding authorized tag Tag auth to the data buyer as an authorized package for subsequent decryption and verification operations.

[0139] In this embodiment, the step 4) specifically includes:

[0140] Step 4.1) The data buyer receives the authorized package from the platform, which contains the sparse key sk ID and the authorized verification tag Tag auth , and obtains the uploaded ciphertext data package Packet = (Tag packet , c1, c2) from the platform;

[0141] Step 4.2) The buyer first verifies whether the tag Tag packet in the data package is consistent with the tag Tag auth in the authorized package. If Tag packket ≠ Tag auth , it means inconsistency, and then decryption is rejected; if Tag packet = Tag auth , it means consistency, and the subsequent steps are continued.

[0142] Step 4.3) If the tag verification is passed, the buyer uses the received sparse key sk ID to decrypt the ciphertext (c1, c2) and calculates the decryption intermediate result:

[0143] M' = c2 + c1 · sk ID mod q

[0144] where M' is the decrypted polynomial, containing the original message and the accumulated noise;

[0145] Step 4.4) Analyze the noise term Δ in the decryption result, where Δ represents the superposition of the structured error introduced by the sparse key and the original noise in the decryption process, and the formula is:

[0146] M' = M + Δ

[0147] Δ = a · r · (sk ID - s) + e · r + e1 + e2 · sk ID

[0148] where M is the original plaintext polynomial, s is the master key generated by the platform, and the polynomials r, e, e1, and e2 are random terms and noise terms in the encryption process;

[0149] Step 4.5) The platform pre-obtains the q-C parameter relationship and the sparsity threshold ρmax Under the premise of reasonable selection of sparse key zeroing ratio ρ and public key coefficient upper bound C, the noise term And under this condition, the buyer restores the original plaintext polynomial through modulo reduction and rounding:

[0150]

[0151] Thus, the final restored M is consistent with the original plaintext uploaded.

[0152] Thus, after completing verification and successfully decrypting and restoring the original data, the data buyer can perform subsequent analysis, modeling, decision-making or apply it to actual business scenarios based on the decrypted data, thereby realizing the final value of data transaction.

[0153] Thus, the technical solutions of the present application have been described in combination with the preferred embodiments shown in the accompanying drawings, but it is easy for those skilled in the art to understand that the protection scope of the present application is obviously not limited to these specific embodiments. Those skilled in the art can make equivalent changes or replacements to the related technical features without deviating from the principles of the present application, and the technical solutions after these changes or replacements will all fall within the protection scope of the present application.

Claims

1. A lightweight homomorphic encrypted data transaction method supporting sparse keys, characterized in that, Includes the following steps: Step 1) System initialization: The trading platform selects the polynomial ring dimension, plaintext modulus, ciphertext modulus, and noise distribution parameters. Under the condition of fixing some parameters, the relationship between the ciphertext modulus and the upper bound of the public key coefficient is obtained through experimental fitting, and the combination of public key parameters and sparsity threshold are determined accordingly. The master public key and master private key are generated, and the public key and tag generation seed are distributed to the data sellers. Step 2) Data encryption and uploading: The data seller normalizes, quantizes and encodes the original data into a plaintext polynomial, encrypts it using the public key distributed by the platform to obtain ciphertext, generates a seed calculation verification label based on the dataset identifier and label, and uploads a data packet containing the ciphertext and verification label. Step 3) Payment and Sparse Key Generation: After the buyer makes the payment, the platform applies a random mask to the master key according to the sparsity threshold to generate a sparse key and generates an authorization tag. The sparse key and the authorization tag are then distributed to the buyer. Step 4) Verification and decryption: After the buyer verifies that the verification tag in the data packet matches the authorization tag, the sparse key is used to decrypt the ciphertext and restore the original data.

