Data similarity search method and system of controllable precision lattice homomorphic encryption inner product

Abstract

This invention provides a data similarity retrieval method and system with controllable precision lattice-based homomorphic encryption inner product, relating to the fields of privacy computing and secure retrieval technology. The retrieval terminal performs polynomial encoding on the retrieval vector to obtain a retrieval plaintext polynomial; the retrieval plaintext polynomial is then subjected to lattice-based homomorphic encryption to obtain retrieval ciphertext; the server performs homomorphic multiplication on the retrieval ciphertext and the data ciphertext to obtain a discrimination ciphertext; the retrieval terminal decrypts the discrimination ciphertext; the constant term coefficient of the decryption polynomial determines whether the retrieval match is successful; the data ciphertext is obtained based on lattice-based homomorphic encryption of the data plaintext polynomial; the data plaintext polynomial is obtained by polynomial encoding of the data feature vector based on a similarity threshold; the constant term coefficient of the product of the data plaintext polynomial and the retrieval plaintext polynomial is equal to the difference between the inner product of the data feature vector, the retrieval vector, and the similarity threshold. This solves the problem that traditional searchable encryption only supports exact matching and is prone to revealing query intent.

Description

Technical Field

[0001] This invention relates to the field of privacy computing and secure retrieval technology, specifically to a data similarity retrieval method and system with controllable precision lattice-based homomorphic encrypted inner product. Background Technology

[0002] With the deepening of digital transformation, data has become a core production factor driving socio-economic development. The aggregation and analysis of massive amounts of data play a crucial role in many fields such as smart grids, financial risk control, biometric identification, medical diagnosis, and IoT monitoring. However, data often contains highly sensitive personal privacy or trade secrets, and the centralized storage and processing of data in the cloud faces serious risks of leakage and a crisis of trust.

[0003] To resolve the conflict between data circulation and utilization and privacy protection, privacy computing technology has emerged, aiming to ensure that data remains encrypted throughout its entire lifecycle of computation, storage, and transmission. However, real-world data (such as biometric templates, user behavior profiles, and sensor time-series sequences) are inherently massive, multi-source, and high-dimensional, typically represented as high-dimensional feature vectors or matrices. Existing encrypted retrieval technologies, such as traditional symmetric / asymmetric searchable encryption (SE) mechanisms, mostly only support exact matching for specific keywords and easily expose user query intent during the search process, failing to meet the complex analysis scenarios requiring end-to-end encryption of high-dimensional data. Summary of the Invention

[0004] To overcome the above-mentioned technical problems, the present invention provides a data similarity retrieval method and system with controllable precision lattice-based homomorphic encrypted inner product.

[0005] On one hand, the present invention provides a data similarity retrieval method with controllable precision lattice-based homomorphic encrypted inner product, comprising: The server receives encrypted data sent by the data provider and stores the encrypted data in the target database. The retrieval terminal performs polynomial encoding on the retrieval vector to obtain the retrieval plaintext polynomial; it then uses the obtained public key to perform lattice-based homomorphic encryption on the retrieval plaintext polynomial to obtain the retrieval ciphertext and sends the retrieval ciphertext to the server. The server performs a homomorphic multiplication operation on the received retrieval ciphertext and the data ciphertext in the target database to obtain the discrimination ciphertext, and then sends the discrimination ciphertext to the retrieval terminal. The retrieval terminal uses the obtained private key to decrypt the discrimination ciphertext to obtain a decryption polynomial; based on the constant term coefficients of the decryption polynomial, it determines whether the retrieval and matching in the target database is successful. Wherein, the encrypted data is obtained by performing lattice basis homomorphic encryption on the plaintext data polynomial; the plaintext data polynomial is obtained by polynomial encoding of the data feature vector based on a preset similarity threshold; the data feature vector is obtained by discretizing the data to be uploaded; the retrieval vector is obtained by discretizing the retrieval content input by the user; the constant term coefficient of the product of the plaintext data polynomial and the retrieval plaintext polynomial is equal to the difference between the inner product of the data feature vector, the retrieval vector and the similarity threshold.

[0006] On the other hand, the present invention also provides a data similarity retrieval method with controllable precision lattice-based homomorphic encrypted inner product, applied to a retrieval terminal, comprising: The search content input by the user is discretized and encoded to obtain a search vector; the search vector is then multinomial encoded to obtain the search plaintext polynomial. The obtained public key is used to perform lattice-based homomorphic encryption on the retrieval plaintext polynomial to obtain the retrieval ciphertext, which is then sent to the server. The system receives the ciphertext from the server and decrypts it using the obtained private key to obtain a decryption polynomial. Based on the coefficients of the constant term of the decryption polynomial, it determines whether the search for a match in the target database is successful. Wherein, the discrimination ciphertext is obtained by performing a homomorphic multiplication operation on the retrieval ciphertext and the data ciphertext, and the data ciphertext is obtained by performing lattice basis homomorphic encryption on the data plaintext polynomial; the data plaintext polynomial is obtained by polynomial encoding of the data feature vector based on a preset similarity threshold; the data feature vector is obtained by discretizing the data to be uploaded; the constant term coefficient of the product of the data plaintext polynomial and the retrieval plaintext polynomial is equal to the difference between the inner product of the data feature vector, the retrieval vector and the similarity threshold.

[0007] On the other hand, the present invention also provides a data similarity retrieval method with controllable precision lattice-based homomorphic encrypted inner product, applied to a server, comprising: Receive encrypted data sent by the data provider and store the encrypted data in the target database; The system receives ciphertext from the retrieval terminal and performs a homomorphic multiplication operation on the ciphertext and the data ciphertext in the target database to obtain the discrimination ciphertext. The ciphertext is sent to the retrieval terminal so that the retrieval terminal can determine whether the search for a match in the target database is successful based on the decryption result of the ciphertext. Wherein, the encrypted data is obtained by performing lattice-based homomorphic encryption on the plaintext data polynomial; the plaintext data polynomial is obtained by performing polynomial encoding on the data feature vector based on a preset similarity threshold; the data feature vector is obtained by discretizing the data to be uploaded; the ciphertext for retrieval is obtained by performing lattice-based homomorphic encryption on the plaintext retrieval polynomial; the plaintext retrieval polynomial is obtained by performing polynomial encoding on the retrieval vector; the retrieval vector is obtained by discretizing the retrieval content input by the user; the constant term coefficient of the product of the plaintext data polynomial and the plaintext retrieval polynomial is equal to the difference between the inner product of the data feature vector, the retrieval vector and the similarity threshold.

[0008] On the other hand, the present invention also provides a retrieval terminal, comprising: The encoding module is used to discretize the search content input by the user to obtain a search vector; and to perform polynomial encoding on the search vector to obtain the search plaintext polynomial. The encryption module is used to perform lattice-based homomorphic encryption on the retrieved plaintext polynomial using the obtained public key to obtain the retrieved ciphertext and send the retrieved ciphertext to the server; The decryption module is used to receive the discrimination ciphertext from the server, and use the obtained private key to decrypt the discrimination ciphertext to obtain a decryption polynomial; based on the constant term coefficients of the decryption polynomial, it determines whether the search for a match in the target database is successful. Wherein, the discrimination ciphertext is obtained by performing a homomorphic multiplication operation on the retrieval ciphertext and the data ciphertext, and the data ciphertext is obtained by performing lattice basis homomorphic encryption on the data plaintext polynomial; the data plaintext polynomial is obtained by polynomial encoding of the data feature vector based on a preset similarity threshold; the data feature vector is obtained by discretizing the data to be uploaded; the constant term coefficient of the product of the data plaintext polynomial and the retrieval plaintext polynomial is equal to the difference between the inner product of the data feature vector, the retrieval vector and the similarity threshold.

[0009] On the other hand, the present invention also provides a server, comprising: The receiving module is used to receive encrypted data sent by the data provider and store the encrypted data in the target database; The homomorphic operation module is used to receive the retrieval ciphertext from the retrieval terminal, and perform a homomorphic multiplication operation on the retrieval ciphertext and the data ciphertext in the target database to obtain the discrimination ciphertext; The sending module is used to send the discrimination ciphertext to the retrieval terminal, so that the retrieval terminal can determine whether the retrieval and matching in the target database is successful based on the decryption result of the discrimination ciphertext; Wherein, the encrypted data is obtained by performing lattice-based homomorphic encryption on the plaintext data polynomial; the plaintext data polynomial is obtained by performing polynomial encoding on the data feature vector based on a preset similarity threshold; the data feature vector is obtained by discretizing the data to be uploaded; the ciphertext for retrieval is obtained by performing lattice-based homomorphic encryption on the plaintext retrieval polynomial; the plaintext retrieval polynomial is obtained by performing polynomial encoding on the retrieval vector; the retrieval vector is obtained by discretizing the retrieval content input by the user; the constant term coefficient of the product of the plaintext data polynomial and the plaintext retrieval polynomial is equal to the difference between the inner product of the data feature vector, the retrieval vector, and the similarity threshold.

[0010] On the other hand, the present invention also provides a data similarity retrieval system with controllable precision lattice-based homomorphic encrypted inner product, comprising: a retrieval terminal as described in any of the above embodiments and / or a server as described in any of the above embodiments.

[0011] On the other hand, the present invention also provides a readable storage medium having an executable program stored thereon, wherein when the executable program is executed, it implements the method described in any one of the above.

[0012] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention provides a data similarity retrieval method and system with controllable precision, based on homomorphic encryption of inner product. First, the data feature vector and the retrieval vector are discretized and then polynomial-encoded, respectively. A similarity threshold is cleverly embedded into the constant term of the plaintext polynomial on the data side. This ensures that the coefficient of the constant term in the product of the plaintext and retrieval polynomials is exactly equal to the difference between the inner product of the data feature vector, the retrieval vector, and the similarity threshold. This transforms the traditional exact matching problem in encrypted form into a computable and decidable encrypted polynomial algebra problem. Based on this, the server performs homomorphic multiplication on the encrypted data and the encrypted retrieval data, ensuring that the calculation of the inner product difference is completed entirely in encrypted form. The server never accesses any plaintext data or similarity values, achieving dual protection of data content and query intent. After decryption, the retrieval terminal only uses the sign or value of the constant term coefficient of the decrypted polynomial for matching determination, without needing to and being able to recover the specific inner product or difference value. This ensures the correctness of the result while completely eliminating the risk of leakage of the specific similarity value.

[0013] This invention, based on a lattice-based homomorphic encryption system, enables secure retrieval of high-dimensional vector data in a fully encrypted state, supporting complex similarity threshold determination. It effectively overcomes the problem that traditional searchable encryption only supports exact matching and is prone to revealing query intent. Attached Figure Description

[0014] Figure 1 This is a schematic flowchart illustrating a data similarity retrieval method for controllable precision lattice-based homomorphic encryption inner product according to an example of the present invention. Figure 2 This is a schematic diagram illustrating the data owner's upload process for data to be uploaded, as exemplified by the present invention. Figure 3 This is a schematic diagram of the interaction process of a data similarity retrieval method with controllable precision lattice basis homomorphic encryption inner product as an example of the present invention; Figure 4 This is a structural block diagram of a retrieval terminal or server, as an example of the present invention. Figure 5 This is a block diagram illustrating the structure of a data similarity retrieval system with controllable precision lattice-based homomorphic encryption inner product, as an example of the present invention. Detailed Implementation

[0015] The specific embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0016] Example 1 This invention provides a data similarity retrieval method with controllable precision lattice-based homomorphic encrypted inner product, the flowchart of which is shown below. Figure 1 As shown, it includes: Step S110: The server receives the encrypted data sent by the data provider and stores the encrypted data in the target database; Step S120: The retrieval terminal performs polynomial encoding on the retrieval vector to obtain the retrieval plaintext polynomial; it then uses the obtained public key to perform lattice-based homomorphic encryption on the retrieval plaintext polynomial to obtain the retrieval ciphertext and sends the retrieval ciphertext to the server. Step S130: The server performs a homomorphic multiplication operation on the received retrieval ciphertext and the data ciphertext in the target database to obtain the discrimination ciphertext and sends the discrimination ciphertext to the retrieval terminal. Step S140: The retrieval terminal uses the obtained private key to decrypt the discrimination ciphertext to obtain a decryption polynomial; based on the constant term coefficients of the decryption polynomial, it determines whether the retrieval and matching in the target database is successful. Wherein, the encrypted data is obtained by performing lattice basis homomorphic encryption on the plaintext data polynomial; the plaintext data polynomial is obtained by polynomial encoding of the data feature vector based on a preset similarity threshold; the data feature vector is obtained by discretizing the data to be uploaded; the retrieval vector is obtained by discretizing the retrieval content input by the user; the constant term coefficient of the product of the plaintext data polynomial and the retrieval plaintext polynomial is equal to the difference between the inner product of the data feature vector, the retrieval vector and the similarity threshold.

