Cryptographic data processing method and apparatus, computer device, and readable storage medium

Abstract

The application relates to an encrypted data processing method and device, computer equipment and a readable storage medium. The method comprises the following steps: obtaining target ciphertext, reference data, a first random number and a second random number; performing encryption processing on the first random number, the target ciphertext and the reference data according to the second random number and a target public key to obtain first ciphertext; performing decryption processing on the first ciphertext based on a first private key to obtain first intermediate plaintext, and sending the first ciphertext and the first intermediate plaintext to a second private key management party; receiving intermediate processing results sent by the second private key management party; the intermediate processing results are obtained by the second private key management party based on a second private key; determining target processing results according to the second random number, the intermediate processing results and the target public key; the target public key corresponds to a target private key constructed by the first private key and the second private key. The encrypted data can be efficiently, accurately and flexibly processed.

Description

Technical Field

[0001] This application relates to the field of encrypted data processing, and in particular to an encrypted data processing method, apparatus, computer device, and readable storage medium. Background Technology

[0002] Ranking, order statistics, and sorting are fundamental primitives in database query processing, but they introduce significant privacy risks when applied to sensitive data. Performing operations directly on encrypted data without accessing the decryption key (such as in homomorphic encryption, HE) is feasible, but extremely challenging. In particular, because these operations inherently rely on data comparison, their implementation under fully homomorphic encryption (FHE) remains particularly difficult.

[0003] Existing research has explored computations for ranking, order statistics, and sorting encrypted datasets. However, these methods face limitations in comparison depth, correctness, dataset scalability, and computational efficiency. Currently, the state-of-the-art (SOTA) solution achieves a minimum comparison depth of 2, but this method relies on the Cheon-Kim-Kim-Song (CKKS) scheme and has limitations that urgently need to be addressed. Summary of the Invention

[0004] Therefore, it is necessary to provide an encrypted data processing method, apparatus, computer equipment, and readable storage medium that can efficiently, accurately, and flexibly process encrypted data, addressing the aforementioned technical problems.

[0005] Firstly, this application provides an encrypted data processing method, applied to a first private key manager, comprising:

[0006] Obtain the target ciphertext, reference data, a type I random number, and a type II random number; the target ciphertext is obtained by encrypting it using the target public key.

[0007] Based on the second type of random number and the target public key, the first type of random number, the target ciphertext, and the reference data are encrypted to obtain the first ciphertext.

[0008] Based on the first private key, the first ciphertext is decrypted to obtain the first intermediate plaintext, and the first ciphertext and the first intermediate plaintext are sent to the second private key manager;

[0009] Receive the intermediate processing result sent by the second private key manager; the intermediate processing result is obtained by the second private key manager decrypting the first ciphertext and the first intermediate plaintext based on the second private key;

[0010] The target processing result is determined based on two types of random numbers, intermediate processing results, and the target public key; the target public key corresponds to the target private key constructed from the first and second private keys; the target processing result serves as the basis for managing the target ciphertext.

[0011] In one embodiment, based on two types of random numbers and a target public key, a first type of random number, a target ciphertext, and reference data are encrypted to obtain a first ciphertext, including:

[0012] When the second type of random number is equal to the first preset value, the first type of random number, the target ciphertext, and the reference data are encrypted based on the first encryption method and the target public key to obtain the first ciphertext.

[0013] When the second type of random number is equal to the second preset value, the first type of random number, the target ciphertext, and the reference data are encrypted based on the second encryption method and the target public key to obtain the first ciphertext; the first preset value is greater than the second preset value.

[0014] The first and second encryption methods use different types of random numbers.

[0015] In one embodiment, when the reference data includes a first reference ciphertext, the target processing result is used to represent the size relationship between the target ciphertext and the first reference ciphertext;

[0016] When the reference data includes the first reference plaintext, the target processing result is used to indicate the consistency between the target ciphertext and the first reference plaintext;

[0017] When the reference data includes a first reference plaintext and a second reference ciphertext, the target processing result is used to represent the encryption condition product corresponding to the target ciphertext; the encryption condition product is the product of the target ciphertext and the first reference plaintext or the second reference ciphertext.

[0018] Secondly, this application provides an encrypted data processing method applied to a second private key manager, comprising:

[0019] Receive first ciphertext and first intermediate plaintext sent by the first private key manager; wherein, the first ciphertext is obtained by the first private key manager encrypting a type I random number, the target ciphertext, and reference data based on a type II random number and a target public key; the first intermediate plaintext is obtained by the first private key manager decrypting the first ciphertext based on the first private key; the target ciphertext is obtained by encrypting based on the target public key;

[0020] Based on the second private key, the first ciphertext and the first intermediate plaintext are decrypted to obtain the intermediate processing result.

[0021] The intermediate processing result is sent to the first private key manager so that the first private key manager can determine the target processing result based on the two types of random numbers, the intermediate processing result, and the target public key; the target public key corresponds to the target private key constructed by the first private key and the second private key; the target processing result is the basis for managing the target ciphertext.

[0022] In one embodiment, based on the second private key, the first ciphertext and the first intermediate plaintext are decrypted to obtain an intermediate processing result, including:

[0023] Based on the second private key, the first ciphertext is decrypted to obtain the second intermediate plaintext;

[0024] Determine the target middle plaintext based on the first and second middle plaintexts;

[0025] The intermediate processing result is determined based on the relationship between the target intermediate plaintext and the third preset value.

[0026] In one embodiment, determining the intermediate processing result based on the relationship between the target intermediate plaintext and a third preset value includes:

[0027] If the target plaintext is greater than the third preset value, the fourth preset value is encrypted based on the target public key to obtain the intermediate processing result.

[0028] If the target plaintext is no greater than the third preset value, the fifth preset value is encrypted based on the target public key to obtain the intermediate processing result.

[0029] Thirdly, this application also provides an encrypted data processing device, configured in a first private key manager, comprising:

[0030] The first acquisition module is used to acquire the target ciphertext, reference data, a type I random number, and a type II random number; the target ciphertext is obtained by encrypting it based on the target public key.

[0031] The first determining module is used to encrypt a type of random number, a target ciphertext, and reference data based on a type of random number and a target public key to obtain the first ciphertext.

[0032] The second determining module is used to decrypt the first ciphertext based on the first private key to obtain the first intermediate plaintext, and send the first ciphertext and the first intermediate plaintext to the second private key manager;

[0033] The first receiving module is used to receive the intermediate processing result sent by the second private key manager; the intermediate processing result is obtained by the second private key manager decrypting the first ciphertext and the first intermediate plaintext based on the second private key;

[0034] The third determination module is used to determine the target processing result based on two types of random numbers, intermediate processing results, and the target public key; the target public key corresponds to the target private key constructed from the first private key and the second private key; the target processing result is the basis for managing the target ciphertext.

