A collaborative encryption / decryption method and system based on the NTRU algorithm

Abstract

This application discloses a collaborative encryption / decryption method and system based on the NTRU algorithm, relating to the field of data security. The method includes: a client and a server each generating local keys based on the NTRU algorithm, and collaboratively generating a global public key; the key includes a partial private key of the client, a partial public key of the client, a partial private key of the server, and a partial public key of the server; encrypting the plaintext message to be encrypted using the global public key to generate ciphertext; decrypting the ciphertext using the server's local partial private key to obtain partial plaintext; and decrypting the partial plaintext using the client's local partial private key to obtain the complete ciphertext. This application can reduce the risk of key leakage, improve data security, and reduce hardware procurement and maintenance costs.

Description

Technical Field

[0001] This application relates to the field of data security, and in particular to a collaborative encryption and decryption method and system based on the NTRU algorithm. Background Technology

[0002] With the emergence of smart terminals and the development of network technology, new services have emerged, such as mobile payment and mobile office. These new services need to be operated on smartphones. In order to protect user privacy and security, cryptographic technology is indispensable. However, the digital signature key implemented by the terminal software is stored in the terminal's memory, which is vulnerable to attack and very insecure. If hardware methods such as USB keys are used, the user experience is poor and inconvenient to use, while also increasing costs. Summary of the Invention

[0003] The purpose of this application is to provide a collaborative encryption and decryption method and system based on the NTRU algorithm, which can effectively protect data security.

[0004] To achieve the above objectives, this application provides the following solution.

[0005] Firstly, this application provides a collaborative encryption / decryption method based on the NTRU algorithm, including:

[0006] The client and server each generate local keys based on the NTRU algorithm, and collaboratively generate a global public key; the key includes a portion of the client's private key, a portion of the client's public key, a portion of the server's private key, and a portion of the server's public key.

[0007] The plaintext message to be encrypted is encrypted using the global public key to generate ciphertext;

[0008] The server uses a portion of its local private key to decrypt the ciphertext, obtaining a portion of the plaintext;

[0009] The client uses a portion of its local private key to decrypt the plaintext portion, obtaining the complete ciphertext.

[0010] Secondly, this application provides a collaborative encryption and decryption system based on the NTRU algorithm, including: a client and a server;

[0011] The client includes: a first key generation module for generating a partial private key and a partial public key for the client; a first public key synthesis module for receiving a partial public key from the server and synthesizing a global public key with a local partial public key; and a second decryption module for recovering the final plaintext by combining a local partial private key after receiving a partial plaintext sent by the server.

[0012] The server includes: a second key generation module for generating a partial private key and a partial public key for the server; a second public key synthesis module for receiving a partial public key from the client and synthesizing a global public key with a local partial public key; and a first decryption module for decrypting the ciphertext using a local partial private key to obtain a partial plaintext and sending the partial plaintext to the client.

[0013] According to the specific embodiments provided in this application, this application has the following technical effects.

[0014] 1. Distributed private key security: The private key is split into a partial private key on the client side and a partial private key on the server side. If a single participant leaks the private key, only the local part of the private key will be exposed, and the complete private key cannot be recovered. This greatly reduces the risk of key leakage and improves data security.

[0015] 2. Balancing experience and cost: No additional hardware is required; it is implemented solely through client-server interaction, without affecting the user experience, while reducing hardware procurement and maintenance costs.

[0016] 3. High computational efficiency: All operations are based on polynomial ring operations, which can be accelerated through fast number theory transformations, resulting in faster encryption / decryption speeds and adaptability to resource-constrained scenarios such as mobile terminals. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating a collaborative encryption / decryption method based on the NTRU algorithm, provided as an embodiment of this application. Detailed Implementation

[0019] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0020] This application proposes a collaborative encryption / decryption method and system based on the NTRU algorithm, which effectively protects the security of the private key of the post-quantum NTRU algorithm. The two keys are generated in a distributed manner, with the keys generated independently on the client and server sides respectively. Even if the client leaks the key, the complete decryption key will not be disclosed, effectively protecting data security.

[0021] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0022] In one exemplary embodiment, such as Figure 1 As shown, a collaborative encryption and decryption method based on the NTRU algorithm is provided. This method is executed by a computer device, specifically by a terminal or server alone, or by both the terminal and the server. In this embodiment, the method is applied to a server as an example, and includes the following steps S1 to S4.

[0023] S1: The client and server each generate local keys based on the NTRU algorithm and jointly generate a global public key; the key includes a portion of the client's private key, a portion of the client's public key, a portion of the server's private key, and a portion of the server's public key.

[0024] S2: Use the global public key to encrypt the plaintext message to be encrypted, and generate ciphertext.

[0025] S3: The server uses a portion of its local private key to decrypt the ciphertext, obtaining a portion of the plaintext.