[0017] In this example implementation, the lattice-based homomorphic encryption algorithm can be NTRU (Number Theory Research Unit), a lattice-based public-key encryption algorithm. A trusted third party, such as a Key Management Center (TTP), can generate the public and private keys for lattice-based homomorphic encryption (e.g., NTRU public and private keys) and distribute the corresponding keys to each retrieval terminal and data provider. Each retrieval terminal (user terminal) can be a data querying party for the target database, the server stores the target database, and the data provider can be a data collection and uploading terminal, such as a smart meter in a power scenario or a user information collection device in a credit reporting scenario. The Key Management Center (TTP) can centrally generate system parameters and distribute keys, ensuring the system's trust foundation. This method is executed on a system comprising a Key Management Center, data providers, querying users (retrieval terminals), and a cloud server (server). The system's mathematical foundation is built on a polynomial ring, defined as: The corresponding modular space is defined as follows: In this parameter system, For the operation ring, It is an integer ring. For polynomial variables; The parameter is the polynomial order, and it is a power of 2 (e.g., N=1024, 2048, etc.). For the ciphertext pattern space, For plaintext model space; The ciphertext modulus; The plaintext modulus; and It is an odd number and satisfies The encryption, decryption, and multiplication operations in the system are all... or Regarding modular polynomials Convolution multiplication, modulo Or take a mold The operations are performed according to the corresponding modular space definition. A two-component ciphertext form is used in the polynomial ring modular space, and the cancellation relation of the public key term in the decryption expression is utilized to enable the decryption end to recover the modular value when the correctness constraint is satisfied. The method employs a unique polynomial coefficient set with a signed interpretation. The input for threshold discrimination is taken from the decryption result before inverse scaling, thus maintaining the sign stability brought about by scaling embedding. The specific operation process is as follows: First, the data provider completes data preprocessing and encryption. The data provider possesses the data to be uploaded, i.e., the original data to be retrieved, such as the original data in a database. The data to be uploaded is first processed by discretization encoding, transforming it into a structured, numerical data feature vector. Subsequently, the data provider processes this data feature vector using polynomial encoding. The key to this encoding is that it not only maps the vector components to specific terms of the polynomial but also pre-embeds a preset similarity threshold (τ) into the constant term of the generated polynomial, thereby obtaining the plaintext polynomial. This allows subsequent polynomial multiplication to simultaneously perform inner product calculation and threshold comparison. Next, the data provider encrypts this plaintext polynomial using the public key of a lattice-based homomorphic encryption algorithm, generating ciphertext data, which is then uploaded to the server and stored in the target database. When a user needs to perform a search, the search terminal (i.e., the user terminal) receives the search content input by the user. The search content is first discretized and encoded, transforming it into a search vector with the same dimension as the data feature vector. This search vector is then encoded into a search plaintext polynomial. Unlike data-side encoding, query-side encoding typically does not embed a threshold; its design aims to ensure that, after multiplying with the data-side polynomial, the inner product terms correctly converge to the constant term of the product result. The search terminal uses the same public key to encrypt the search plaintext polynomial, obtaining the search ciphertext, and sends it to the server. The server, as a computing node, receives the search ciphertext and, without decryption or knowing any plaintext information, performs the core encrypted computation. The server retrieves the data ciphertext to be compared from the target database and performs a homomorphic multiplication operation with the received search ciphertext. Due to the nature of homomorphic encryption, the plaintext obtained after decrypting the product of the two ciphertexts is approximately equal to the product of their respective plaintext polynomials. Through the aforementioned ingenious encoding design, the constant term coefficient of the plaintext polynomial corresponding to this product result is theoretically equal to the "data feature vector". With retrieval vector The inner product minus the similarity threshold The difference obtained The server returns the ciphertext result of this multiplication operation as the discrimination ciphertext to the retrieval terminal. Finally, the retrieval terminal uses its private key, paired with the encryption public key, to decrypt the discrimination ciphertext. Decryption yields a decryption polynomial. The user only needs to extract the coefficients of the constant term of this decryption polynomial. If the coefficient is positive (>0), it means the inner product is greater than a threshold. If the coefficient is negative (<0), it means the inner product is less than the threshold. If the constant term coefficient is zero, the result can be output according to preset rules (e.g., the result can be judged as a successful retrieval). This invention can be applied to various encrypted retrieval / query scenarios. For example, in credit reporting scenarios, it can be used to query the credit of a subject to determine whether the subject is on a blacklist or whitelist, assisting in the next credit decision. In the power scenario, it can be used to query the electricity usage range of a target user to determine whether the user belongs to the electricity usage range. In this invention, the data feature vector and query (retrieval vector) always exist in encrypted form on the server. The server cannot know their content, protecting data privacy and query privacy, and achieving full encryption. It also supports similarity judgment based on inner product, which is more flexible and more in line with real-world needs than keyword exact matching, and is suitable for various scenarios such as feature matching and range query. The user only obtains a binary judgment result (yes / no) and cannot know the specific similarity score, avoiding excessive leakage of result information. The entire scheme is built on a quantum-resistant lattice-based encryption algorithm, which has long-term security against quantum attacks.

[0018] Before the search begins, system initialization is performed. During this initialization phase, TTP is responsible for key generation. First, a private key polynomial with limited coefficient amplitude is selected. .exist Selecting random polynomials ,exist Selecting small-coefficient noise polynomials Construct the public key tuple: The second component of the public key satisfies a linear congruence relation: ;in, Represents the public key; The first component polynomial of the public key; This is the second component polynomial of the public key. The private key is defined as follows: The public key structure utilizes the Ring-LWE (Ring-Learning-Weakness) assumption, which ensures the security of the system.

[0019] In some example implementations, the discretization encoding is bucketing indicator encoding. Bucketing indicator encoding is an efficient method for converting continuous or discrete value fields into fixed-length binary vectors, and is particularly suitable for processing range queries or categorical attribute queries.

[0020] For example, the process of forming the data feature vector includes: Divide the value range of the corresponding field of the data to be uploaded into multiple non-overlapping first bucket intervals; For any field of the data to be uploaded, construct the data feature vector corresponding to the field based on the first bucket interval into which the value of the field falls; The length of the data feature vector is the same as the number of first bucket intervals; the element in the data feature vector corresponding to the value of the field in the first bucket interval is set to 1, and the elements in the other first bucket intervals are set to 0. Accordingly, the process of forming the retrieval vector includes: For any search condition, determine the second bucket interval set corresponding to the search condition; For the search content, the corresponding bucket position of the search field that belongs to the second bucket interval set is set to 1, and the corresponding bucket position of the search field that does not belong to the second bucket interval set is set to 0, thus constructing the corresponding search vector; In this example implementation, the retrieval vector and the data feature vector have the same dimension. The corresponding fields of the data to be uploaded are pre-divided into... First, non-overlapping intervals are defined, and these fields are assigned a length of [value]. The bucket indicator vector. For any data record, the value of the corresponding field falls into the bucket indicator vector. When constructing a bucket, construct the component of the data feature vector at the j-th position. The remaining bucket positions are set to 0, that is:

[0021] in, Let i be the i-th positional component of the data feature vector.

[0022] The second bucket set corresponding to search conditions containing multiple target values Construct a retrieval vector Q such that all Location The remaining positions are 0. That is, the value is 1 for the bucket positions that meet the query conditions, and 0 for the other bucket positions.

[0023] This results in the homomorphic inner product result on the bucket indicator dimension corresponding to the field. This is equal to the indicator value of the data record hitting the query bucket set, used to determine whether the field meets the search conditions. The query vector and the data feature vector have the same dimension. When using bucketing indicator encoding, the components corresponding to the fields participating in the search / query take values ​​of 0 or 1, while the vector components corresponding to the fields not participating in the search / query take values ​​of zero. This ensures that the homomorphic inner product result is contributed only by the components of the fields participating in the search / query.

[0024] In some example implementations, the method further includes the following before the server receives the encrypted data sent by the data provider: The data provider performs polynomial encoding on the data feature vector based on a preset similarity threshold and a first encoding index set to obtain an encoding polynomial; The data provider uses a target precision factor to scale the encoded polynomial to obtain the plaintext data polynomial. Accordingly, the retrieval terminal performs polynomial encoding on the retrieval vector to obtain the retrieval plaintext polynomial, including: The retrieval terminal performs polynomial encoding on the retrieval vector based on the second encoding index set to obtain the retrieval plaintext polynomial; The target precision factor is determined based on the dimension and similarity threshold of the data feature vector; the first encoding index set and the second encoding index set satisfy a dual relationship.

[0025] In this example implementation, the data provider is in a polynomial ring. In the middle, for the dimension is Data feature vector , for For the Lth element, select a set of first exponents that are pairwise distinct. and satisfy The feature vector is encoded into a plaintext polynomial on a polynomial ring. During this process, a preset similarity threshold will be used. The negative value (i.e. This is embedded into the constant term of the polynomial to obtain the encoded polynomial, thus aggregating the difference between the inner product and the threshold onto the constant term. The encoded polynomial is shown below:

[0026] in, To encode the polynomial, For polynomial variables, Let i be the i-th element of the first encoded index set. For the polynomial order parameter, And its value is a power of 2; Let i be the i-th element of the data feature vector. The dimension of the data feature vector; This is the similarity threshold. For example, such as... Figure 2 As shown, the data owner can also input plaintext data at the data acquisition / collection terminal. The data acquisition / collection terminal divides the data into data fields according to the plaintext data, obtains the data feature vector through discretization encoding, and converts the similarity threshold and the data feature vector into a data plaintext polynomial through polynomial encoding. The data plaintext polynomial is then encrypted using a lattice base public key to generate ciphertext. The ciphertext is then sent to the server to be stored in the target database.

[0027] The retrieval terminal is used to process user-side search / query requests. It generates a retrieval vector based on the user's search content, with dimensions consistent with the data feature vector. , for The Lth element is used to construct a second encoding exponent set for inner product calculation. , The first and second encoding index sets satisfy a duality relation. The retrieval vector is encoded into a retrieval plaintext polynomial. The details are as follows:

[0028] in, To retrieve plaintext polynomials, This is the i-th element of the second encoding index set; ; To retrieve the i-th element of the vector. The aim is to ensure that the product of two polynomials... The terms can fall into the position of the coefficient of the constant term, as follows: Perform multiplication on the polynomial ring on the encoding polynomial and the retrieval plaintext polynomial:

[0029] The constant term coefficients of the result satisfy:

[0030] in, This is an operation to extract the coefficients of the constant term. For any polynomial... :

[0031] in, For polynomials The Order coefficient, for order, , For model modulus space, For model polynomial ring; definition The coefficient of the constant term is: ; in, For polynomials The coefficient of the constant term; when When used for sign determination, first... The execution center has been upgraded , In the model The central representation of the meta-mapping function is shown below, and with The sign is used as the decision input. The ingenuity of this construction lies in the fact that when performing polynomial multiplication... At that time, the cross term It will be transformed into After being simplified, it becomes Therefore, the coefficient of the constant term in the product result... Will be exactly equal to This is the difference between the inner product result and the threshold.

[0032] Next, to combat the noise introduced by subsequent homomorphic computations, the data provider uses a target precision factor to modify the encoded polynomial. After scaling (scale enlargement), we get:

[0033] in, The target precision factor, For plaintext polynomials, This is the embedding polynomial used for encryption. The target precision factor is selected from the precision factors. For the accuracy factor; to support optional inverse scaling recovery, it is required that... Thus exist , so that:

[0034] in, The greatest common divisor function; the coefficients used for threshold discrimination are taken from the decryption reduction result modulo... The output after the central representative element is mapped; when the correctness constraints are satisfied and the coefficient amplitude does not experience modulo wrap-around, each coefficient has a unique signed integer interpretation in the sense of the central representative element.