[0035] Fourthly, this application also provides an encrypted data processing apparatus, configured in a second private key manager, comprising:

[0036] The second receiving module is used to receive the first ciphertext and the first intermediate plaintext sent by the first private key manager; wherein, the first ciphertext is obtained by the first private key manager encrypting a type of random number, the target ciphertext, and reference data based on two types of random numbers and the target public key; the first intermediate plaintext is obtained by the first private key manager decrypting the first ciphertext based on the first private key; the target ciphertext is obtained by encrypting based on the target public key;

[0037] The fourth determining module is used to decrypt the first ciphertext and the first intermediate plaintext based on the second private key to obtain the intermediate processing result;

[0038] The sending module is used to send the intermediate processing result to the first private key manager, so that the first private key manager can determine the target processing result based on the two types of random numbers, the intermediate processing result and the target public key; the target public key corresponds to the target private key constructed by the first private key and the second private key; the target processing result is the basis for managing the target ciphertext.

[0039] Fifthly, this application also provides a computer device, including a memory and a processor, the memory storing a computer program, the processor executing the computer program to perform the following steps:

[0040] Obtain the target ciphertext, reference data, a type I random number, and a type II random number; the target ciphertext is obtained by encrypting it using the target public key.

[0041] Based on the second type of random number and the target public key, the first type of random number, the target ciphertext, and the reference data are encrypted to obtain the first ciphertext.

[0042] Based on the first private key, the first ciphertext is decrypted to obtain the first intermediate plaintext, and the first ciphertext and the first intermediate plaintext are sent to the second private key manager;

[0043] Receive the intermediate processing result sent by the second private key manager; the intermediate processing result is obtained by the second private key manager decrypting the first ciphertext and the first intermediate plaintext based on the second private key;

[0044] The target processing result is determined based on two types of random numbers, intermediate processing results, and the target public key; the target public key corresponds to the target private key constructed from the first and second private keys; the target processing result serves as the basis for managing the target ciphertext.

[0045] Sixthly, this application also provides a computer device, including a memory and a processor, the memory storing a computer program, the processor executing the computer program to perform the following steps:

[0046] Receive first ciphertext and first intermediate plaintext sent by the first private key manager; wherein, the first ciphertext is obtained by the first private key manager encrypting a type I random number, the target ciphertext, and reference data based on a type II random number and a target public key; the first intermediate plaintext is obtained by the first private key manager decrypting the first ciphertext based on the first private key; the target ciphertext is obtained by encrypting based on the target public key;

[0047] Based on the second private key, the first ciphertext and the first intermediate plaintext are decrypted to obtain the intermediate processing result.

[0048] The intermediate processing result is sent to the first private key manager so that the first private key manager can determine the target processing result based on the two types of random numbers, the intermediate processing result, and the target public key; the target public key corresponds to the target private key constructed by the first private key and the second private key; the target processing result is the basis for managing the target ciphertext.

[0049] In a seventh aspect, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0050] Obtain the target ciphertext, reference data, a type I random number, and a type II random number; the target ciphertext is obtained by encrypting it using the target public key.

[0051] Based on the second type of random number and the target public key, the first type of random number, the target ciphertext, and the reference data are encrypted to obtain the first ciphertext.

[0052] Based on the first private key, the first ciphertext is decrypted to obtain the first intermediate plaintext, and the first ciphertext and the first intermediate plaintext are sent to the second private key manager;

[0053] Receive the intermediate processing result sent by the second private key manager; the intermediate processing result is obtained by the second private key manager decrypting the first ciphertext and the first intermediate plaintext based on the second private key;

[0054] The target processing result is determined based on two types of random numbers, intermediate processing results, and the target public key; the target public key corresponds to the target private key constructed from the first and second private keys; the target processing result serves as the basis for managing the target ciphertext.

[0055] Eighthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0056] Receive first ciphertext and first intermediate plaintext sent by the first private key manager; wherein, the first ciphertext is obtained by the first private key manager encrypting a type I random number, the target ciphertext, and reference data based on a type II random number and a target public key; the first intermediate plaintext is obtained by the first private key manager decrypting the first ciphertext based on the first private key; the target ciphertext is obtained by encrypting based on the target public key;

[0057] Based on the second private key, the first ciphertext and the first intermediate plaintext are decrypted to obtain the intermediate processing result.

[0058] The intermediate processing result is sent to the first private key manager so that the first private key manager can determine the target processing result based on the two types of random numbers, the intermediate processing result, and the target public key; the target public key corresponds to the target private key constructed by the first private key and the second private key; the target processing result is the basis for managing the target ciphertext.

[0059] Ninthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0060] Obtain the target ciphertext, reference data, a type I random number, and a type II random number; the target ciphertext is obtained by encrypting it using the target public key.

[0061] Based on the second type of random number and the target public key, the first type of random number, the target ciphertext, and the reference data are encrypted to obtain the first ciphertext.

[0062] Based on the first private key, the first ciphertext is decrypted to obtain the first intermediate plaintext, and the first ciphertext and the first intermediate plaintext are sent to the second private key manager;

[0063] Receive the intermediate processing result sent by the second private key manager; the intermediate processing result is obtained by the second private key manager decrypting the first ciphertext and the first intermediate plaintext based on the second private key;

[0064] The target processing result is determined based on two types of random numbers, intermediate processing results, and the target public key; the target public key corresponds to the target private key constructed from the first and second private keys; the target processing result serves as the basis for managing the target ciphertext.

[0065] In a tenth aspect, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0066] Receive first ciphertext and first intermediate plaintext sent by the first private key manager; wherein, the first ciphertext is obtained by the first private key manager encrypting a type I random number, the target ciphertext, and reference data based on a type II random number and a target public key; the first intermediate plaintext is obtained by the first private key manager decrypting the first ciphertext based on the first private key; the target ciphertext is obtained by encrypting based on the target public key;

[0067] Based on the second private key, the first ciphertext and the first intermediate plaintext are decrypted to obtain the intermediate processing result.

[0068] The intermediate processing result is sent to the first private key manager so that the first private key manager can determine the target processing result based on the two types of random numbers, the intermediate processing result, and the target public key; the target public key corresponds to the target private key constructed by the first private key and the second private key; the target processing result is the basis for managing the target ciphertext.