[0026] S4: The client uses a portion of its local private key to decrypt the plaintext portion and obtain the complete ciphertext.

[0027] The NTRU algorithm possesses quantum-resistant properties and high computational efficiency, making it suitable for building distributed encryption and decryption systems. By distributing the key generation process across the client and server, and designing a two-stage decryption process, the risk of single-point key leakage can be effectively eliminated. This application employs a key sharding storage mechanism, storing the private key separately on the client and server; a breach on either the client or server will not lead to the overall key leakage. It eliminates dependence on external hardware devices, allowing users to perform secure encryption and decryption operations using only a regular terminal. The dynamic key combination mechanism during encryption and decryption ensures that each operation generates a temporarily valid complete key, further enhancing the system's resistance to attacks.

[0028] In one specific embodiment, step S1 specifically includes the following steps.

[0029] S11: Set the core parameters of the NTRU algorithm; the core parameters include: polynomial degree n, modulus q, prime number p, and polynomial ring. ;in, Indicates the coefficient in The set of polynomials; Let x be an integer representing the modulus q, and let x be an element of the polynomial.

[0030] The modulus q refers to the modulo operation parameter of the polynomial coefficients, which can be implemented using values ​​such as 2048 or 4096, and is used to constrain the range of the polynomial coefficients. The prime number p refers to the modulus parameter used when constructing the public key, which can be implemented using small prime numbers such as 3 or 5, to ensure the existence of inverses in the modulo operation.

[0031] S12: Client randomly generates the fundamental polynomial And calculate part of the private key ,beg ,like If it does not exist, regenerate it. ; Modulus Modulo operation.

[0032] S13: Client randomly generates auxiliary private key polynomial Generate a partial public key and will Send to the server.

[0033] S14: Server-side random generation of fundamental polynomials And calculate part of the private key ,beg ,like If it does not exist, regenerate it. .

[0034] S15: Server-side random generation of auxiliary private key polynomial Generate a partial public key and will Send to the client.

[0035] S16: Client calculates global public key The server calculates the global public key. .

[0036] In the above implementation, the random generation of the auxiliary private key polynomial enhances the unpredictability of the private key. The construction method of the partial public key retains the characteristics of the NTRU algorithm while providing necessary parameters for the subsequent collaborative generation of the global public key. The interaction mechanism of exchanging partial public keys between the two parties ensures that the synthesis of the global public key does not require either party to hold the complete private key. The distributed key generation achieves fragmented storage of the private key, realizing secure key management while maintaining the encryption efficiency of the algorithm.

[0037] After generating their respective partial public keys, the client and server can combine them to obtain the global public key without relying on a third-party trusted node, by synchronously executing the same polynomial operation rules. Since the computation process is completely identical and the parameters are public, the generated global public key is automatically agreed upon between the client and server. In this process, the right to generate the global public key is distributed among two independent nodes. Mathematical constraints ensure the indivisibility of the partial public keys, preventing attackers from deducing the complete key information by intercepting a single node's partial public key, thus avoiding the risk of a single node's private key being leaked and the global public key being compromised. Furthermore, since the client and server only need to exchange partial public keys and perform local computations, without multiple interactions or complex verification mechanisms, the communication overhead of the key generation process is reduced.

[0038] In one specific embodiment, step S2 specifically includes: randomly generating a polynomial. Generate ciphertext , This is the plaintext message to be encrypted.

[0039] The encryption process first generates dynamic parameters through a random polynomial generation module. These parameters are then multiplied by a global public key using a polynomial ring multiplication operation, and the plaintext message is superimposed on them. Finally, a modular arithmetic operation is performed to generate the final ciphertext. The random polynomial is generated independently for each encryption operation, ensuring that the same plaintext produces different ciphertexts in different encryption processes. The global public key consists of partial public key components maintained by both the client and server, preventing attackers from deducing the complete public key structure by intercepting unilateral communication data. During the polynomial ring operation, the plaintext message is converted into a polynomial coefficient distribution on the ring, which, combined with the interference effect of the random parameters, forms a ciphertext form resistant to analytical attacks. The choice of modular arithmetic parameters is consistent with the core parameters of the NTRU algorithm, ensuring the mathematical reversibility of the decryption process.

[0040] In one specific embodiment, step S4 specifically includes:

[0041] S41: The server uses a portion of the local private key. For ciphertext Decryption yields partial plaintext. and part of the plaintext This occurs to the client.

[0042] S42: The client uses a portion of its local private key. For some plain text Decrypt to obtain the complete ciphertext. .

[0043] In the above implementation, the decryption process is split into a collaborative operation between the server and the client. The server uses a portion of its local private key to perform an initial decryption of the ciphertext, generating a partial plaintext. The client receives this intermediate result and uses its own partial private key to perform a second decryption to obtain the final plaintext. In this process, the partially generated private keys of the client and the server form a chain dependency during decryption, preventing either party from completing the full decryption operation independently, thus significantly improving system security.