[0035] Then, the plaintext polynomial is encrypted using a pre-generated lattice-based public key to obtain ciphertext, which is then sent to the server.

[0036] The retrieval terminal uses the obtained lattice-based public key to perform lattice-based homomorphic encryption on the retrieval plaintext polynomial, obtains the retrieval ciphertext, and sends it to the server.

[0037] For each of the above lattice-based homomorphic encryption processes, a corresponding small-coefficient random polynomial is independently generated. and small coefficient noise polynomials The output two-component ciphertext is then:

[0038]

[0039]

[0040] in, This is the ciphertext corresponding to the plaintext polynomial; and These are the first and second component polynomials of the ciphertext, respectively. It is a random masking polynomial; , For noise polynomial components; The polynomial to be encrypted can be either the retrieval plaintext polynomial or the data plaintext polynomial. Therefore, the two-component ciphertexts corresponding to the data ciphertext and the retrieval ciphertext are as follows:

[0041] in, For encrypted data, To retrieve the encrypted text, These are the two components of the encrypted data; These are the two components for retrieving the ciphertext.

[0042] The server is responsible for performing algebraic operations on the ciphertext field, that is, processing the received ciphertext data. With ciphertext retrieval Perform homomorphic multiplication, which is the tensor product of ciphertext components on the polynomial ring, to obtain the result of the multiplication operation.

[0043] Since multiplying two two-component ciphertexts results in a three-component ciphertext, in some example implementations, after performing a homomorphic multiplication operation on the received retrieval ciphertext and the data ciphertext in the target database, the process further includes: The server performs relinearization on the results of the multiplication operation.

[0044] In this example implementation, relinearization manages the growth of the ciphertext size, ensuring decryption feasibility. The server relinearizes the homomorphic multiplication result of two two-component ciphertexts to reduce dimensionality, enabling the user's two-component private key to correctly decrypt it. Furthermore, relinearization suppresses the sharp increase in storage and transmission overhead caused by the linear growth of the number of ciphertext components with the multiplication depth, reducing the complexity of subsequent calculations.

[0045] For example, relinearization of the result of a multiplication operation includes: An evaluation key is constructed based on the private key polynomial and public key polynomial components of the aforementioned lattice-based homomorphic encryption. The evaluation key is used to linearly combine the results of the multiplication operation to obtain a low-dimensional representation of the results of the multiplication operation.

[0046] In this example implementation, the generation of the evaluation key (often denoted as evk) is related to the system's core keys (private key and public key). For example, the evaluation key is based on the private key polynomial. and public-key polynomial components and Constructed. First, parameters are selected, including the decomposition base. With decomposition length ,satisfy Define a power basis vector. .in For the ciphertext modulus, For use as a base The integer power vector is decomposed. Then, relinearization key generation is performed. For each... Independently generate the corresponding small-coefficient random polynomial With small coefficient noise polynomial Construct evaluation key :

[0047] satisfy:

[0048]

[0049] in, Power basis vectors Any element; let evk ,in For the public key component, For the private key polynomial, This represents the squared convolution in the polynomial ring and reduced to a modular polynomial. For the first The group evaluates the key components; evk is the set of relinearized keys.

[0050] encrypted data With ciphertext retrieval Homomorphic multiplication in polynomial rings The above operation is essentially a tensor product of ciphertext polynomials, and its result is first expressed as an extended ciphertext containing three components. Among them, the first component Second component Third component Since three-component ciphertext cannot be directly decrypted using a standard two-component private key, and the ciphertext size would increase dramatically with increasing computational depth, a relinearization operation is used to compress it back into two-component form. The server uses a pre-generated relinearization key set evk to adjust the coefficients of the quadratic terms in the three-component ciphertext. Processing is then performed. Specifically, a base... Decomposition technology, Decomposed coefficient by coefficient into a set of numerical polynomials , so that:

[0051] The first decomposition obtained A number of numerical polynomials. Subsequently, intermediate relinearization results are computed using the evaluation key. and :

[0052] Finally, the output is the relinearized two-component ciphertext. ,in, , This is a low-dimensional representation of the result of the multiplication operation. At this point, In mathematics, this corresponds to the plaintext product. The encryption result. When the correctness constraint is satisfied, The decrypted plaintext and the three-component ciphertext The corresponding plaintext result of the multiplication in the modulo The central representative element remains consistent in meaning.

[0053] In some implementations, the process of determining the target precision factor includes: Based on the upper bound of the quantization amplitude corresponding to the data feature vector and the retrieval vector, and the dimension of the data feature vector or the retrieval vector, the upper bound of the difference between the inner product result of the data feature vector and the retrieval vector and the similarity threshold is determined. Based on the plaintext modulus corresponding to the lattice-based homomorphic encryption, the upper bound of the residual error of the constant term, the reserved security margin corresponding to the plaintext modulus, and the upper bound of the difference between the inner product result and the similarity threshold, the upper bound constraint of the precision factor is determined. The lower bound constraint of the accuracy factor is determined based on the upper bound of the residual error of the constant term; Select a positive integer that simultaneously satisfies the upper bound constraint and the lower bound constraint as the target precision factor; The upper bound of the residual error of the constant term is determined based on the dimension of the data feature vector or the retrieval vector.

[0054] In this example implementation, the selection of the target precision factor is a key parameter to ensure the correctness of the sign determination of the dense inner product. The precision factor is a positive integer used for the plaintext coefficient scaling embedding and needs to satisfy the value constraints for the correctness of the sign determination. The difference between the inner product of the data feature vector and the query vector is defined as... To preserve the sign property of the difference during ciphertext computation, the plaintext must be scaled using a target precision factor. However, homomorphic operations introduce noise, and finite fields pose a risk of modulo wrap-around. Therefore, the precision factor must satisfy strict dual constraints. First, to prevent the constant term coefficients used for discrimination after decryption from undergoing modulo wrap-around in the sense of the central representative element of the plaintext modulus p, the precision factor must satisfy an upper bound constraint. Specifically, assume there exists an upper bound on the vector quantization amplitude. , so that for any have , Then the difference of inner products satisfies:

[0055] Suppose there exists an upper bound function for the absolute value of the residual error of a constant term used for sign determination. Its dimension It is non-decreasing and can take the form of a linear upper bound:

[0056] in, These are the upper bounds of constants predetermined based on system parameters (their values) ), The worst-case estimation can be performed using a noise growth model of polynomial convolution operations, based on system parameters such as the polynomial ring order, upper bound of the private key coefficients, and upper bound of the noise distribution. The residual error of the constant term can include the upper bound of the influence of the residual term introduced by homomorphic multiplication and relinearization on the sign of the constant term. The constant term coefficients used for discrimination refer to the coefficients of the reduced result obtained from decryption within the modulus... The constant term coefficients of the polynomial obtained after the execution center representative element is mapped.

[0057] To ensure in the model Under the central representative element, the constant term coefficients used for discrimination do not undergo modulus wrapping or sign flipping, and the precision factor... Upper bound constraint must be satisfied:

[0058] in, For the precision factor, Let be the plaintext modulus corresponding to lattice-based homomorphic encryption. This is the upper bound of the residual error of the constant term. This is the upper bound of the difference between the inner product of the data feature vector and the retrieval vector and the similarity threshold. For model The safety margin reserved in the central representative meta-mapping; The dimension of the data feature vector or the retrieval vector; The similarity threshold; This is the upper bound of the quantization amplitude corresponding to the data feature vector. This is the upper bound of the quantization amplitude corresponding to the search vector; this constraint ensures that when T reaches its maximum value, the amplified signal... Even after adding the error term, it still falls under Within the effective representation interval.

[0059] At the same time, to ensure the difference of inner products At that time, the sign of the constant term coefficients used for judgment after decryption is not changed by the residual error, and the precision factor... The lower bound constraint must be satisfied:

[0060] When the above constraints are met, decryption and simulation are performed. The constant term coefficients and inner product differences used for determination after mapping the central representative element Maintaining the same sign relationship. This lower bound constraint ensures that the amplified minimum non-zero signal, after subtracting the maximum possible error, remains constant. The result is still greater than the error itself, thus maintaining the stability of the symbol. Therefore, selecting a positive integer that simultaneously satisfies the upper and lower bound constraints as the target precision factor ensures that the constant term coefficient obtained from decryption maintains the same sign as the original inner product difference T in the sense of the central representative element, thereby achieving accurate determination of the encrypted threshold. This example, through rigorous mathematical analysis, transforms the thorny noise management problem in homomorphic encryption into an interval constraint problem for a single parameter (precision factor). This allows the system to pre-calculate the range of S values ​​that can guarantee correct symbol determination, given the known data dimension, threshold range, and noise characteristics of the encryption scheme, thus achieving controllable precision.

[0061] In some example implementations, after obtaining the discriminant ciphertext, the method further includes: The server uses a randomly selected blinding factor to blind the discrimination ciphertext, resulting in the blinded discrimination ciphertext. The blinding factor is a positive integer.

[0062] In this example implementation, to completely eliminate the risk of side-channel data leakage, the server performs a check on the data before returning the discriminant ciphertext. Perform a randomized blinding operation. A blinding factor can be randomly selected and homomorphically multiplied with the discriminant ciphertext to obtain the blinded discriminant ciphertext, which is then returned to the retrieval terminal. This prevents users from inferring the specific similarity value from the decryption result.

[0063] For example, in order to ensure that the constant term coefficients of the blinded ciphertext do not undergo modulo wrapping in the sense of the central representative element modulo p during decryption (i.e., do not compromise the correctness of symbol determination), the value of the blinding factor must be subject to a strict upper bound constraint. The limitations. Based on the mathematical derivation of this invention, the range of values ​​for the blinding factor is as follows:

[0064]

[0065] in, As a blinding factor, This is the upper bound of the blinding factor. Let be the ciphertext modulus corresponding to lattice-based homomorphic encryption. For the security margin corresponding to the ciphertext modulus, To determine the upper bound of the absolute values ​​of the coefficients of the intermediate quantities corresponding to the ciphertext for decryption; The dimension is the data feature vector or the retrieval vector. This constraint ensures that the blinding factor will not cause overflow during the decryption of the ciphertext modulus q, nor will it cause numerical overflow after mapping to the plaintext modulus p. For example, Unblinded ciphertext after relinearization The intermediate amount of decryption in modulo and execute The upper bound of the absolute values ​​of the coefficients previously included the noise growth term introduced by homomorphic multiplication and relinearization of the evaluation key. Through these value constraints, the constant term coefficients used for threshold determination after decryption of the blinded discriminant ciphertext do not undergo modulus wrapping or sign flipping, thus the threshold determination relies solely on the sign information of the constant term coefficients.

[0066] After selecting the blinding factor within the above range, the server re-linearizes the ciphertext. Perform homomorphic scalar multiplication to compute the blinded discriminant ciphertext. :

[0067] After blinding, the decrypted plaintext value logically becomes Because r is a confidential parameter randomly selected by the server, the user can only determine the sign of the inner product difference through the sign of the decryption result, and cannot deduce the original similarity distance from the numerical value, thus achieving "zero leakage" secure retrieval. Ultimately, the server will... Send back to the user terminal (retrieval terminal).

[0068] In some example implementations, the retrieval terminal uses the acquired private key to decrypt the discrimination ciphertext to obtain a decryption polynomial, including: The retrieval terminal decrypts the discrimination ciphertext based on the private key polynomial and uses the central representative element mapping function under the ciphertext modulus to obtain the decryption intermediate polynomial; The retrieval terminal reduces the decryption intermediate polynomial to the plaintext modulus field to obtain the decryption intermediate polynomial in the plaintext modulus field; The retrieval terminal uses the central representative element mapping function under the plaintext modulus to process the decryption intermediate polynomial in the plaintext modulus field to obtain the decryption polynomial; Wherein, the constant term coefficients of the decryption polynomial have the same sign as the inner product difference, and the inner product difference is the difference between the inner product of the data feature vector, the retrieval vector and the similarity threshold, or the inner product difference is the result of scaling and blinding processing of the difference between the inner product of the data feature vector, the retrieval vector and the similarity threshold; Determining whether a match was successfully retrieved in the target database based on the constant term coefficients of the decryption polynomial includes: If the coefficient of the constant term in the decrypted polynomial is greater than 0, it is determined that the search for a match in the target database was successful. If the coefficient of the constant term in the decryption polynomial is less than 0, it is determined that the search for a match in the target database has failed.