[0069] The aforementioned encrypted data processing method, apparatus, computer equipment, and readable storage medium involve: acquiring target ciphertext, reference data, a type I random number, and a type II random number; encrypting the target ciphertext using a target public key; encrypting the type I random number, target ciphertext, and reference data using the type II random number and the target public key to obtain a first ciphertext; decrypting the first ciphertext using a first private key to obtain a first intermediate plaintext, and sending the first ciphertext and the first intermediate plaintext to a second private key manager; receiving the intermediate processing result sent by the second private key manager; obtaining the intermediate processing result by the second private key manager decrypting the first ciphertext and the first intermediate plaintext using the second private key; determining the target processing result based on the type II random number, the intermediate processing result, and the target public key; the target public key corresponding to the target private key constructed from the first and second private keys; and the target processing result serving as the basis for managing the target ciphertext. In this process, the computation task is performed by two machines each holding a share of the private key. and The servers work together: Server 1 (the first private key manager) is responsible for generating blinded ciphertext and initiating partial decryption; Server 2 (the second private key manager) is responsible for performing threshold decryption, plaintext comparison and returning the encryption result, ensuring that a single server cannot decrypt the data, thus ensuring the security of encrypted data during the processing of encrypted data. Attached Figure Description

[0070] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0071] Figure 1 This is an application environment diagram of an encrypted data processing method in one embodiment;

[0072] Figure 2 This is a flowchart illustrating an encrypted data processing method in one embodiment;

[0073] Figure 3 This is a flowchart illustrating the encrypted data processing method in another embodiment;

[0074] Figure 4A This is a timing diagram of an encrypted data processing method in one embodiment;

[0075] Figure 4B This is an application environment diagram of the encrypted data processing method in another embodiment;

[0076] Figure 5 This is a structural block diagram of an encrypted data processing device in one embodiment;

[0077] Figure 6 This is a structural block diagram of an encrypted data processing device in another embodiment;

[0078] Figure 7 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0079] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0080] Before introducing the embodiments of this application, it should be noted that although the state-of-the-art (SOTA) solution achieves a minimum comparison depth of 2, this method relies on the Cheon-Kim-Kim-Song (CKKS) scheme and has three key limitations:

[0081] (1) Approximation error: There are approximation errors in the calculation results, and the correctness of the deterministic result cannot be guaranteed.

[0082] (2) Data set size limit: The CKKS scheme itself limits the size of the dataset to a power of 2.

[0083] (3) High comparison overhead: Pairwise comparison of encrypted values ​​under CKKS will generate huge computational overhead.

[0084] In summary, efficiently, accurately (without approximation errors), and flexibly (supporting arbitrary dataset sizes) perform basic operations such as ranking, order statistics, and sorting on encrypted data in untrusted cloud environments remains a crucial and challenging problem. This application aims to address this issue. This method can be widely applied to cloud-based secure ranking, order statistics, and encrypted sorting scenarios, providing a highly efficient and scalable solution for sorting and comparing encrypted data. Compared to existing CKKS-based homomorphic encryption methods, it completely eliminates floating-point errors, supports data input of any size, and significantly reduces computational and communication overhead. While maintaining high security and numerical accuracy, this method possesses good versatility and deployment flexibility, making it suitable for various practical application environments such as privacy-preserving data analysis, encrypted database queries, and secure cloud computing. Furthermore, this method involves two types of collaborative computing entities: Server 1 (the first private key manager) and Server 2 (the second private key manager). The two servers establish a connection through a secure channel and collaboratively execute a secure computing protocol in an untrusted environment to achieve core functions such as comparing encrypted data, determining equivalence, and performing conditional multiplication.

[0085] The encrypted data processing method provided in this application embodiment can be applied to, for example... Figure 1 In the application environment shown, the first private key manager 102 communicates with the second private key manager 104 via a network. Specifically, the first private key manager 102 obtains the target ciphertext, reference data, a type I random number, and a type II random number; the target ciphertext is obtained by encrypting it based on the target public key; the first private key manager 102 encrypts the type I random number, the target ciphertext, and the reference data according to the type II random number and the target public key to obtain the first ciphertext; the first private key manager 102 decrypts the first ciphertext based on the first private key to obtain the first intermediate plaintext, and sends the first ciphertext and the first intermediate plaintext to the second private key manager 104; the first private key manager 102 receives the intermediate processing result sent by the second private key manager 104; the intermediate processing result is obtained by the second private key manager decrypting the first ciphertext and the first intermediate plaintext based on the second private key; the first private key manager 102 determines the target processing result according to the type II random number, the intermediate processing result, and the target public key; the target public key corresponds to the target private key constructed by the first private key and the second private key; the target processing result is the basis for managing the target ciphertext.

[0086] In one exemplary embodiment, such as Figure 2 As shown, an encrypted data processing method is provided, which can be applied to... Figure 1Taking the first private key manager 102 (i.e., server 1) as an example, the following steps are included:

[0087] S210, obtain the target ciphertext, reference data, a type I random number, and a type II random number.

[0088] The target ciphertext is obtained by encrypting it using the target public key; reference data is used to assist in determining the first ciphertext; both Type I and Type II random numbers are randomly generated numbers, the difference being that Type I random numbers are specific numerical values, while Type II random numbers are indefinite numerical values. For example, a Type II random number could be... .

[0089] For example, in this embodiment, the first private key manager can obtain the target ciphertext, reference data, a type I random number, and a type II random number sent by the data provider. In some embodiments, the type I and type II random numbers may also be randomly generated by the first private key manager itself.

[0090] S220: Based on the second type of random number and the target public key, encrypt the first type of random number, the target ciphertext, and the reference data to obtain the first ciphertext.

[0091] In one optional implementation, when the two types of random numbers are equal to a first preset value, the first type of random number, the target ciphertext, and the reference data are encrypted based on a first encryption method and a target public key to obtain a first ciphertext; when the two types of random numbers are equal to a second preset value, the first type of random number, the target ciphertext, and the reference data are encrypted based on a second encryption method and a target public key to obtain the first ciphertext; the first preset value is greater than the second preset value; wherein the first type of random number used in the first encryption method and the second encryption method are different.

[0092] The first preset value and the second preset value can both be determined based on human experience. For example, the first preset value can be 1 and the second preset value can be 0.

[0093] For example, in the case where a class of random numbers includes r1 and r2, the random number used in the first encryption method can be r1, and the random number used in the second encryption method can be r2, or r1 and r2.

[0094] S230: Based on the first private key, the first ciphertext is decrypted to obtain the first intermediate plaintext, and the first ciphertext and the first intermediate plaintext are sent to the second private key manager.

[0095] S240, Receive the intermediate processing result sent by the second private key manager.

[0096] The intermediate processing result is obtained by the second private key manager decrypting the first ciphertext and the first intermediate plaintext based on the second private key.

[0097] S250 determines the target processing result based on two types of random numbers, intermediate processing results, and the target public key.

[0098] The target public key corresponds to the target private key constructed from the first and second private keys; the target processing result serves as the basis for managing the target ciphertext.