2. The lightweight homomorphic encrypted data transaction method supporting sparse keys according to claim 1, characterized in that, Step 1) includes: Step 1.1) Select system parameters, including: polynomial ring dimension n, plaintext modulus t, noise distribution standard deviation δ, ciphertext modulus q, and upper bound C of public key coefficients; where n is a power of 2 satisfying the fast number theory transformation condition, t and δ are used to constrain the plaintext mapping and noise magnitude, q controls the ciphertext computation space, and C constrains the amplitude of the public key coefficients. The polynomial ring is defined as: R q =Z q [X] / (X n +1) Step 1.2) Under the condition of fixed n, t, and δ, explore the impact of different combinations of q and C on the decryption correctness through experiments, ensuring that the infinite norm of the decryption residual noise term satisfies the following condition: Where Δ represents the total noise term introduced during the decryption process; Step 1.3) With n, t, and δ fixed, for different values ​​of q, the upper bound C of the coefficient norm of the public key polynomial a satisfies ||a|| ∞ Under the constraint of ≤C, the minimum feasible C is measured experimentally for a given q. min Maximum feasible C max And take the midpoint C mid =(C min +C max ) / 2 is used as the recommended C parameter for this q; Step 1.4) Record and fit log2q and log2C mid The empirical relationship between them approximately satisfies: log2C mid ≈k1·log2q+k2 Where k1 and k2 are coefficients obtained by least squares regression fitting, which are used to guide the subsequent platform to select an appropriate C when given q; Step 1.5) In the determined qC mid Based on the combination, the sparsity threshold ρ under this combination was further determined through experiments. max That is, when the decryption noise satisfies Under the premise of [specific conditions], the maximum percentage of zeros allowed in the master key is used to guide the sparse key generation process; Step 1.6) Generate a public key and a private key that satisfy the selected m, q, t, δ, C, where the private key s∈R q Sampling is performed from a small-amplitude discrete distribution (such as a ternary distribution or a Gaussian distribution); the master public key (a, b) is generated according to the following formula: b = -a·s + e mod q Where a satisfies ||a|| ∞ A random polynomial ≤ C, where e is a noise polynomial; Step 1.7) Distribute the generated public key (a, b) and the seed tag (SeedTag) for generating verification tags to the data seller, and record the qC relationship and sparsity threshold ρ obtained from the experimental fitting on the platform side. max This is used to generate sparse keys later.

3. The lightweight homomorphic encrypted data transaction method supporting sparse keys according to claim 1, characterized in that, Step 2) includes: Step 2.1) The data seller receives the public key (a, b) and the seed tag (SeedTag) distributed by the platform, and obtains the original dataset D = {d1, d2, ..., d...} to be encrypted. L }; Step 2.2) For each data sample d in dataset D i Normalization is performed to map it to the interval [0, 1]. The normalization formula is: Where d min =min(D),d max =max(D); Step 2.3) Apply the normalized data sample d i norm Quantize it and map it to an integer: Where K∈Z + This is a pre-defined quantization amplification factor used to amplify decimals into integers; Step 2.4) Quantize the integer sequence {d1′, d2′, ..., d...} L The encoding of '} is a plaintext polynomial M(X)∈R t , where R t =Z t [X] / (X n +1), the plaintext modulus is t, and the polynomial ring dimension is n; Step 2.5) Sample a random polynomial r∈R q and two noise polynomials e1, e2∈R q Their coefficients are all independently drawn from discrete distributions that satisfy the standard deviation δ, resulting in random terms and noise terms, which are used to ensure the security of cryptographic semantics; Step 2.6) Calculate the ciphertext polynomial pair c = (c1, c2) according to the BFV encryption scheme: c1 = a·r + e1 mod q c2 = b·r + M + e2 mod q Where q is the ciphertext modulus; Step 2.7) Based on the dataset identifier ID D The seedTag distributed by the platform is used to calculate the tag for verification using a hash function. packet : Tag packet =H(ID D ||SeedTag) Where H(·) represents the secure hash function (e.g., SHA-256) used by the platform; Step 2.8) Pack the complete data packet containing the verification tag and ciphertext pair as follows: Packet=(Tag packet ,c1,c2) The data packet is then uploaded to the platform so that buyers can assess the utility of the encrypted data before making payment.