[0069] In this example implementation, the retrieval terminal decrypts and recovers the plaintext polynomial using the acquired private key, and determines the final similarity threshold based solely on the algebraic signs of the constant term coefficients without recovering the specific similarity values. The decryption process requires a central representation element mapping; therefore, the central representation element mapping and the central lifting operator are defined as follows: for any modulus... With any integer Define its in the model The central representative element below is:

[0070] in, In the model The central representation of the meta-mapping function is below. and satisfy

[0071] For any:

[0072] Define the central lifting operator as a coefficient-wise action:

[0073] Among them, when When ,when When This causes the coefficients of the polynomial to modulo With model The central representative element has a unique signed integer interpretation, and the sign of the coefficients used for threshold discrimination after decryption is taken from... The output.

[0074] The retrieval terminal first uses the locally stored private key polynomial The received blinded discriminant ciphertext Perform the decryption operation. This decryption process first involves the ring of the ciphertext module q. To eliminate the influence of the public key component and the random masking term, calculate the intermediate decryption polynomial. :

[0075] in, The central representative element mapping operator modulo q is used to map the result of the modular operation to a symmetric interval. This step correctly handles negative numbers and noise accumulation generated during ciphertext operations, ensuring the correctness of the decrypted polynomial coefficients in the integer sense.

[0076] Subsequently, the retrieval terminal will decrypt the intermediate polynomial. Reduced to plaintext modulus The domain is used to eliminate the multipliers introduced during the encryption process. The noise term (i.e.) The reduced polynomial obtained by calculation is denoted as . Satisfies the congruence relation:

[0077] at this time, Theoretically, it contains the inner product difference information after blinding and scale embedding, but it is still in the model range. integer field In the middle (i.e., [0, The interval [-1] has not yet reflected the semantics of positive and negative signs.

[0078] To recover the symbol information, it is necessary to... Execution Module The central representative metamap Map its coefficients back to the range of signed integers. Next, the coefficients of the constant term in the mapped polynomial are extracted. As the final criterion:

[0079] In this formula, This represents the operation of taking the constant term of the polynomial. Since the inner product difference has already been aggregated into the constant term during the aforementioned encoding stage, this coefficient... Numerically corresponding to ,in This is the residual error term.

[0080] Finally, the retrieval terminal uses integers The symbol is binarized for determination. If z > 0, the inner product of the data feature vector and the retrieval vector exceeds the similarity threshold. (Right now If z < 0, it indicates a successful search, meaning the search data exists in the target database. If z < 0, the similarity requirement is not met, meaning the search fails and the search data does not exist in the target database. If z = 0, it means the inner product of the data feature vector and the search vector equals the similarity threshold, and this can be set as a successful or failed search as needed. The correctness of this judgment logic is based on the following mathematical facts: both the blinding factor and the target precision factor are positive integers, and the value of the target precision factor satisfies the lower bound constraint to resist noise. The product factor does not change the original inner product difference because of the influence of the product factor. The algebraic symbols are used. Through the above steps, the user terminal (retrieval terminal) only obtains a Boolean result of "yes" or "no", and cannot deduce the values ​​of the blinding factor and the target precision factor, thus making it impossible to calculate the specific value. Numerical values ​​enable secure retrieval with maximum privacy.

[0081] In some implementations, the decryption intermediate polynomial satisfies a correctness constraint so that during the mapping process of the central representative element mapping function under the ciphertext modulus, the polynomial coefficients of the decryption intermediate polynomial do not undergo modulus wrap-around. The correctness constraint is an inequality relationship constructed between the plaintext modulus and the ciphertext modulus based on the upper bound of the coefficient amplitudes of the private key polynomial, the small-coefficient noise polynomial, and the plaintext polynomial corresponding to the homomorphic encryption of the lattice basis.

[0082] In this example implementation, based on the lattice-based encryption and decryption principle, during the system parameter generation stage, it is assumed that there exists a pre-given upper bound on the magnitude of the polynomial coefficients:

[0083] And satisfy:

[0084]

[0085]

[0086]

[0087]

[0088] ; in, It represents the infinite norm of the polynomial coefficients.

[0089] Based on this, the lattice-based encryption and decryption method satisfies the following correctness constraint based on the upper bound of the polynomial coefficient magnitude:

[0090] in, Let be the polynomial order of the operational ring of lattice-based homomorphic encryption; This is an upper bound on the magnitude of the polynomial coefficients of the private key polynomial. This is the upper bound of the amplitude of the polynomial coefficients of a small-coefficient random polynomial. These are the upper bounds of the polynomial coefficient amplitudes for each small-coefficient noise polynomial. This is the upper bound of the magnitude of the polynomial coefficients of the plaintext polynomial. This represents the floor operation. By satisfying the above inequality constraints, it is guaranteed that the central representative element mapping is performed on the decrypted intermediate polynomial. When the coefficients do not undergo modulo wrap-around, the decrypted polynomial is thus in modulo... The central representative element has a unique and stable signed interpretation, which provides a correct premise for subsequent threshold discrimination based on the sign of constant term coefficients.

[0091] For example, one exemplary data similarity retrieval method of controllable precision lattice-based homomorphic encrypted inner product, such as... Figure 3 As shown, it includes the following steps: Step S1: The key management center generates keys and parameters: Based on the polynomial ring, it constructs the parameters of a lattice-based homomorphic encryption system, determining the polynomial order parameter N, the ciphertext modulus p and the plaintext modulus q, the public key pk, and the private key sk; and based on the dimensions of the data feature vector and the retrieval vector, as well as the upper bound of noise growth caused by homomorphic multiplication and relinearization, it determines the target precision factor. The precision factor is a positive integer used to control the plaintext embedding scale, so that the constant term coefficients used for symbol determination after decryption do not undergo modulus wrap-around or symbol flipping in the sense of the central representative element.

[0092] Step S2: The terminal where the data owner is located performs feature vector encryption on the data to be uploaded: the data to be uploaded is vectorized into corresponding data feature vectors using bucketing indicator encoding. Embedded target precision factor Construct polynomial mappings Use public key pk pair Perform lattice-based homomorphic encryption to obtain the dense state eigenvectors. And send it to the cloud server. By incorporating the similarity threshold into the constant term of the polynomial encoded by the feature vector, after performing one polynomial multiplication, the coefficients of the constant term correspond to the difference between the inner product of the data feature vector and the query vector and the similarity threshold.

[0093] Step S3: The retrieval terminal generates a dense query vector: the user inputs the query conditions, and the query vector Q is obtained through bucketing indicator encoding; the retrieval plaintext polynomial is obtained by polynomial mapping of Q using dual exponents. Use public key pk pair Perform lattice-based homomorphic encryption to obtain the secret query vector, which is also the retrieval vector. And send it to the cloud server.

[0094] Step S4: The cloud server includes a storage section and a computing section (homogeneous computation and blinding modules). The storage section stores the encrypted data set from the data owner's terminal to form the target database. The computing section processes the encrypted feature vectors without decryption. and retrieval vector Perform homomorphic multiplication on the polynomial ring and relinearize the multiplication results to obtain the discriminant ciphertext. The constant term coefficients of the polynomial corresponding to the ciphertext maintain the same sign as the difference between the precision factor and the inner product when the correctness condition is satisfied. Step S5, Cloud Server Random Blinding Processing: The server applies a random blinding factor to the discriminant ciphertext and performs homomorphic scalar multiplication to generate the blinded discriminant ciphertext. And send it to the retrieval terminal. Random blinding is used to mask the specific numerical value of the inner product difference, wherein the blinding factor is a positive integer and satisfies that the coefficient of the constant term after blinding does not undergo modulus wrap-around or sign flip in the sense of the central representative element; Step S6: The retrieval terminal performs decryption and symbol determination: the private key sk is used to decrypt the blinded discriminative ciphertext to obtain a plaintext polynomial reduced to the plaintext modulus field; the central representative element mapping is performed on the plaintext polynomial and its constant term coefficient z is extracted; the similarity is determined based solely on the positive or negative sign of z to determine whether the similarity meets the similarity threshold, without restoring the specific similarity value.

[0095] This invention discretizes data features and query conditions into ciphertext representations that can participate in encrypted computation. Encryption is achieved by constructing the difference between the inner product result based on a lattice-based encryption algorithm and a similarity threshold. This difference is obtained at the constant term coefficient after encrypted multiplication and relinearization. A precision factor is introduced as a message embedding and scaling control parameter, establishing constraints on its relationship with vector dimension and homomorphic noise growth, ensuring that the constant term coefficient used for discrimination after decryption has a stable sign in the sense of the central representative element. The server applies positive integer randomization to the difference result and returns it to the user. The user only performs similarity judgment based on the sign of the decrypted result, avoiding the leakage of specific similarity values. This invention is suitable for high-privacy data retrieval scenarios, ensuring controllable accuracy in similarity retrieval throughout the encrypted process. By introducing a precision factor and blinding processing, this invention achieves similarity threshold determination throughout the encrypted process, ensuring computational accuracy while avoiding the leakage of specific similarity values.

[0096] Current cloud data storage faces severe risks of data leakage and a crisis of trust. Even more serious is the fact that traditional public-key encryption mechanisms (such as RSA and ECC) widely used for data transmission and storage protection rely on the security of large integer factorization or discrete logarithm problems, which will become extremely vulnerable to the powerful computing capabilities of future quantum computers. Therefore, researching post-quantum cryptography technologies that can resist quantum computing attacks and support dense data processing has become crucial for ensuring long-term data security.

[0097] Existing keyword-based precise matching capabilities are no longer sufficient to meet the complex needs of modern big data analytics. Real-world data is characterized by its massive volume, multiple sources, and high dimensionality. Key analytical tasks often rely on similarity retrieval, which involves calculating the distance (such as Euclidean distance or cosine similarity) or inner product between the query vector and the database feature vector to filter out records that meet specific similarity thresholds, rather than simple full-word matching.

[0098] Currently, traditional searchable encryption techniques cannot effectively handle encrypted vector operations on high-dimensional data. While fully homomorphic encryption theoretically supports arbitrary computation, it faces challenges such as high computational overhead, rapid increase in ciphertext noise, and difficulty in controlling precision when processing floating-point vector inner products. Achieving high-precision, low-latency, and quantum-resistant encrypted vector similarity determination without decryption or disclosure of specific values ​​has become a major technical bottleneck restricting the in-depth mining of the value of high-dimensional sensitive data.

[0099] This invention ingeniously utilizes the properties of lattice-based homomorphic encryption based on polynomial rings, creatively transforming the traditional data similarity retrieval problem (i.e., vector inner product calculation and threshold comparison) into the problem of determining the sign of the constant term in the polynomial multiplication result under the ciphertext domain. To achieve this goal, this invention constructs a unique encoding and encryption system. By introducing a "precision factor" to scale the plaintext data, sufficient signal margin is built to resist the noise growth that inevitably occurs during homomorphic operations. Simultaneously, a "random blinding factor" is introduced on the server side to blind the multiplication result, thereby masking the true inner product value. The combination of these two aspects allows the user to complete the determination by only checking the sign of the constant term coefficient after decryption. Under the premise of ensuring mathematical correctness (i.e., ensuring that no sign flipping occurs due to modulus wrapping), it achieves a similarity retrieval that is entirely ciphertext and has zero numerical leakage.