[0099] Specifically, when the reference data includes a first reference ciphertext, the target processing result is used to represent the size relationship between the target ciphertext and the first reference ciphertext; when the reference data includes a first reference plaintext, the target processing result is used to represent the consistency between the target ciphertext and the first reference plaintext; when the reference data includes a first reference plaintext and a second reference ciphertext, the target processing result is used to represent the encryption condition product corresponding to the target ciphertext; the encryption condition product is the product of the target ciphertext and either the first reference plaintext or the second reference ciphertext.

[0100] The following describes the encrypted data processing method provided in this application, using the example of a first reference ciphertext as the reference data and a target processing result used to represent the size relationship between the target ciphertext and the first reference ciphertext.

[0101] In step S210, server 1 first generates a type of random number. and And second-type random numbers: bits Subsequently, in step S220, server 1 uses two types of random numbers... The value is used to encrypt a class of random numbers, the target ciphertext, and reference data using homomorphic operations to construct a blinded ciphertext (i.e., the first ciphertext). ;like ,but ;like ,but Furthermore, in step S230, server 1 uses its private key share (i.e., the first private key). Execution part decryption Obtain the first intermediate plaintext Finally, server 1 will... The result is sent to server 2 so that the second private key manager (i.e., server 2) can determine the intermediate processing result.

[0102] In step S250, server 1 receives the intermediate processing result sent by server 2. Then, use the random bits it generates. Using the homomorphic properties of the (2,2)-threshold Paillier cryptosystem, calculate the final encryption comparison result. .

[0103] The following describes the encrypted data processing method provided in this application, using the example of the reference data including the first reference plaintext and the target processing result used to represent the consistency between the target ciphertext and the first reference plaintext.

[0104] In step S210, server 1 first generates two independent sets of random numbers: one type of random number in the first set is... , Type II random numbers are The second group contains one type of random number. , Type II random numbers are Subsequently, in step S220, server 1 utilizes the homomorphic property of the (2,2)-threshold Paillier cryptosystem, combined with the input target ciphertext... First reference plaintext, i.e. plaintext parameters The first group of random numbers contains a type of random number. and second-type random numbers Construct the first blinded ciphertext (i.e., the first ciphertext). Specifically, this construction falls into two cases: if Server 1 calculates of The power (scalar multiplication homomorphism) is then combined with a newly encrypted random number. Performing encrypted multiplication (addition homomorphism) yields... .like Server 1 then calculates of Power of, and with Multiply, we get Meanwhile, server 1 uses a second set of random numbers. and the same The second blinded ciphertext (i.e. the first ciphertext) is constructed in a completely similar manner. :like ,but .like ,but After constructing and Then, in step S230, server 1 uses its private key share Perform partial decryption to obtain the first intermediate plaintext. and Finally, server 1 sends the tuple to server 2: .

[0105] In step S250, server 1 receives the intermediate processing result sent by server 2. and Then, use the random bits it generates. Using the homomorphic properties of the (2,2)-threshold Paillier cryptosystem, calculate the final encryption equivalence judgment result. .

[0106] The following describes the encrypted data processing method provided in this application, taking as an example that the reference data includes a first reference plaintext and a second reference ciphertext, and the target processing result is used to represent the encrypted condition product corresponding to the target ciphertext.

[0107] In step S210, server 1 first generates two independent sets of random numbers: the first set includes one type of random number. , and second-type random numbers The second group includes a type of random numbers. , and second-type random numbers Subsequently, in step S220, server 1 utilizes the homomorphic property of the (2,2)-threshold Paillier cryptosystem, combined with the input target ciphertext... First reference plaintext, i.e. plaintext parameters The first set of random numbers and random bits Construct the first blinded ciphertext Specifically, this construction falls into two cases: if Server 1 calculates of The power (scalar multiplication homomorphism) is then combined with a newly encrypted random number. Performing encrypted multiplication (addition homomorphism) yields... .like Server 1 then calculates of Power of, and with Multiply, we get Meanwhile, server 1 uses a second set of random numbers. and the same Construct a second blinded ciphertext in a completely similar manner. :like ,but .like ,but After constructing and Then, in step S230, server 1 uses its private key share Perform partial decryption separately to obtain and Finally, server 1 will contain the target ciphertext. tuple Send to server 2.

[0108] In step S250, server 1 receives the intermediate processing result. Then, use the random bits it generates. And the second reference ciphertext entered. (for processing) The final encryption conditional product is calculated by combining these two intermediate results using homomorphic operations (the power of the product). .

[0109] In the aforementioned encrypted data processing method, the following steps are taken: First, target ciphertext, reference data, a type I random number, and a type II random number are obtained. The target ciphertext is encrypted using a target public key. Then, the type I random number, target ciphertext, and reference data are encrypted using the type II random number and the target public key to obtain a first ciphertext. Next, the first ciphertext is decrypted using a first private key to obtain a first intermediate plaintext, and both the first ciphertext and the first intermediate plaintext are sent to a second private key manager. The intermediate processing result sent by the second private key manager is received. This intermediate processing result is then obtained by the second private key manager decrypting the first ciphertext and the first intermediate plaintext using the second private key. Finally, the target processing result is determined based on the type II random number, the intermediate processing result, and the target public key. The target public key corresponds to the target private key constructed from the first and second private keys. The target processing result serves as the basis for managing the target ciphertext. In this process, the computation task is performed by two machines each holding a share of the private key. and The servers work together: Server 1 (the first private key manager) is responsible for generating blinded ciphertext and initiating partial decryption; Server 2 (the second private key manager) is responsible for performing threshold decryption, plaintext comparison and returning the encryption result, ensuring that a single server cannot decrypt the data, thus ensuring the security of encrypted data during the processing of encrypted data.

[0110] Based on the technical solutions of the above embodiments, this application also provides an optional embodiment. In this optional embodiment, the method is applied to... Figure 1 Taking the second private key manager 104 as an example, the explanation includes the following steps:

[0111] S310, receive the first ciphertext and the first intermediate plaintext sent by the first private key manager.

[0112] The first ciphertext is obtained by the first private key manager encrypting a type of random number, the target ciphertext, and reference data using two types of random numbers and the target public key; the first intermediate plaintext is obtained by the first private key manager decrypting the first ciphertext using the first private key; and the target ciphertext is obtained by encrypting the target public key.

[0113] S320, based on the second private key, decrypts the first ciphertext and the first intermediate plaintext to obtain the intermediate processing result.

[0114] In one alternative implementation, the first ciphertext can be decrypted based on the second private key to obtain the second intermediate plaintext; the target intermediate plaintext can be determined based on the first and second intermediate plaintexts; and the intermediate processing result can be determined based on the relationship between the target intermediate plaintext and a third preset value.