[0044] Based on the same inventive concept, this application also provides a collaborative encryption and decryption system based on the NTRU algorithm. The solution provided by this system is similar to the solution described in the above method. Therefore, the specific limitations of one or more embodiments of the collaborative encryption and decryption system based on the NTRU algorithm provided below can be found in the limitations of the collaborative encryption and decryption method based on the NTRU algorithm described above, and will not be repeated here.

[0045] In one exemplary embodiment, a collaborative encryption / decryption system based on the NTRU algorithm is provided, comprising: a client and a server.

[0046] The client includes: a first key generation module for generating a partial private key and a partial public key for the client; a first public key synthesis module for receiving a partial public key from the server and synthesizing a global public key with a local partial public key; and a second decryption module for recovering the final plaintext by combining a local partial private key after receiving a partial plaintext sent by the server.

[0047] The server includes: a second key generation module for generating a partial private key and a partial public key for the server; a second public key synthesis module for receiving a partial public key from the client and synthesizing a global public key with a local partial public key; and a first decryption module for decrypting the ciphertext using a local partial private key to obtain a partial plaintext and sending the partial plaintext to the client.

[0048] The system further includes an encryption module, used to encrypt the plaintext message to be encrypted using the global public key, generating ciphertext.

[0049] In one specific embodiment, the first public key synthesis module and the second public key synthesis module adopt the formula Generate a global public key ,in, For part of the client's public key, This is a portion of the server's public key.

[0050] In one specific embodiment, the encryption module includes:

[0051] Polynomial generation unit, used to randomly generate polynomials ;

[0052] Encryption unit, used to generate ciphertext , This is the plaintext message to be encrypted.

[0053] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0054] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. Furthermore, those skilled in the art will recognize that, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A collaborative encryption / decryption method based on the NTRU algorithm, characterized in that, include: The client and server each generate local keys based on the NTRU algorithm, and then collaboratively generate a global public key. The key includes a portion of the client's private key, a portion of the client's public key, a portion of the server's private key, and a portion of the server's public key. The plaintext message to be encrypted is encrypted using the global public key to generate ciphertext; specifically, this includes: Randomly generated polynomials Generate ciphertext , The plaintext message to be encrypted; The server uses a portion of its local private key to decrypt the ciphertext, obtaining a portion of the plaintext; specifically, the server uses a portion of its local private key... For ciphertext Decryption yields partial plaintext. and part of the plaintext Occurs on the client; The client uses a portion of its local private key to decrypt the plaintext, obtaining the complete plaintext; specifically, the client uses a portion of its local private key... For some plain text Decrypt to obtain the complete plaintext ; Specifically, the client and server each generate local keys based on the NTRU algorithm, including: Set the core parameters of the NTRU algorithm; the core parameters include: polynomial degree n, modulus q, prime number p, and polynomial ring. ;in, Indicates the coefficient in The set of polynomials, The integer representing the modulus q, and x representing the elements of the polynomial; The client randomly generates the fundamental polynomial. And calculate part of the private key ,beg ,like If it does not exist, regenerate it. ; Modulus Modulo operation; The client randomly generates a secondary private key polynomial. Generate a partial public key and will Send to the server; The server randomly generates the basic polynomial. And calculate part of the private key ,beg ,like If it does not exist, regenerate it. ; Server-side randomized auxiliary private key polynomial Generate a partial public key and will Send to the client; The collaborative generation of the global public key specifically includes: Both the client and server use a formula based on a portion of the client's public key and a portion of the server's public key. Generate a global public key ,in, For part of the client's public key, This is a portion of the server's public key.

2. A collaborative encryption / decryption system based on the NTRU algorithm, the system being used to execute the collaborative encryption / decryption method based on the NTRU algorithm as described in claim 1, characterized in that, The system includes: a client and a server; The client includes: a first key generation module for generating a partial private key and a partial public key for the client; a first public key synthesis module for receiving a partial public key from the server and synthesizing a global public key with a local partial public key; and a second decryption module for recovering the final plaintext by combining a local partial private key after receiving a portion of plaintext sent by the server. The server includes: a second key generation module for generating a partial private key and a partial public key for the server; a second public key synthesis module for receiving a partial public key from the client and synthesizing a global public key with a local partial public key; and a first decryption module for decrypting the ciphertext using a local partial private key to obtain a portion of plaintext and sending the portion of plaintext to the client. The first public key synthesis module and the second public key synthesis module use the formula Generate a global public key ,in, For part of the client's public key, This is a portion of the server's public key; The system further includes: an encryption module, used to encrypt the plaintext message to be encrypted using the global public key to generate ciphertext; the encryption module includes: a polynomial generation unit, used to randomly generate polynomials. ; Encryption unit, used to generate ciphertext , This is the plaintext message to be encrypted.

Images