[0100] Example 2 Based on the same inventive concept, this invention also proposes a data similarity retrieval method with controllable precision lattice-based homomorphic encrypted inner product, applied to a retrieval terminal, comprising: The search content input by the user is discretized and encoded to obtain a search vector; the search vector is then multinomial encoded to obtain the search plaintext polynomial. The obtained public key is used to perform lattice-based homomorphic encryption on the retrieval plaintext polynomial to obtain the retrieval ciphertext, which is then sent to the server. The system receives the ciphertext from the server and decrypts it using the obtained private key to obtain a decryption polynomial. Based on the coefficients of the constant term of the decryption polynomial, it determines whether the search for a match in the target database is successful. Wherein, the discrimination ciphertext is obtained by performing a homomorphic multiplication operation on the retrieval ciphertext and the data ciphertext, and the data ciphertext is obtained by performing lattice basis homomorphic encryption on the data plaintext polynomial; the data plaintext polynomial is obtained by polynomial encoding of the data feature vector based on a preset similarity threshold; the data feature vector is obtained by discretizing the data to be uploaded; the constant term coefficient of the product of the data plaintext polynomial and the retrieval plaintext polynomial is equal to the difference between the inner product of the data feature vector, the retrieval vector and the similarity threshold.

[0101] In one possible implementation, the discretization encoding is a bucketing indicator encoding.

[0102] In one possible implementation, the process of forming the retrieval vector includes: For any search condition, determine the second bucket interval set corresponding to the search condition; For the search content, the corresponding bucket position of the search field that belongs to the second bucket interval set is set to 1, and the corresponding bucket position of the search field that does not belong to the second bucket interval set is set to 0, thus constructing the corresponding search vector; Accordingly, the process of forming the data feature vector includes: Divide the value range of the corresponding field of the data to be uploaded into multiple non-overlapping first bucket intervals; For any field of the data to be uploaded, construct the data feature vector corresponding to the field based on the first bucket interval into which the value of the field falls; The length of the data feature vector is the same as the number of first bucket intervals; the element in the data feature vector corresponding to the value of the field in the first bucket interval is set to 1, and the elements in the other first bucket intervals are set to 0. The retrieval vector and the data feature vector have the same dimension.

[0103] In one possible implementation, polynomial encoding of the retrieval vector yields the retrieval plaintext polynomial, including: The retrieval plaintext polynomial is obtained by performing polynomial encoding on the retrieval vector based on the second encoding index set. Accordingly, the process of forming the plaintext polynomial includes: The data feature vector is polynomial-encoded based on a preset similarity threshold and a first encoding index set to obtain an encoding polynomial. The target precision factor is used to scale the coding polynomial to obtain the plaintext polynomial. The target precision factor is determined based on the dimension and similarity threshold of the data feature vector; the first encoding index set and the second encoding index set satisfy a dual relationship.

[0104] In one possible implementation, the encoding polynomial is as follows: ; in, To encode the polynomial, For polynomial variables, Let i be the i-th element of the first encoded index set. and satisfy , For the polynomial order parameter, And its value is a power of 2; Let i be the i-th element of the data feature vector. The dimension of the data feature vector; The similarity threshold; The retrieval plaintext polynomial is as follows: ; in, To retrieve plaintext polynomials, This is the i-th element of the second encoding index set; ; This is to retrieve the i-th element of the vector.

[0105] In one possible implementation, the process of determining the target precision factor includes: Based on the upper bound of the quantization amplitude corresponding to the data feature vector and the retrieval vector, and the dimension of the data feature vector or the retrieval vector, the upper bound of the difference between the inner product result of the data feature vector and the retrieval vector and the similarity threshold is determined. Based on the plaintext modulus corresponding to the lattice-based homomorphic encryption, the upper bound of the residual error of the constant term, the reserved security margin corresponding to the plaintext modulus, and the upper bound of the difference between the inner product result and the similarity threshold, the upper bound constraint of the precision factor is determined. The lower bound constraint of the accuracy factor is determined based on the upper bound of the residual error of the constant term; Select a positive integer that simultaneously satisfies the upper bound constraint and the lower bound constraint as the target precision factor; The upper bound of the residual error of the constant term is determined based on the dimension of the data feature vector or the retrieval vector.

[0106] In one possible implementation, the upper bound constraint of the precision factor is as follows:

[0107]

[0108] in, For the precision factor, Let be the plaintext modulus corresponding to lattice-based homomorphic encryption. This is the upper bound of the residual error of the constant term. This is the upper bound of the difference between the inner product of the data feature vector and the retrieval vector and the similarity threshold. For model The safety margin reserved in the central representative meta-mapping; The dimension of the data feature vector or the retrieval vector; The similarity threshold; This is the upper bound of the quantization amplitude corresponding to the data feature vector. This is the upper bound of the quantization amplitude corresponding to the search vector; The lower bound constraint of the precision factor is as follows: .

[0109] In one possible implementation, the private key includes a private key polynomial and a central representative metamapping function in the ciphertext modulus; the obtained private key is used to decrypt the ciphertext to obtain a decryption polynomial, including: Based on the private key polynomial, the central representative element mapping function under the ciphertext modulus is used to decrypt the discrimination ciphertext to obtain the decryption intermediate polynomial; The decryption intermediate polynomial is reduced to the plaintext modulus field to obtain the decryption intermediate polynomial in the plaintext modulus field. The decryption polynomial in the plaintext modulus field is processed using the central representative element mapping function under the plaintext modulus to obtain the decryption polynomial; Wherein, the constant term coefficients of the decryption polynomial have the same sign as the inner product difference, and the inner product difference is the difference between the inner product of the data feature vector, the retrieval vector and the similarity threshold, or the inner product difference is the result of scaling and blinding processing of the difference between the inner product of the data feature vector, the retrieval vector and the similarity threshold; Determining whether a match was successfully retrieved in the target database based on the constant term coefficients of the decryption polynomial includes: If the coefficient of the constant term in the decrypted polynomial is greater than 0, it is determined that the search for a match in the target database was successful. If the coefficient of the constant term in the decryption polynomial is less than 0, it is determined that the search for a match in the target database has failed.

[0110] In one possible implementation, the decryption intermediate polynomial satisfies a correctness constraint such that during the mapping process of the decryption intermediate polynomial through the central representative element mapping function under the ciphertext modulus, the polynomial coefficients of the decryption intermediate polynomial do not undergo modulus wrap-around. The correctness constraint is an inequality relationship constructed between the plaintext modulus and the ciphertext modulus based on the upper bound of the coefficient amplitudes of the private key polynomial, the small-coefficient noise polynomial, and the plaintext polynomial corresponding to the homomorphic encryption of the lattice basis.

[0111] In one possible implementation, the correctness constraint is as follows:

[0112] in, Let be the polynomial order of the operational ring of lattice-based homomorphic encryption; The plaintext modulus; The ciphertext modulus; The target precision factor; For the ciphertext modulus The safety margin reserved during the central representative meta-mapping process; This is an upper bound on the magnitude of the polynomial coefficients of the private key polynomial. This is the upper bound of the amplitude of the polynomial coefficients of a small-coefficient random polynomial. These are the upper bounds of the polynomial coefficient amplitudes for each small-coefficient noise polynomial. This is the upper bound of the magnitude of the polynomial coefficients of the plaintext polynomial. This indicates a round-down operation.

[0113] Example 3 Based on the same inventive concept, this invention also proposes a data similarity retrieval method for controllable precision lattice-based homomorphic encrypted inner product, applied to a server, comprising: Receive encrypted data sent by the data provider and store the encrypted data in the target database; The system receives ciphertext from the retrieval terminal and performs a homomorphic multiplication operation on the ciphertext and the data ciphertext in the target database to obtain the discrimination ciphertext. The ciphertext is sent to the retrieval terminal so that the retrieval terminal can determine whether the search for a match in the target database is successful based on the decryption result of the ciphertext. Wherein, the encrypted data is obtained by performing lattice-based homomorphic encryption on the plaintext data polynomial; the plaintext data polynomial is obtained by performing polynomial encoding on the data feature vector based on a preset similarity threshold; the data feature vector is obtained by discretizing the data to be uploaded; the ciphertext for retrieval is obtained by performing lattice-based homomorphic encryption on the plaintext retrieval polynomial; the plaintext retrieval polynomial is obtained by performing polynomial encoding on the retrieval vector; the retrieval vector is obtained by discretizing the retrieval content input by the user; the constant term coefficient of the product of the plaintext data polynomial and the plaintext retrieval polynomial is equal to the difference between the inner product of the data feature vector, the retrieval vector and the similarity threshold.

[0114] In one possible implementation, after performing a homomorphic multiplication operation on the retrieved ciphertext and the data ciphertext in the target database, the method further includes: The result of the multiplication operation is relinearized.

[0115] In one possible implementation, the result of the multiplication operation is relinearized, including: An evaluation key is constructed based on the private key polynomial and public key polynomial components of the aforementioned lattice-based homomorphic encryption. The evaluation key is used to linearly combine the results of the multiplication operation to obtain a low-dimensional representation of the results of the multiplication operation.

[0116] In one possible implementation, after obtaining the discriminant ciphertext, the method further includes: The discrimination ciphertext is blinded using a randomly selected blinding factor to obtain the blinded discrimination ciphertext. The blinding factor is a positive integer.

[0117] In one possible implementation, the blinding factor takes the following values:

[0118]

[0119] in, As a blinding factor, This is the upper bound of the blinding factor. Let be the ciphertext modulus corresponding to lattice-based homomorphic encryption. For model The safety margin reserved in the central representative meta-mapping, To determine the upper bound of the absolute values ​​of the coefficients of the intermediate quantities corresponding to the ciphertext for decryption; The target precision factor, Let be the plaintext modulus corresponding to lattice-based homomorphic encryption. This is the upper bound of the residual error of the constant term. This is the upper bound of the difference between the inner product of the data feature vector and the retrieval vector and the similarity threshold. For model The safety margin reserved in the central representative meta-mapping; The dimension of the data feature vector or the retrieval vector.

[0120] Example 4 Based on the same inventive concept, this application also proposes a retrieval terminal, comprising: The encoding module is used to discretize the search content input by the user to obtain a search vector; and to perform polynomial encoding on the search vector to obtain the search plaintext polynomial. The encryption module is used to perform lattice-based homomorphic encryption on the retrieved plaintext polynomial using the obtained public key to obtain the retrieved ciphertext and send the retrieved ciphertext to the server; The decryption module is used to receive the discrimination ciphertext from the server, and use the obtained private key to decrypt the discrimination ciphertext to obtain a decryption polynomial; based on the constant term coefficients of the decryption polynomial, it determines whether the search for a match in the target database is successful. Wherein, the discrimination ciphertext is obtained by performing a homomorphic multiplication operation on the retrieval ciphertext and the data ciphertext, and the data ciphertext is obtained by performing lattice basis homomorphic encryption on the data plaintext polynomial; the data plaintext polynomial is obtained by polynomial encoding of the data feature vector based on a preset similarity threshold; the data feature vector is obtained by discretizing the data to be uploaded; the constant term coefficient of the product of the data plaintext polynomial and the retrieval plaintext polynomial is equal to the difference between the inner product of the data feature vector, the retrieval vector and the similarity threshold.

[0121] In one possible implementation, the discretization encoding is a bucketing indicator encoding.

[0122] In one possible implementation, the encoding module includes a vectorization submodule, which is used for: For any search condition, determine the second bucket interval set corresponding to the search condition; For the search content, the corresponding bucket position of the search field that belongs to the second bucket interval set is set to 1, and the corresponding bucket position of the search field that does not belong to the second bucket interval set is set to 0, thus constructing the corresponding search vector; Accordingly, the data feature vector is constructed based on the first bucket interval that the value of any field of the data to be uploaded falls into, and the first bucket interval is a plurality of non-overlapping bucket intervals divided based on the value range of the corresponding field of the data to be uploaded. The length of the data feature vector is the same as the number of first bucket intervals; the elements in the data feature vector corresponding to the value of the field in the first bucket interval are set to 1, and the elements in the other first bucket intervals are set to 0; the retrieval vector and the data feature vector have the same dimension.

[0123] In one possible implementation, the encoding module further includes: The encoding submodule is used to perform polynomial encoding on the retrieval vector based on the second encoding index set to obtain the retrieval plaintext polynomial. Wherein, the plaintext polynomial is obtained by scaling the encoding polynomial using a target precision factor; the encoding polynomial is obtained by polynomial encoding the data feature vector based on a preset similarity threshold and a first encoding index set; the target precision factor is determined based on the dimension of the data feature vector and a similarity threshold; the first encoding index set and the second encoding index set satisfy a duality relationship.