[0115] For example, if the target intermediate plaintext is greater than the third preset value, the fourth preset value can be encrypted based on the target public key to obtain an intermediate processing result; if the target intermediate plaintext is not greater than the third preset value, the fifth preset value can be encrypted based on the target public key to obtain an intermediate processing result.

[0116] The third and fourth preset values ​​can be determined based on human experience or through a large number of experiments. In this application, the third and fourth preset values ​​can be determined based on two types of random numbers.

[0117] The following describes the encrypted data processing method provided in this application, using the example of a first reference ciphertext as the reference data and a target processing result used to represent the size relationship between the target ciphertext and the first reference ciphertext.

[0118] After receiving the first ciphertext and the first intermediate plaintext, server 2 first uses its private key share. Execution part decryption Obtain the second intermediate plaintext Next, server 2 combines the first intermediate plaintext. Second intermediate plaintext Execution threshold decryption Recover the target plaintext Server 2 compares the target's intermediate plaintext. With the third preset value Size: If Then, the encryption generation ;like Then, the encryption generation After the calculation is complete, server 2 will encrypt the result. Send back to server 1.

[0119] The following describes the encrypted data processing method provided in this application, using the example of the reference data including the first reference plaintext and the target processing result used to represent the consistency between the target ciphertext and the first reference plaintext.

[0120] Server 2 first processes the first ciphertext. The relevant part: It uses its private key share For the first ciphertext The execution part is decrypted to obtain its share. Next, server 2 combines the share received from server 1. and the share calculated by myself Perform threshold decryption to recover the first intermediate plaintext. Meanwhile, server 2 processes data in exactly the same way as... Relevant part: It uses Decryption of the execution part And then perform threshold decryption. To recover the second intermediate plaintext Subsequently, server 2, according to and and The comparison result triggers a conditional homomorphic operation: for ,like (If the condition is true), then calculate. ;like (If the condition is false), then calculate. ;for ,like (If the condition is true), then calculate. ;like (If the condition is false), then calculate. After the calculation is completed, server 2 uses the two encrypted intermediate results as intermediate processing results. Send back to server 1.

[0121] The following describes the encrypted data processing method provided in this application, taking as an example that the reference data includes a first reference plaintext and a second reference ciphertext, and the target processing result is used to represent the encrypted condition product corresponding to the target ciphertext.

[0122] Server 2 first processes the first ciphertext. The relevant part: It uses its private key share For the first ciphertext The execution part is decrypted to obtain its share. Next, server 2 combines the share received from server 1. and the share calculated by myself Perform threshold decryption to recover the first intermediate plaintext. Meanwhile, server 2 processes data in exactly the same way as... Relevant part: It uses Decryption of the execution part And then perform threshold decryption. To recover the second intermediate plaintext Subsequently, server 2, according to and and The comparison result triggers a conditional homomorphic operation: for ,like (If the condition is true), then calculate. (correspond );like (If the condition is false), then calculate. (correspond );for ,like (If the condition is true), then calculate. (correspond );like (If the condition is false), then calculate. (correspond After the calculation is complete, server 2 uses the two encrypted intermediate results as intermediate processing results. Send back to server 1.

[0123] S330, send the intermediate processing result to the first private key manager so that the first private key manager can determine the target processing result based on the two types of random numbers, the intermediate processing result and the target public key.

[0124] The target public key corresponds to the target private key constructed from the first and second private keys; the target processing result serves as the basis for managing the target ciphertext.

[0125] The above encryption method involves obtaining target ciphertext, reference data, a type I random number, and a type II random number; encrypting the target ciphertext using a target public key; encrypting the type I random number, target ciphertext, and reference data using the type II random number and the target public key to obtain a first ciphertext; decrypting the first ciphertext using a first private key to obtain a first intermediate plaintext, and sending the first ciphertext and the first intermediate plaintext to a second private key manager; receiving the intermediate processing result from the second private key manager; decrypting the first ciphertext and the first intermediate plaintext using the second private key to obtain the intermediate processing result; determining the target processing result based on the type II random number, the intermediate processing result, and the target public key; the target public key corresponds to the target private key constructed from the first and second private keys; and the target processing result serves as the basis for managing the target ciphertext. In this process, the computation task is performed by two machines each holding a share of the private key. and The servers work together: Server 1 (the first private key manager) is responsible for generating blinded ciphertext and initiating partial decryption; Server 2 (the second private key manager) is responsible for performing threshold decryption, plaintext comparison and returning the encryption result, ensuring that a single server cannot decrypt the data, thus ensuring the security of encrypted data during the processing of encrypted data.

[0126] Based on the technical solutions of the above embodiments, this application also provides an optional embodiment. In this embodiment, the interaction of the encrypted data processing method provided by this application is described in detail.

[0127] See Figure 4A The timing diagram of the encrypted data processing method shown includes:

[0128] S401, the first private key manager obtains the target ciphertext, reference data, a type I random number, and a type II random number;

[0129] The target ciphertext is obtained by encrypting it using the target public key;

[0130] Specifically, when the reference data includes a first reference ciphertext, the target processing result is used to represent the size relationship between the target ciphertext and the first reference ciphertext; when the reference data includes a first reference plaintext, the target processing result is used to represent the consistency between the target ciphertext and the first reference plaintext; when the reference data includes a first reference plaintext and a second reference ciphertext, the target processing result is used to represent the encryption condition product corresponding to the target ciphertext; the encryption condition product is the product of the target ciphertext and either the first reference plaintext or the second reference ciphertext.

[0131] S402A, when the second type of random number is equal to the first preset value, the first private key manager encrypts the first type of random number, the target ciphertext, and the reference data based on the first encryption method and the target public key to obtain the first ciphertext;

[0132] S402B, when the second type of random number is equal to the second preset value, the first private key manager encrypts the first type of random number, the target ciphertext, and the reference data based on the second encryption method and the target public key to obtain the first ciphertext; the first preset value is greater than the second preset value;

[0133] The first encryption method and the second encryption method use different types of random numbers.

[0134] S403, the first private key manager decrypts the first ciphertext based on the first private key to obtain the first intermediate plaintext;

[0135] S404, The first private key manager sends the first ciphertext and the first intermediate plaintext to the second private key manager;

[0136] S405, the second private key manager decrypts the first ciphertext based on the second private key to obtain the second intermediate plaintext;

[0137] S406, the second private key manager determines the target intermediate plaintext based on the first intermediate plaintext and the second intermediate plaintext;

[0138] S407A, when the target intermediate plaintext is greater than the third preset value, the second private key manager encrypts the fourth preset value based on the target public key to obtain the intermediate processing result.

[0139] S407B, the second private key manager encrypts the fifth preset value based on the target public key, provided that the target intermediate plaintext is no greater than the third preset value, to obtain the intermediate processing result.