4. The lightweight homomorphic encrypted data transaction method supporting sparse keys according to claim 1, characterized in that, Step 3) includes: Step 3.1) The data buyer completes the upload of the encrypted data packet Packet = (Tag packet After evaluating the utility of c1 and c2 and confirming payment, the platform authorizes the buyer to access the corresponding dataset ID based on the payment result. D Decrypt; Step 3.2) After authorization, the platform selects the corresponding sparsity threshold ρ based on the combination relationship between the ciphertext modulus q and the upper bound C of the public key coefficients from Step 1). max Determine the zeroing ratio ρ ≤ ρ used to generate the sparse key. max Where ρ represents the proportion of the master key's random zeroing coefficients, used to ensure that the decryption noise satisfies: Where Δ is the structured noise term introduced due to the sparsification of the master key; Step 3.3) The platform provides the dataset ID. D Construct a random mask vector Mask ρ ∈{0,1} n Its Hamming weight is approximately (1-ρ)·n, that is, approximately ρ·n positions are randomly selected and set to zero, while the rest are set to one, which is used to control the distribution of non-zero items in the sparse key; Step 3.4) The platform uses the mask. ρ The sparse key sk is generated by bitwise multiplication with the master key s. ID The specific formula is as follows: sk ID =Mask ρ ⊙s Where the symbol ⊙ denotes the multiplication of corresponding coefficients of vectors, sk ID It is a polynomial with the same key dimension as the master key but with sparser coefficients, used for decrypting specific datasets; Step 3.5) To ensure the uniqueness of the sparse key corresponding to each dataset, the platform maintains a sparse key allocation index table K. dist Each dataset identifier ID D With the generated sk ID Establish corresponding relationships to prevent reuse or confusion; Step 3.6) The platform is based on the dataset identifier ID. D Calculate the authorization verification tag using the seedTag used for verification. auth The formula is: Tag auth =H(ID D ||SeedTag) Where H(·) represents a secure hash function, ensuring that the authorization and uploaded data are consistent; Step 3.7) The platform will use the sparse key sk ID and the corresponding authorization tag auth It is packaged into an authorization package and sent to the data buyer for subsequent decryption and verification operations.

5. A lightweight homomorphic encrypted data transaction method supporting sparse keys according to claim 1, characterized in that, Step 4) includes: Step 4.1) The data buyer receives an authorization package from the platform, which contains the sparse key sk. ID and authorization verification tag auth At the same time, it retrieves the uploaded encrypted data packet Packet=(Tag) from the platform. packet (c1, c2); Step 4.2) The buyer first verifies the tag in the data packet. packet Tags in the license package auth Consistency, if Tag packet ≠Tag auth This indicates an inconsistency, and decryption is refused; if Tag packet =Tag auth This indicates agreement, proceed to the next step; Step 4.3) If the tag verification is successful, the buyer uses the received sparse key sk ID Decrypt the ciphertext (c1, c2) and calculate the intermediate decryption results: M′=c2+c1·sk ID mod q Where M′ is the decrypted polynomial, containing the original message and accumulated noise; Step 4.4) Analyze the noise term Δ in the decryption result, where Δ represents the superposition of the structured error introduced by the sparse key and the original noise during the decryption process, and the formula is: M′=M+Δ Δ=a·r·(sk ID -s)+e·r+e1+e2·sk ID Where M is the original plaintext polynomial, s is the master key generated by the platform, and polynomials r, e, e1, and e2 are the random and noise terms in the encryption process. Step 4.5) Based on the experimentally fitted qC parameter relationship and sparsity threshold ρ, the platform is pre-fitted. max Under the premise of reasonably selecting the sparse key zeroing ratio ρ and the upper bound C of the public key coefficients, ensure the noise term Under these conditions, the buyer recovers the original plaintext polynomial through modulo reduction and rounding: This ensures that the recovered M is consistent with the original plaintext uploaded.

Images