[0124] In one possible implementation, the encoding polynomial is as follows: ; in, To encode the polynomial, For polynomial variables, Let i be the i-th element of the first encoded index set. and satisfy , For the polynomial order parameter, And its value is a power of 2; Let i be the i-th element of the data feature vector. The dimension of the data feature vector; The similarity threshold; The retrieval plaintext polynomial is as follows: ; in, To retrieve plaintext polynomials, This is the i-th element of the second encoding index set; ; This is to retrieve the i-th element of the vector.

[0125] In one possible implementation, the process of determining the target precision factor includes: Based on the upper bound of the quantization amplitude corresponding to the data feature vector and the retrieval vector, and the dimension of the data feature vector or the retrieval vector, the upper bound of the difference between the inner product result of the data feature vector and the retrieval vector and the similarity threshold is determined. Based on the plaintext modulus corresponding to the lattice-based homomorphic encryption, the upper bound of the residual error of the constant term, the reserved security margin corresponding to the plaintext modulus, and the upper bound of the difference between the inner product result and the similarity threshold, the upper bound constraint of the precision factor is determined. The lower bound constraint of the accuracy factor is determined based on the upper bound of the residual error of the constant term; Select a positive integer that simultaneously satisfies the upper bound constraint and the lower bound constraint as the target precision factor; The upper bound of the residual error of the constant term is determined based on the dimension of the data feature vector or the retrieval vector.

[0126] In one possible implementation, the upper bound constraint of the precision factor is as follows:

[0127]

[0128] in, For the precision factor, Let be the plaintext modulus corresponding to lattice-based homomorphic encryption. This is the upper bound of the residual error of the constant term. This is the upper bound of the difference between the inner product of the data feature vector and the retrieval vector and the similarity threshold. For model The safety margin reserved in the central representative meta-mapping; The dimension of the data feature vector or the retrieval vector; The similarity threshold; This is the upper bound of the quantization amplitude corresponding to the data feature vector. This is the upper bound of the quantization amplitude corresponding to the search vector; The lower bound constraint of the precision factor is as follows: .

[0129] In one possible implementation, the private key includes a private key polynomial and a central representation metamapping function under the ciphertext modulus; the decryption module includes: The decryption submodule is used to decrypt the discrimination ciphertext based on the private key polynomial and using the central representative element mapping function under the ciphertext modulus to obtain the decryption intermediate polynomial; The reduction submodule is used to reduce the decryption intermediate polynomial to the plaintext modulus field to obtain the decryption intermediate polynomial in the plaintext modulus field. The mapping submodule is used to process the decryption intermediate polynomial of the plaintext modulus field using the central representative element mapping function under the plaintext modulus to obtain the decryption polynomial; Wherein, the constant term coefficients of the decryption polynomial have the same sign as the inner product difference, and the inner product difference is the difference between the inner product of the data feature vector, the retrieval vector and the similarity threshold, or the inner product difference is the result of scaling and blinding processing of the difference between the inner product of the data feature vector, the retrieval vector and the similarity threshold; The decryption module further includes a result determination submodule, which is used for: If the coefficient of the constant term in the decrypted polynomial is greater than 0, it is determined that the search for a match in the target database was successful. If the coefficient of the constant term in the decryption polynomial is less than 0, it is determined that the search for a match in the target database has failed.

[0130] In one possible implementation, the decryption intermediate polynomial satisfies a correctness constraint such that during the mapping process of the decryption intermediate polynomial through the central representative element mapping function under the ciphertext modulus, the polynomial coefficients of the decryption intermediate polynomial do not undergo modulus wrap-around. The correctness constraint is an inequality relationship constructed between the plaintext modulus and the ciphertext modulus based on the upper bound of the coefficient amplitudes of the private key polynomial, the small-coefficient noise polynomial, and the plaintext polynomial corresponding to the homomorphic encryption of the lattice basis.

[0131] In one possible implementation, the correctness constraint is as follows:

[0132] in, Let be the polynomial order of the operational ring of lattice-based homomorphic encryption; The plaintext modulus; The ciphertext modulus; The target precision factor; For the ciphertext modulus The safety margin reserved during the central representative meta-mapping process; This is an upper bound on the magnitude of the polynomial coefficients of the private key polynomial. This is the upper bound of the amplitude of the polynomial coefficients of a small-coefficient random polynomial. These are the upper bounds of the polynomial coefficient amplitudes for each small-coefficient noise polynomial. This is the upper bound of the magnitude of the polynomial coefficients of the plaintext polynomial. This indicates a round-down operation.

[0133] Example 5 Based on the same inventive concept, this application also provides a server, comprising: The receiving module is used to receive encrypted data sent by the data provider and store the encrypted data in the target database; The homomorphic operation module is used to receive the retrieval ciphertext from the retrieval terminal, and perform a homomorphic multiplication operation on the retrieval ciphertext and the data ciphertext in the target database to obtain the discrimination ciphertext; The sending module is used to send the discrimination ciphertext to the retrieval terminal, so that the retrieval terminal can determine whether the retrieval and matching in the target database is successful based on the decryption result of the discrimination ciphertext; Wherein, the encrypted data is obtained by performing lattice-based homomorphic encryption on the plaintext data polynomial; the plaintext data polynomial is obtained by performing polynomial encoding on the data feature vector based on a preset similarity threshold; the data feature vector is obtained by discretizing the data to be uploaded; the ciphertext for retrieval is obtained by performing lattice-based homomorphic encryption on the plaintext retrieval polynomial; the plaintext retrieval polynomial is obtained by performing polynomial encoding on the retrieval vector; the retrieval vector is obtained by discretizing the retrieval content input by the user; the constant term coefficient of the product of the plaintext data polynomial and the plaintext retrieval polynomial is equal to the difference between the inner product of the data feature vector, the retrieval vector, and the similarity threshold.

[0134] In one possible implementation, the server further includes: The relinearization module is used to relinearize the results of multiplication operations.

[0135] In one possible implementation, the relinearization module is specifically used for: An evaluation key is constructed based on the private key polynomial and public key polynomial components of the aforementioned lattice-based homomorphic encryption. The evaluation key is used to linearly combine the results of the multiplication operation to obtain a low-dimensional representation of the results of the multiplication operation.

[0136] In one possible implementation, the server further includes: The blinding module is used to blind the discrimination ciphertext using a randomly selected blinding factor to obtain the blinded discrimination ciphertext. The blinding factor is a positive integer.

[0137] In one possible implementation, the blinding factor takes the following values:

[0138]

[0139] in, As a blinding factor, This is the upper bound of the blinding factor. Let be the ciphertext modulus corresponding to lattice-based homomorphic encryption. For model The safety margin reserved in the central representative meta-mapping, To determine the upper bound of the absolute values ​​of the coefficients of the intermediate quantities corresponding to the ciphertext for decryption; The target precision factor, Let be the plaintext modulus corresponding to lattice-based homomorphic encryption. This is the upper bound of the residual error of the constant term. This is the upper bound of the difference between the inner product of the data feature vector and the retrieval vector and the similarity threshold. For model The safety margin reserved in the central representative meta-mapping; The dimension of the data feature vector or the retrieval vector.

[0140] like Figure 4 As shown, the retrieval terminal in Embodiment 4 may be a computer device, a microcontroller device, a smart mobile device, etc.; the server in Embodiment 5 may be a cloud server or a distributed computing device, etc. The retrieval terminal and server in the above embodiments may include a processor, a memory, a transceiver component, etc. The memory, processor, and transceiver component are connected via a bus; the memory can be used to store executable programs, and an exemplary executable program may include instructions; the processor is used to execute the instructions stored in the memory. The memory can also be used to store data, which can be accessed and / or modified when instructions are executed.

[0141] The processor may be a Central Processing Unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, and it is suitable for implementing one or more instructions. Specifically, it is suitable for loading and executing one or more instructions in the storage medium to realize the corresponding method flow or corresponding function, so as to realize the steps of the data similarity retrieval method of controllable precision lattice basis homomorphic encryption inner product in embodiment 2 or 3 above.

[0142] Example 6 Based on the same inventive concept, this application also provides a data similarity retrieval system with controllable precision lattice-based homomorphic encrypted inner product, such as... Figure 5 As shown, system 500 includes: a retrieval terminal 510 as described in any one of embodiments 4 and / or a server 520 as described in any one of embodiments 5.

[0143] Example 7 Based on the same inventive concept, this invention also provides a readable storage medium, specifically an electronic device readable storage medium (Memory). An electronic device readable storage medium is a memory device within an electronic device used to store programs and data. It is understood that the storage medium here can include both the built-in storage medium of the electronic device and extended storage media supported by the electronic device. The storage medium provides storage space, which stores the terminal's operating system. Furthermore, this storage space also stores one or more instructions suitable for loading and execution by a processor. These instructions can be one or more executable programs (including program code). It should be noted that the storage medium here can be high-speed RAM or non-volatile memory, such as at least one disk storage device. Loading and executing one or more instructions stored in the storage medium by the processor can implement the steps of the data similarity retrieval method for controllable precision lattice-based homomorphic encryption inner product described in embodiments 2 and 3 above.

[0144] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0145] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0146] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0147] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0148] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit its scope of protection. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that after reading the present invention, they can still make various changes, modifications or equivalent substitutions to the specific implementation methods of the application, but these changes, modifications or equivalent substitutions are all within the scope of protection of the claims pending approval.

Claims

1. A data similarity retrieval method with controllable precision lattice-based homomorphic encrypted inner product, characterized in that, include: The data provider performs polynomial encoding on the data feature vector based on a preset similarity threshold and a first encoding index set to obtain the encoding polynomial; The encoding polynomial is scaled using a target precision factor to obtain the plaintext polynomial. The server receives encrypted data sent by the data provider and stores the encrypted data in the target database. The retrieval terminal performs polynomial encoding on the retrieval vector based on the second encoding exponent set to obtain the retrieval plaintext polynomial; it then uses the obtained public key to perform lattice-based homomorphic encryption on the retrieval plaintext polynomial to obtain the retrieval ciphertext and sends the retrieval ciphertext to the server. The server performs a homomorphic multiplication operation on the received retrieval ciphertext and the data ciphertext in the target database to obtain the discrimination ciphertext. The server then performs blinding processing on the discrimination ciphertext using a randomly selected blinding factor to obtain the blinded discrimination ciphertext. The blinded discrimination ciphertext is sent to the retrieval terminal; The retrieval terminal uses the obtained private key to decrypt the blinded discrimination ciphertext to obtain the decryption polynomial; The sign of the constant term coefficients of the decrypted polynomial determines whether a match was successfully retrieved in the target database. Wherein, the encrypted data is obtained by performing lattice basis homomorphic encryption on the plaintext data polynomial; the data feature vector is obtained by discretizing and encoding the data to be uploaded; the retrieval vector is obtained by discretizing and encoding the retrieval content input by the user; the constant term coefficient of the product of the plaintext data polynomial and the plaintext retrieval polynomial is equal to the difference between the inner product of the data feature vector and the retrieval vector and the similarity threshold; the first encoding index set and the second encoding index set satisfy a dual relationship; the target precision factor is selected from positive integers that simultaneously satisfy the upper and lower bound constraints of the precision factor. The upper bound constraint of the precision factor is as follows: in, For the precision factor, Let be the plaintext modulus corresponding to lattice-based homomorphic encryption. This is the upper bound of the residual error of the constant term, and its value is determined based on the dimension of the data feature vector or the retrieval vector; This is the upper bound of the difference between the inner product of the data feature vector and the retrieval vector and the similarity threshold. For model The safety margin reserved in the central representative meta-mapping; The dimension of the data feature vector or the retrieval vector; The similarity threshold; This is the upper bound of the quantization amplitude corresponding to the data feature vector. This is the upper bound of the quantization amplitude corresponding to the search vector; The lower bound constraint of the precision factor is as follows: ； The blinding factor is a positive integer; the value range of the blinding factor is as follows: in, As a blinding factor, This is the upper bound of the blinding factor. Let be the ciphertext modulus corresponding to lattice-based homomorphic encryption. To determine the upper bound of the absolute values ​​of the coefficients of the intermediate quantities corresponding to the ciphertext for decryption; The target precision factor, For model The safety margin reserved in the central representative meta-mapping.

2. The method according to claim 1, characterized in that, The discretization encoding is a bucketing indicator encoding.