[0140] S408, the second private key manager sends the intermediate processing result to the first private key manager.

[0141] S409, the first private key manager determines the target processing result based on two types of random numbers, intermediate processing results, and the target public key; the target public key corresponds to the target private key constructed from the first and second private keys; the target processing result is the basis for managing the target ciphertext.

[0142] This embodiment specifically includes:

[0143] (1) Security Ranking: The ranking function The aim is to element vector Each element in Mapped to its position in the sorted sequence (e.g., The ranking is This implementation follows the theoretical framework of SOTA, through basic matrix operations (such as...). The calculation formula for the proposed CMP protocol implementation is as follows: This method improves efficiency while maintaining correctness by using CMP instead of the SOTA comparison primitives.

[0144] (2) Secure Order Statistics: The order statistics function The aim is to extract from the input element vector Select the first one from the ordered arrangement The fourth largest element in (4,6,1,5,3) is 5. This implementation utilizes the ranking function described in (1). The calculation formula for the proposed security product protocol is as follows: This method avoids dependence on homomorphic multiplication while maintaining correctness and improving efficiency by using CMP and Product instead of SOTA's comparison and indicator primitives.

[0145] (3) Secure Sorting: The sorting function The aim is to element vector The elements are arranged in a specific order (e.g., (4,6,1,5,3) are sorted as (1,3,4,5,6)). This implementation is based on SOTA and utilizes the ranking function described in (1). Basic matrix operations (such as) The calculation formula for the proposed security Product protocol is as follows:

[0146] ,in It is a by The size of the constant matrix is ​​determined by the value of the matrix. This method achieves the same correctness preservation, efficiency gain, and avoidance of homomorphic multiplication by replacing the primitives of SOTA with CMP and Product.

[0147] See Figure 4B The diagram illustrates the application environment of the encrypted data processing method, and provides a detailed description of the embodiments of this application.

[0148] For the Security Comparison Protocol (CMP), the following steps are included:

[0149] Step 1: Server 1 performs the computation. Assume that in this application example, the public key of the (2,2)-threshold Paillier cryptosystem is... Includes parameters ,in It is a large integer, represented as Server 1 receives the input ciphertext. (Corresponding plaintext) )and (Corresponding plaintext) Server 1 first generates random numbers. Based on security parameters... Random selection Subsequently, from Scope (i.e.) Select ) At the same time, server 1 randomly selects a bit. Subsequently, server 1, according to The value is used to construct a blinded ciphertext through homomorphic operations. ;

[0150] The ciphertext Corresponding plaintext The calculation is as follows:

[0151]

[0152]

[0153]

[0154]

[0155] Server 1 calculates the ciphertext. After the calculation is complete, server 1 uses its private key share. Execution part decryption get Finally, server 1 will... Send to server 2.

[0156] Step 2: Server 2 performs the calculation. Server 2 receives... Then, first use its private key share. Execution part decryption get Next, server 2 combined... and Execution threshold decryption Recover the intermediate plaintext Server 2 comparison and (Right now The size of ). Because ,satisfy The conditions. According to the agreement, if Then, the encryption generation After the calculation is complete, server 2 will encrypt the result. (Right now Send it back to server 1.

[0157] Step 3: Server 1 performs the calculation. Server 1 receives... (Right now After that, use the random bits generated in step one. Using the homomorphic properties of the (2,2)-threshold Paillier cryptosystem, calculate the final encryption comparison result. :

[0158]

[0159]

[0160]

[0161] Utilizing homomorphic properties (scalar multiplication and addition are homomorphic):

[0162]

[0163]

[0164] Final output ciphertext The plaintext corresponding to this result. That is correct, because .

[0165] For the equivalence determination protocol (CMP1), the following steps are included:

[0166] Step 1: Server 1 performs the calculation. Server 1 first generates two independent sets of random numbers: the first set is... , and a random bit The second group is , and a random bit Subsequently, server 1 utilizes the homomorphic property of the (2,2)-threshold Paillier cryptosystem, combined with the input ciphertext... Plaintext parameters The first set of random numbers and random bits Construct the first blinded ciphertext Specifically, this construction falls into two cases: if Server 1 calculates of The power (scalar multiplication homomorphism) is then combined with a newly encrypted random number. Performing encrypted multiplication (addition homomorphism) yields... .like Server 1 then calculates of Power of, and with Multiply, we get Meanwhile, server 1 uses a second set of random numbers. and the same Construct a second blinded ciphertext in a completely similar manner. :like ,but .like ,but After constructing and Then, server 1 uses its private key share Perform partial decryption separately to obtain and Finally, server 1 sends the tuple to server 2: .

[0167] Step 2: Server 2 performs the computation. Server 2 receives the tuple from Server 1. Server 2 first processes the... The relevant part: It uses its private key share For ciphertext The execution part is decrypted to obtain its share. Next, server 2 combines the share received from server 1. and the share calculated by myself Perform threshold decryption to recover the first intermediate plaintext. Meanwhile, server 2 processes data in exactly the same way as... Relevant part: It uses Decryption of the execution part And then perform threshold decryption. To recover the second intermediate plaintext Subsequently, server 2, according to and and The comparison result triggers a conditional homomorphic operation: for ,like (If the condition is true), then calculate. ;like (If the condition is false), then calculate. ;for ,like (If the condition is true), then calculate. ;like (If the condition is false), then calculate. After the calculation is complete, server 2 will send the two encrypted intermediate results. Send back to server 1.

[0168] Step 3: Server 1 performs the calculation. Server 1 receives... and Then, use the random bits generated in step one. Using the homomorphic properties of the (2,2)-threshold Paillier cryptosystem, calculate the final encryption equivalence judgment result. .

[0169] For the conditional product protocol (Product), the following steps are included:

[0170] Step 1: Server 1 performs the calculation. Server 1 first generates two independent sets of random numbers: the first set is... , and a random bit The second group is , and a random bit Subsequently, server 1 utilizes the homomorphic property of the (2,2)-threshold Paillier cryptosystem, combined with the input ciphertext... Plaintext parameters The first set of random numbers and random bits Construct the first blinded ciphertext Specifically, this construction falls into two cases: if Server 1 calculates of The power (scalar multiplication homomorphism) is then combined with a newly encrypted random number. Performing encrypted multiplication (addition homomorphism) yields... .like Server 1 then calculates of Power of, and with Multiply, we get Meanwhile, server 1 uses a second set of random numbers. and the same Construct a second blinded ciphertext in a completely similar manner. :like ,but .like ,but After constructing and Then, server 1 uses its private key share Perform partial decryption separately to obtain and Finally, server 1 will contain the target ciphertext. tuple Send to server 2.