3. The method according to claim 2, characterized in that, The process of forming the data feature vector includes: Divide the value range of the corresponding field of the data to be uploaded into multiple non-overlapping first bucket intervals; For any field of the data to be uploaded, construct the data feature vector corresponding to the field based on the first bucket interval into which the value of the field falls; The length of the data feature vector is the same as the number of first bucket intervals; the element in the data feature vector corresponding to the value of the field in the first bucket interval is set to 1, and the elements in the other first bucket intervals are set to 0. Accordingly, the process of forming the retrieval vector includes: For any search condition, determine the second bucket interval set corresponding to the search condition; For the search content, the corresponding bucket position of the search field that belongs to the second bucket interval set is set to 1, and the corresponding bucket position of the search field that does not belong to the second bucket interval set is set to 0, thus constructing the corresponding search vector; The retrieval vector and the data feature vector have the same dimension.

4. The method according to claim 1, characterized in that, The encoding polynomial is as follows: ； in, To encode the polynomial, For polynomial variables, Let i be the i-th element of the first encoded index set. and satisfy , For the polynomial order parameter, And its value is a power of 2; Let i be the i-th element of the data feature vector. The dimension of the data feature vector; The similarity threshold; The retrieval plaintext polynomial is as follows: in, To retrieve plaintext polynomials, This is the i-th element of the second encoding index set; ; This is to retrieve the i-th element of the vector.

5. The method according to claim 1, characterized in that, After performing a homomorphic multiplication operation on the received retrieval ciphertext and the data ciphertext in the target database, the method further includes: The server performs relinearization on the results of the multiplication operation.

6. The method according to claim 5, characterized in that, The result of the multiplication operation is relinearized, including: An evaluation key is constructed based on the private key polynomial and public key polynomial components of the aforementioned lattice-based homomorphic encryption. The evaluation key is used to linearly combine the results of the multiplication operation to obtain a low-dimensional representation of the results of the multiplication operation.

7. The method according to claim 1, characterized in that, The retrieval terminal uses the acquired private key to decrypt the discrimination ciphertext, obtaining a decryption polynomial, including: The retrieval terminal decrypts the discrimination ciphertext based on the private key polynomial and uses the central representative element mapping function under the ciphertext modulus to obtain the decryption intermediate polynomial; The retrieval terminal reduces the decryption intermediate polynomial to the plaintext modulus field to obtain the decryption intermediate polynomial in the plaintext modulus field; The retrieval terminal uses the central representative element mapping function under the plaintext modulus to process the decryption intermediate polynomial in the plaintext modulus field to obtain the decryption polynomial; Wherein, the constant term coefficients of the decryption polynomial have the same sign as the inner product difference, and the inner product difference is the difference between the inner product of the data feature vector, the retrieval vector and the similarity threshold, or the inner product difference is the result of scaling and blinding processing of the difference between the inner product of the data feature vector, the retrieval vector and the similarity threshold; Determining whether a match was successfully retrieved in the target database based on the constant term coefficients of the decryption polynomial includes: If the coefficient of the constant term in the decrypted polynomial is greater than 0, it is determined that the search for a match in the target database was successful. If the coefficient of the constant term in the decryption polynomial is less than 0, it is determined that the search for a match in the target database has failed.

8. The method according to claim 7, characterized in that, The decryption intermediate polynomial satisfies the correctness constraint so that during the mapping process of the central representative element mapping function under the ciphertext modulus, the polynomial coefficients of the decryption intermediate polynomial do not undergo modulus wrap-around. The correctness constraint is an inequality relationship constructed between the plaintext modulus and the ciphertext modulus based on the upper bound of the coefficient amplitudes of the private key polynomial, the small-coefficient noise polynomial, and the plaintext polynomial corresponding to the homomorphic encryption of the lattice basis.

9. The method according to claim 8, characterized in that, The correctness constraints are as follows: in, Let be the polynomial order of the operational ring of lattice-based homomorphic encryption; The plaintext modulus; The ciphertext modulus; The target precision factor; For the ciphertext modulus The safety margin reserved during the central representative meta-mapping process; This is an upper bound on the magnitude of the polynomial coefficients of the private key polynomial. This is the upper bound of the amplitude of the polynomial coefficients of a small-coefficient random polynomial. These are the upper bounds of the polynomial coefficient amplitudes for each small-coefficient noise polynomial. This is the upper bound of the magnitude of the polynomial coefficients of the plaintext polynomial. This indicates the floor function.

10. A data similarity retrieval method with controllable precision lattice-based homomorphic encrypted inner product, characterized in that, Applied to retrieval terminals, including: The search content input by the user is discretized and encoded to obtain a search vector; the search vector is then multinomial encoded based on the second encoding index set to obtain the search plaintext polynomial. The obtained public key is used to perform lattice-based homomorphic encryption on the search plaintext polynomial to obtain the search ciphertext, and the search ciphertext is sent to the server. The system receives the blinded ciphertext from the server and decrypts it using the obtained private key to obtain a decryption polynomial. The sign of the constant term coefficients in the decryption polynomial determines whether the search for a match in the target database is successful. The blinded discriminative ciphertext is obtained by blinding the discriminative ciphertext using a randomly selected blinding factor. The discriminative ciphertext is obtained by performing homomorphic multiplication on the retrieval ciphertext and the data ciphertext. The data ciphertext is obtained by performing lattice-based homomorphic encryption on the data plaintext polynomial. The data plaintext polynomial is formed as follows: a polynomial encoding is performed on the data feature vector based on a preset similarity threshold and a first encoding index set to obtain an encoding polynomial; the encoding polynomial is then scaled using a target precision factor to obtain the data plaintext polynomial; the first encoding index set and the second encoding index set satisfy a duality relationship; the data feature vector is obtained by discretizing the data to be uploaded; the constant term coefficient of the product of the data plaintext polynomial and the retrieval plaintext polynomial is equal to the difference between the inner product of the data feature vector, the retrieval vector, and the similarity threshold; the target precision factor is selected from positive integers that simultaneously satisfy the upper and lower bound constraints of the precision factor. The upper bound constraint of the precision factor is as follows: in, For the precision factor, Let be the plaintext modulus corresponding to lattice-based homomorphic encryption. This is the upper bound of the residual error of the constant term, and its value is determined based on the dimension of the data feature vector or the retrieval vector; This is the upper bound of the difference between the inner product of the data feature vector and the retrieval vector and the similarity threshold. For model The safety margin reserved in the central representative meta-mapping; The dimension of the data feature vector or the retrieval vector; The similarity threshold; This is the upper bound of the quantization amplitude corresponding to the data feature vector. This is the upper bound of the quantization amplitude corresponding to the search vector; The lower bound constraint of the precision factor is as follows: ； The blinding factor is a positive integer; the value range of the blinding factor is as follows: in, As a blinding factor, This is the upper bound of the blinding factor. Let be the ciphertext modulus corresponding to lattice-based homomorphic encryption. To determine the upper bound of the absolute values ​​of the coefficients of the intermediate quantities corresponding to the ciphertext for decryption; The target precision factor, For model The safety margin reserved in the central representative meta-mapping.

11. The method according to claim 10, characterized in that, The discretization encoding is a bucketing indicator encoding.

12. The method according to claim 11, characterized in that, The process of forming the retrieval vector includes: For any search condition, determine the second bucket interval set corresponding to the search condition; For the search content, the corresponding bucket position of the search field that belongs to the second bucket interval set is set to 1, and the corresponding bucket position of the search field that does not belong to the second bucket interval set is set to 0, thus constructing the corresponding search vector; Accordingly, the process of forming the data feature vector includes: Divide the value range of the corresponding field of the data to be uploaded into multiple non-overlapping first bucket intervals; For any field of the data to be uploaded, construct the data feature vector corresponding to the field based on the first bucket interval into which the value of the field falls; The length of the data feature vector is the same as the number of first bucket intervals; the element in the data feature vector corresponding to the value of the field in the first bucket interval is set to 1, and the elements in the other first bucket intervals are set to 0. The retrieval vector and the data feature vector have the same dimension.

13. The method according to claim 10, characterized in that, The encoding polynomial is as follows: ； in, To encode the polynomial, For polynomial variables, Let i be the i-th element of the first encoded index set. and satisfy , For the polynomial order parameter, And its value is a power of 2; Let i be the i-th element of the data feature vector. The dimension of the data feature vector; The similarity threshold; The retrieval plaintext polynomial is as follows: ； in, To retrieve plaintext polynomials, This is the i-th element of the second encoding index set; ; This is to retrieve the i-th element of the vector.

14. The method according to claim 10, characterized in that, The private key includes a private key polynomial and a central representative metamapping function under the ciphertext modulus; the obtained private key is used to decrypt the ciphertext to obtain a decryption polynomial, including: Based on the private key polynomial, the central representative element mapping function under the ciphertext modulus is used to decrypt the discrimination ciphertext to obtain the decryption intermediate polynomial; The decryption intermediate polynomial is reduced to the plaintext modulus field to obtain the decryption intermediate polynomial in the plaintext modulus field. The decryption polynomial in the plaintext modulus field is processed using the central representative element mapping function under the plaintext modulus to obtain the decryption polynomial; Wherein, the constant term coefficients of the decryption polynomial have the same sign as the inner product difference, and the inner product difference is the difference between the inner product of the data feature vector, the retrieval vector and the similarity threshold, or the inner product difference is the result of scaling and blinding processing of the difference between the inner product of the data feature vector, the retrieval vector and the similarity threshold; Determining whether a match was successfully retrieved in the target database based on the constant term coefficients of the decryption polynomial includes: If the coefficient of the constant term in the decrypted polynomial is greater than 0, it is determined that the search for a match in the target database was successful. If the coefficient of the constant term in the decryption polynomial is less than 0, it is determined that the search for a match in the target database has failed.

15. The method according to claim 14, characterized in that, The decryption intermediate polynomial satisfies the correctness constraint so that during the mapping process of the central representative element mapping function under the ciphertext modulus, the polynomial coefficients of the decryption intermediate polynomial do not undergo modulus wrap-around. The correctness constraint is an inequality relationship constructed between the plaintext modulus and the ciphertext modulus based on the upper bound of the coefficient amplitudes of the private key polynomial, the small-coefficient noise polynomial, and the plaintext polynomial corresponding to the homomorphic encryption of the lattice basis.

16. The method according to claim 15, characterized in that, The correctness constraints are as follows: in, Let be the polynomial order of the operational ring of lattice-based homomorphic encryption; The plaintext modulus; The ciphertext modulus; The target precision factor; For the ciphertext modulus The safety margin reserved during the central representative meta-mapping process; This is an upper bound on the magnitude of the polynomial coefficients of the private key polynomial. This is the upper bound of the amplitude of the polynomial coefficients of a small-coefficient random polynomial. These are the upper bounds of the polynomial coefficient amplitudes for each small-coefficient noise polynomial. This is the upper bound of the magnitude of the polynomial coefficients of the plaintext polynomial. This indicates the floor function.