[0171] Step 2: Server 2 performs the computation. Server 2 receives the tuple from Server 1. Server 2 first processes the... The relevant part: It uses its private key share For ciphertext The execution part is decrypted to obtain its share. Next, server 2 combines the share received from server 1. and the share calculated by myself Perform threshold decryption to recover the first intermediate plaintext. Meanwhile, server 2 processes data in exactly the same way as... Relevant part: It uses Decryption of the execution part And then perform threshold decryption. To recover the second intermediate plaintext Subsequently, server 2, according to and and The comparison result triggers a conditional homomorphic operation: for ,like (If the condition is true), then calculate. (correspond );like (If the condition is false), then calculate. (correspond );for ,like (If the condition is true), then calculate. (correspond );like (If the condition is false), then calculate. (correspond After the calculation is complete, server 2 will send the two encrypted intermediate results. Send back to server 1.

[0172] Step 3: Server 1 performs the calculation. Server 1 receives... Then, use the random bits generated in step one. And the input ciphertext (for processing) The final encryption conditional product is calculated by combining these two intermediate results using homomorphic operations (the power of the product). .

[0173] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0174] First, this invention employs a dual integration mechanism based on the (2,2)-threshold Paillier security protocol and SOTA matrix encoding. Specifically, the method innovatively integrates SOTA's efficient matrix encoding concept with the novel (2,2)-threshold Paillier security protocol to construct a "matrix construction-secure comparison" collaborative computing architecture. At the matrix construction layer, the system inherits SOTA's core contributions, transforming the comparison of vector pairs into a one-time matrix comparison through operations such as RepIC and RepIR. At the secure computing layer, this invention uses a newly proposed secure comparison protocol (CMP) to replace the expensive comparison primitives based on CKKS in SOTA. This design achieves both the inheritance of SOTA's core ideas and the replacement of key shortcomings: the approximation errors and high overhead present in the SOTA scheme are completely resolved, thus fundamentally ensuring the deterministic correctness of the computational results and improving computational efficiency.

[0175] Second, a performance-balanced architecture that balances deterministic correctness and efficient computation. This scheme deeply integrates the (2,2)-threshold Paillier cryptosystem with a dual-server collaborative computing model, constructing a two-layer protection system that balances correctness and efficiency in an untrusted cloud server environment. Specifically, the computation task is performed by two servers, each holding a share of the private key. and The server-side collaborative execution is as follows: Server 1 is responsible for generating blinded ciphertext and initiating partial decryption; Server 2 is responsible for performing threshold decryption, plaintext comparison, and returning the encryption result. This mechanism ensures that a single point server cannot decrypt the data. In addition, a secure comparison protocol (CMP) and a secure conditional product protocol (Product) are innovatively introduced. The latter implements conditional selection functionality without relying on the native homomorphic multiplication of the Paillier cryptosystem. Compared with the SOTA technology based on CKKS, this scheme, while ensuring the deterministic correctness of the calculation result, overcomes the core limitations of traditional schemes (1) having approximation errors; (2) only supporting datasets of power-of-2 size; and (3) having huge comparison overhead, providing more efficient and scalable technical support for encrypted database queries and secure computation.

[0176] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0177] Based on the same inventive concept, this application also provides an encrypted data processing apparatus for implementing the encrypted data processing method described above. The solution provided by this apparatus is similar to the implementation scheme described in the above method; therefore, the specific limitations in one or more encrypted data processing apparatus embodiments provided below can be found in the limitations of the encrypted data processing method described above, and will not be repeated here.

[0178] In one exemplary embodiment, such as Figure 5As shown, an encrypted data processing device is provided, comprising: a first acquisition module 510, a first determination module 520, a second determination module 530, a first receiving module 540, and a third determination module 550, wherein:

[0179] The first acquisition module 510 is used to acquire target ciphertext, reference data, a type I random number, and a type II random number; the target ciphertext is obtained by encryption based on the target public key; when the reference data includes a first reference ciphertext, the target processing result is used to represent the size relationship between the target ciphertext and the first reference ciphertext; when the reference data includes a first reference plaintext, the target processing result is used to represent the consistency between the target ciphertext and the first reference plaintext; when the reference data includes a first reference plaintext and a second reference ciphertext, the target processing result is used to represent the encryption condition product corresponding to the target ciphertext; the encryption condition product is the product of the target ciphertext and the first reference plaintext or the second reference ciphertext.

[0180] The first determining module 520 is used to encrypt a type of random number, a target ciphertext, and reference data based on a type of random number and a target public key to obtain the first ciphertext.

[0181] The second determining module 530 is used to decrypt the first ciphertext based on the first private key to obtain the first intermediate plaintext, and send the first ciphertext and the first intermediate plaintext to the second private key manager.

[0182] The first receiving module 540 is used to receive the intermediate processing result sent by the second private key manager; the intermediate processing result is obtained by the second private key manager decrypting the first ciphertext and the first intermediate plaintext based on the second private key.

[0183] The third determining module 550 is used to determine the target processing result based on the two types of random numbers, intermediate processing results and target public key; the target public key corresponds to the target private key constructed by the first private key and the second private key; the target processing result is the basis for managing the target ciphertext.

[0184] In one embodiment, the first determining module 520 includes a first determining unit, configured to encrypt a type of random number, a target ciphertext, and reference data based on a first encryption method and a target public key when the two types of random numbers are equal to a first preset value, to obtain a first ciphertext; and a second determining unit, configured to encrypt a type of random number, a target ciphertext, and reference data based on a second encryption method and a target public key when the two types of random numbers are equal to a second preset value, to obtain the first ciphertext; wherein the first preset value is greater than the second preset value; and the type of random number used in the first encryption method and the second encryption method is different.

[0185] In one exemplary embodiment, such as Figure 6As shown, an encrypted data processing apparatus is provided, comprising: a second receiving module 610, a fourth determining module 620, and a sending module 630, wherein:

[0186] The second receiving module 610 is used to receive the first ciphertext and the first intermediate plaintext sent by the first private key manager; wherein, the first ciphertext is obtained by the first private key manager encrypting a type of random number, the target ciphertext and the reference data according to the two types of random numbers and the target public key; the first intermediate plaintext is obtained by the first private key manager decrypting the first ciphertext based on the first private key; the target ciphertext is obtained by encrypting based on the target public key.

[0187] The fourth determining module 620 is used to decrypt the first ciphertext and the first intermediate plaintext based on the second private key to obtain the intermediate processing result.

[0188] The sending module 630 is used to send the intermediate processing result to the first private key manager, so that the first private key manager can determine the target processing result based on the two types of random numbers, the intermediate processing result and the target public key; the target public key corresponds to the target private key constructed by the first private key and the second private key; the target processing result is the basis for managing the target ciphertext.

[0189] In one embodiment, the fourth determining module 620 includes a third determining unit, used to decrypt the first ciphertext based on the second private key to obtain the second intermediate plaintext; a fourth determining unit, used to determine the target intermediate plaintext based on the first intermediate plaintext and the second intermediate plaintext; and a fifth determining unit, used to determine the intermediate processing result based on the size relationship between the target intermediate plaintext and a third preset value.

[0190] In one embodiment, the fifth determining unit includes a first determining subunit, configured to encrypt a fourth preset value based on the target public key to obtain an intermediate processing result when the target intermediate plaintext is greater than a third preset value; and a second determining subunit, configured to encrypt a fifth preset value based on the target public key to obtain an intermediate processing result when the target intermediate plaintext is not greater than a third preset value.

[0191] Each module in the aforementioned encrypted data processing device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0192] In one exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 7As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When executed by the processor, the computer program implements an encrypted data processing method. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0193] Those skilled in the art will understand that Figure 7 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0194] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.

[0195] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps in the above method embodiments.

[0196] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0197] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0198] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0199] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0200] The above embodiments are merely illustrative of several implementation methods of this application, and their descriptions are relatively specific and detailed. However, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for encrypting data processing, characterized in that, Applied to the first private key manager, the method includes: Obtain the target ciphertext, reference data, a type I random number, and a type II random number; the target ciphertext is obtained by encryption based on the target public key. Based on the two types of random numbers and the target public key, the first type of random number, the target ciphertext, and the reference data are encrypted to obtain the first ciphertext. Based on the first private key, the first ciphertext is decrypted to obtain the first intermediate plaintext, and the first ciphertext and the first intermediate plaintext are sent to the second private key manager; Receive the intermediate processing result sent by the second private key manager; the intermediate processing result is obtained by the second private key manager decrypting the first ciphertext and the first intermediate plaintext based on the second private key; The target processing result is determined based on the two types of random numbers, the intermediate processing result, and the target public key; the target public key corresponds to the target private key constructed from the first private key and the second private key; the target processing result serves as the basis for managing the target ciphertext.

2. The method according to claim 1, characterized in that, The first ciphertext is obtained by encrypting the first type of random number, the target ciphertext, and the reference data according to the second type of random number and the target public key, including: When the second type of random number is equal to the first preset value, the first type of random number, the target ciphertext, and the reference data are encrypted based on the first encryption method and the target public key to obtain the first ciphertext; When the second type of random number is equal to the second preset value, the first type of random number, the target ciphertext, and the reference data are encrypted based on the second encryption method and the target public key to obtain the first ciphertext; the first preset value is greater than the second preset value; The first encryption method and the second encryption method use different types of random numbers.

3. The method according to claim 1, characterized in that, When the reference data includes a first reference ciphertext, the target processing result is used to represent the size relationship between the target ciphertext and the first reference ciphertext; When the reference data includes a first reference plaintext, the target processing result is used to indicate the consistency between the target ciphertext and the first reference plaintext; When the reference data includes the first reference plaintext and the second reference ciphertext, the target processing result is used to represent the encryption condition product corresponding to the target ciphertext; The encryption condition product is the product of the target ciphertext and the first reference plaintext or the second reference ciphertext.

4. A method for encrypting data processing, characterized in that, Applied to a second private key manager, the method includes: The system receives a first ciphertext and a first intermediate plaintext sent by a first private key manager; wherein the first ciphertext is obtained by the first private key manager encrypting a type of random number, a target ciphertext, and reference data based on two types of random numbers and a target public key; the first intermediate plaintext is obtained by the first private key manager decrypting the first ciphertext based on the first private key; and the target ciphertext is obtained by encrypting based on the target public key. Based on the second private key, the first ciphertext and the first intermediate plaintext are decrypted to obtain the intermediate processing result; The intermediate processing result is sent to the first private key manager so that the first private key manager can determine the target processing result based on the two types of random numbers, the intermediate processing result, and the target public key; the target public key corresponds to the target private key constructed from the first private key and the second private key; the target processing result is the basis for managing the target ciphertext.

5. The method according to claim 4, characterized in that, The process of decrypting the first ciphertext and the first intermediate plaintext based on the second private key to obtain an intermediate processing result includes: Based on the second private key, the first ciphertext is decrypted to obtain the second intermediate plaintext; Determine the target intermediate plaintext based on the first intermediate plaintext and the second intermediate plaintext; The intermediate processing result is determined based on the relationship between the target intermediate plaintext and the third preset value.

6. The method according to claim 5, characterized in that, The step of determining the intermediate processing result based on the relationship between the target intermediate plaintext and the third preset value includes: If the target plaintext is greater than the third preset value, the fourth preset value is encrypted based on the target public key to obtain the intermediate processing result. If the target plaintext is not greater than the third preset value, the fifth preset value is encrypted based on the target public key to obtain the intermediate processing result.

7. An encrypted data processing device, characterized in that, Configured in the first private key manager, the device includes: The first acquisition module is used to acquire target ciphertext, reference data, a type I random number, and a type II random number; the target ciphertext is obtained by encryption based on the target public key. The first determining module is used to encrypt the first type of random number, the target ciphertext, and the reference data according to the second type of random number and the target public key to obtain the first ciphertext; The second determining module is used to decrypt the first ciphertext based on the first private key to obtain the first intermediate plaintext, and send the first ciphertext and the first intermediate plaintext to the second private key manager; The first receiving module is used to receive the intermediate processing result sent by the second private key manager; the intermediate processing result is obtained by the second private key manager decrypting the first ciphertext and the first intermediate plaintext based on the second private key; The third determining module is used to determine the target processing result based on the two types of random numbers, the intermediate processing result, and the target public key; the target public key corresponds to the target private key constructed from the first private key and the second private key; the target processing result is the basis for managing the target ciphertext.

8. An encrypted data processing device, characterized in that, Configured in a second private key manager, the device includes: The second receiving module is used to receive a first ciphertext and a first intermediate plaintext sent by the first private key manager; wherein, the first ciphertext is obtained by the first private key manager encrypting a type of random number, a target ciphertext, and reference data based on two types of random numbers and a target public key; the first intermediate plaintext is obtained by the first private key manager decrypting the first ciphertext based on the first private key; and the target ciphertext is obtained by encrypting based on the target public key. The fourth determining module is used to decrypt the first ciphertext and the first intermediate plaintext based on the second private key to obtain the intermediate processing result; The sending module is used to send the intermediate processing result to the first private key manager, so that the first private key manager can determine the target processing result based on the two types of random numbers, the intermediate processing result, and the target public key; the target public key corresponds to the target private key constructed by the first private key and the second private key; the target processing result is the basis for managing the target ciphertext.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1-6.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1-6.

Images