17. A data similarity retrieval method with controllable precision lattice-based homomorphic encrypted inner product, characterized in that, Applied to servers, including: Receive encrypted data sent by the data provider and store the encrypted data in the target database; The system receives retrieval ciphertext from a retrieval terminal, performs homomorphic multiplication on the retrieval ciphertext and the data ciphertext in the target database to obtain discrimination ciphertext, and performs blinding processing on the discrimination ciphertext using a randomly selected blinding factor to obtain blinded discrimination ciphertext. The blinded discriminative ciphertext is sent to the retrieval terminal, so that the retrieval terminal determines whether the retrieval and matching in the target database is successful based on the sign of the constant term coefficient of the decryption result of the blinded discriminative ciphertext. The encrypted data is obtained by performing lattice-based homomorphic encryption on a plaintext polynomial. The plaintext polynomial is formed as follows: a polynomial encoding is performed on the data feature vector based on a preset similarity threshold and a first encoding index set to obtain an encoding polynomial; the encoding polynomial is then scaled using a target precision factor to obtain the plaintext polynomial. The data feature vector is obtained by discretizing the data to be uploaded. The retrieval encrypted data is obtained by performing lattice-based homomorphic encryption on a retrieval plaintext polynomial. The retrieval plaintext polynomial is obtained by performing polynomial encoding on a retrieval vector based on a second encoding index set. The retrieval vector is obtained by discretizing the retrieval content input by the user. The first and second encoding index sets satisfy a duality relationship. The constant term coefficient of the product of the plaintext polynomial and the retrieval plaintext polynomial is equal to the difference between the inner product of the data feature vector, the retrieval vector, and the similarity threshold. The target precision factor is selected from positive integers that simultaneously satisfy both the upper and lower bound constraints of the precision factor. The upper bound constraint of the precision factor is as follows: in, For the precision factor, Let be the plaintext modulus corresponding to lattice-based homomorphic encryption. This is the upper bound of the residual error of the constant term, and its value is determined based on the dimension of the data feature vector or the retrieval vector; This is the upper bound of the difference between the inner product of the data feature vector and the retrieval vector and the similarity threshold. For model The safety margin reserved in the central representative meta-mapping; The dimension of the data feature vector or the retrieval vector; The similarity threshold; This is the upper bound of the quantization amplitude corresponding to the data feature vector. This is the upper bound of the quantization amplitude corresponding to the search vector; The lower bound constraint of the precision factor is as follows: ； The blinding factor is a positive integer; the value range of the blinding factor is as follows: in, As a blinding factor, This is the upper bound of the blinding factor. Let be the ciphertext modulus corresponding to lattice-based homomorphic encryption. To determine the upper bound of the absolute values ​​of the coefficients of the intermediate quantities corresponding to the ciphertext for decryption; The target precision factor, For model The safety margin reserved in the central representative meta-mapping.

18. The method according to claim 17, characterized in that, After performing a homomorphic multiplication operation on the retrieved ciphertext and the ciphertext in the target database, the method further includes: The result of the multiplication operation is relinearized.

19. The method according to claim 18, characterized in that, The result of the multiplication operation is relinearized, including: An evaluation key is constructed based on the private key polynomial and public key polynomial components of the aforementioned lattice-based homomorphic encryption. The evaluation key is used to linearly combine the results of the multiplication operation to obtain a low-dimensional representation of the results of the multiplication operation.

20. A retrieval terminal, characterized in that, include: The encoding module is used to discretize and encode the search content input by the user to obtain a search vector; and to perform polynomial encoding on the search vector based on the second encoding index set to obtain the search plaintext polynomial. The encryption module is used to perform lattice-based homomorphic encryption on the retrieved plaintext polynomial using the obtained public key to obtain the retrieved ciphertext and send the retrieved ciphertext to the server; The decryption module is used to receive the blinded discriminative ciphertext from the server and decrypt the blinded discriminative ciphertext using the obtained private key to obtain the decryption polynomial. The sign of the constant term coefficients in the decrypted polynomial determines whether a match is successfully retrieved in the target database. The blinded discriminative ciphertext is obtained by blinding the discriminative ciphertext using a randomly selected blinding factor. The discriminative ciphertext is obtained by performing a homomorphic multiplication operation on the retrieval ciphertext and the data ciphertext. The data ciphertext is obtained by performing lattice-based homomorphic encryption on the data plaintext polynomial. The formation process of the data plaintext polynomial is as follows: a polynomial encoding is performed on the data feature vector based on a preset similarity threshold and a first encoding index set to obtain an encoding polynomial; the encoding polynomial is then scaled using a target precision factor to obtain the data plaintext polynomial; the data feature vector is obtained by discretizing and encoding the data to be uploaded; the constant term coefficient of the product of the data plaintext polynomial and the retrieval plaintext polynomial is equal to the difference between the inner product of the data feature vector, the retrieval vector, and the similarity threshold; the first encoding index set and the second encoding index set satisfy a dual relationship; the target precision factor is selected from positive integers that simultaneously satisfy the upper and lower bound constraints of the precision factor. The upper bound constraint of the precision factor is as follows: in, For the precision factor, Let be the plaintext modulus corresponding to lattice-based homomorphic encryption. This is the upper bound of the residual error of the constant term, and its value is determined based on the dimension of the data feature vector or the retrieval vector; This is the upper bound of the difference between the inner product of the data feature vector and the retrieval vector and the similarity threshold. For model The safety margin reserved in the central representative meta-mapping; The dimension of the data feature vector or the retrieval vector; The similarity threshold; This is the upper bound of the quantization amplitude corresponding to the data feature vector. This is the upper bound of the quantization amplitude corresponding to the search vector; The lower bound constraint of the precision factor is as follows: ； The blinding factor is a positive integer; the value range of the blinding factor is as follows: in, As a blinding factor, This is the upper bound of the blinding factor. Let be the ciphertext modulus corresponding to lattice-based homomorphic encryption. To determine the upper bound of the absolute values ​​of the coefficients of the intermediate quantities corresponding to the ciphertext for decryption; The target precision factor, For model The safety margin reserved in the central representative meta-mapping.

21. The retrieval terminal according to claim 20, characterized in that, The discretization encoding is a bucketing indicator encoding.

22. The retrieval terminal according to claim 21, characterized in that, The encoding module includes a vectorization submodule, which is used for: For any search condition, determine the second bucket interval set corresponding to the search condition; For the search content, the corresponding bucket position of the search field that belongs to the second bucket interval set is set to 1, and the corresponding bucket position of the search field that does not belong to the second bucket interval set is set to 0, thus constructing the corresponding search vector; Accordingly, the data feature vector is constructed based on the first bucket interval that the value of any field of the data to be uploaded falls into, and the first bucket interval is a plurality of non-overlapping bucket intervals divided based on the value range of the corresponding field of the data to be uploaded. The length of the data feature vector is the same as the number of first bucket intervals; the elements in the data feature vector corresponding to the value of the field in the first bucket interval are set to 1, and the elements in the other first bucket intervals are set to 0; the retrieval vector and the data feature vector have the same dimension.

23. The retrieval terminal according to claim 20, characterized in that, The encoding polynomial is as follows: ； in, To encode the polynomial, For polynomial variables, Let i be the i-th element of the first encoded index set. and satisfy , For the polynomial order parameter, And its value is a power of 2; Let i be the i-th element of the data feature vector. The dimension of the data feature vector; The similarity threshold; The retrieval plaintext polynomial is as follows: ； in, To retrieve plaintext polynomials, This is the i-th element of the second encoding index set; ; This is to retrieve the i-th element of the vector.

24. The retrieval terminal according to claim 20, characterized in that, The private key includes a private key polynomial and a central representative metamapping function under the ciphertext modulus; the decryption module includes: The decryption submodule is used to decrypt the discrimination ciphertext based on the private key polynomial and using the central representative element mapping function under the ciphertext modulus to obtain the decryption intermediate polynomial; The reduction submodule is used to reduce the decryption intermediate polynomial to the plaintext modulus field to obtain the decryption intermediate polynomial in the plaintext modulus field. The mapping submodule is used to process the decryption intermediate polynomial of the plaintext modulus field using the central representative element mapping function under the plaintext modulus to obtain the decryption polynomial; Wherein, the constant term coefficients of the decryption polynomial have the same sign as the inner product difference, and the inner product difference is the difference between the inner product of the data feature vector, the retrieval vector and the similarity threshold, or the inner product difference is the result of scaling and blinding processing of the difference between the inner product of the data feature vector, the retrieval vector and the similarity threshold; The decryption module further includes a result determination submodule, which is used for: If the coefficient of the constant term in the decrypted polynomial is greater than 0, it is determined that the search for a match in the target database was successful. If the coefficient of the constant term in the decryption polynomial is less than 0, it is determined that the search for a match in the target database has failed.

25. The retrieval terminal according to claim 24, characterized in that, The decryption intermediate polynomial satisfies the correctness constraint so that during the mapping process of the central representative element mapping function under the ciphertext modulus, the polynomial coefficients of the decryption intermediate polynomial do not undergo modulus wrap-around. The correctness constraint is an inequality relationship constructed between the plaintext modulus and the ciphertext modulus based on the upper bound of the coefficient amplitudes of the private key polynomial, the small-coefficient noise polynomial, and the plaintext polynomial corresponding to the homomorphic encryption of the lattice basis.

26. The retrieval terminal according to claim 25, characterized in that, The correctness constraints are as follows: in, Let be the polynomial order of the operational ring of lattice-based homomorphic encryption; The plaintext modulus; The ciphertext modulus; The target precision factor; For the ciphertext modulus The safety margin reserved during the central representative meta-mapping process; This is an upper bound on the magnitude of the polynomial coefficients of the private key polynomial. This is the upper bound of the amplitude of the polynomial coefficients of a small-coefficient random polynomial. These are the upper bounds of the polynomial coefficient amplitudes for each small-coefficient noise polynomial. This is the upper bound of the magnitude of the polynomial coefficients of the plaintext polynomial. This indicates the floor function.

27. A server, characterized in that, include: The receiving module is used to receive encrypted data sent by the data provider and store the encrypted data in the target database; The homomorphic operation module is used to receive the retrieval ciphertext from the retrieval terminal, and perform a homomorphic multiplication operation on the retrieval ciphertext and the data ciphertext in the target database to obtain the discrimination ciphertext; The discrimination ciphertext is blinded using a randomly selected blinding factor to obtain the blinded discrimination ciphertext. The sending module is used to send the blinded discriminative ciphertext to the retrieval terminal, so that the retrieval terminal can determine whether the retrieval and matching in the target database is successful based on the sign of the constant term coefficient of the decryption result of the blinded discriminative ciphertext. The encrypted data is obtained by performing lattice-based homomorphic encryption on a plaintext polynomial. The plaintext polynomial is formed as follows: a polynomial encoding is performed on the data feature vector based on a preset similarity threshold and a first encoding index set to obtain an encoding polynomial; the encoding polynomial is then scaled using a target precision factor to obtain the plaintext polynomial. The data feature vector is obtained by discretizing the data to be uploaded. The retrieval encrypted data is obtained by performing lattice-based homomorphic encryption on a retrieval plaintext polynomial. The retrieval plaintext polynomial is obtained by performing polynomial encoding on a retrieval vector based on a second encoding index set. The retrieval vector is obtained by discretizing the retrieval content input by the user. The constant term coefficient of the product of the plaintext polynomial and the retrieval plaintext polynomial is equal to the difference between the inner product of the data feature vector, the retrieval vector, and the similarity threshold. The first and second encoding index sets satisfy a duality relationship. The target precision factor is selected from positive integers that simultaneously satisfy both upper and lower bound constraints of the precision factor. The upper bound constraint of the precision factor is as follows: in, For the precision factor, Let be the plaintext modulus corresponding to lattice-based homomorphic encryption. This is the upper bound of the residual error of the constant term, and its value is determined based on the dimension of the data feature vector or the retrieval vector; This is the upper bound of the difference between the inner product of the data feature vector and the retrieval vector and the similarity threshold. For model The safety margin reserved in the central representative meta-mapping; The dimension of the data feature vector or the retrieval vector; The similarity threshold; This is the upper bound of the quantization amplitude corresponding to the data feature vector. This is the upper bound of the quantization amplitude corresponding to the search vector; The lower bound constraint of the precision factor is as follows: ； The blinding factor is a positive integer; the value range of the blinding factor is as follows: in, As a blinding factor, This is the upper bound of the blinding factor. Let be the ciphertext modulus corresponding to lattice-based homomorphic encryption. To determine the upper bound of the absolute values ​​of the coefficients of the intermediate quantities corresponding to the ciphertext for decryption; The target precision factor, For model The safety margin reserved in the central representative meta-mapping.

28. The server according to claim 27, characterized in that, The server also includes: The relinearization module is used to relinearize the results of multiplication operations.

29. The server according to claim 28, characterized in that, The relinearization module is specifically used for: An evaluation key is constructed based on the private key polynomial and public key polynomial components of the aforementioned lattice-based homomorphic encryption. The evaluation key is used to linearly combine the results of the multiplication operation to obtain a low-dimensional representation of the results of the multiplication operation.

30. A data similarity retrieval system with controllable precision lattice-based homomorphic encrypted inner product, characterized in that, include: The retrieval terminal according to any one of claims 20-26 and / or the server according to any one of claims 27-29.

31. A readable storage medium, characterized in that, It contains an executable program, which, when executed, implements the method as described in any one of claims 10 to 19.

Images