High-performance data multi-domain conversion lattice homomorphic encryption method and system

Abstract

The application provides a high-performance data multi-domain conversion lattice homomorphism encryption and decryption method and system, which converts the initial polynomial of plaintext to a Montgomery domain, maps the Montgomery domain polynomial to a two-dimensional array by using a Good's Trick strategy, converts the two-dimensional array to a point value domain by using a Lazy-NTT strategy, obtains a ciphertext point value array by using a public key to obtain a ciphertext, and obtains plaintext by inverse Lazy-NTT, inverse Good's Trick mapping and Montgomery restoration processing; the above steps can be repeated to obtain ciphertexts corresponding to multiple plaintexts, multiple ciphertexts are converted to a point value domain by multi-domain conversion under the same public key, point-by-point addition and / or point-by-point multiplication are performed in the point value domain, and a homomorphic operation result ciphertext is obtained; the multi-domain conversion is introduced in the encryption, homomorphic addition and homomorphic multiplication processes, the number of polynomial convolution and module reduction is reduced, and therefore the overall operation efficiency of a privacy computing scene is improved.

Description

Technical Field

[0001] This invention relates to the fields of cryptography and information security technology, specifically to a high-performance data multi-domain transformation lattice basis homomorphic encryption and decryption method and system. Background Technology

[0002] With the development of privacy computing technology, the introduction of quantum-resistant cryptography to address potential quantum computing threats has become a necessity in the field of data security. The NTRU (N-th Degree Truncated Polynomial Ring Units) algorithm, as a lattice-based quantum-resistant cryptosystem, is often used to construct homomorphic encryption schemes due to its algebraic structure characteristics, enabling direct data computation in ciphertext.

[0003] However, the NTRU algorithm faces a severe challenge in homomorphic computing applications due to its excessively high polynomial computation complexity. To meet the security and noise tolerance requirements of homomorphic computing, NTRU typically requires extremely large polynomial dimensions N and modulus q, making high-dimensional polynomial multiplication the core computational bottleneck of the system. In traditional implementations, polynomial convolution involves massive amounts of basic arithmetic operations, and each multiplication is accompanied by high modular reduction overhead. Existing general-purpose computing methods struggle to maintain efficiency under such large-scale parameters, resulting in extremely high computational resource consumption at the basic arithmetic level. Furthermore, this high-intensity computational load, coupled with frequent domain transformation processes, further limits its processing efficiency in resource-constrained environments such as edge computing.

[0004] Therefore, there is an urgent need for an NTRU data encryption method that can reduce the computational complexity of polynomial multiplication and modular reduction, and reduce the computational overhead during homomorphic operations. Summary of the Invention

[0005] To overcome the shortcomings of existing NTRU algorithms in homomorphic computing applications, which suffer from low overall efficiency due to the high computational complexity of high-dimensional polynomial multiplication and modular reduction operations, this invention provides a high-performance data multi-domain transformation lattice-based homomorphic encryption method, comprising:

[0006] Obtain the initial polynomial of the plaintext to be processed, the initial polynomial including the plaintext polynomial and the random perturbation polynomial of the plaintext to be processed;

[0007] Transform the initial polynomial to the Montgomery field to obtain the Montgomery field polynomial;

[0008] Using the Good's Trick strategy of the NTRU algorithm, the Montgomery field polynomial is mapped to obtain a two-dimensional array;

[0009] Using the Lazy-NTT strategy of the NTRU algorithm, the two-dimensional array is transformed into a point value domain to obtain a point value array, which includes a plaintext point value array and a perturbation point value array.

[0010] Using the pre-generated NTRU public key and the perturbation point value array, the plaintext point value array is processed to obtain the ciphertext point value array;

[0011] If there are multiple plaintexts to be processed and there is a need for ciphertext operations, repeat the above steps for multiple plaintexts to be processed to obtain a ciphertext point value array for each plaintext to be processed; directly perform homomorphic addition and / or homomorphic multiplication operations on multiple ciphertext point value arrays within the point value domain to obtain a homomorphic operation result point value array.

[0012] Obtain multiple ciphertext point value arrays generated based on the above steps; based on the convolution characteristics of the Good's Trick strategy, perform column-to-column circular convolution on the multiple ciphertext point value arrays within the point value domain, and combine Montgomery modular multiplication to perform homomorphic operations to obtain the homomorphic operation result point value array.

[0013] Optionally, the step of transforming the initial polynomial to the Montgomery field to obtain the Montgomery field polynomial includes:

[0014] The coefficients of the initial polynomial are multiplied by the preset Montgomery base and modulo q of the NTRU algorithm to obtain the Montgomery field polynomial.

[0015] Optionally, the step of using the Lazy-NTT strategy to transform the two-dimensional array into a point value domain, obtaining a plaintext point value array and a perturbation point value array, includes:

[0016] Using the Lazy-NTT strategy of the NTRU algorithm, the following multi-level Lazy-NTT transformation is performed on each row of data in the two-dimensional array:

[0017] If the current layer is not the last layer, then based on the index of each data in the current layer and in conjunction with the multiplication type determination table, the multiplication type used for each data is determined; based on each data, when the multiplication type used for the data is Montgomery modular multiplication, a rotation factor is selected from the Montgomery domain unit root table, and Montgomery modular multiplication is performed on the data and the rotation factor to obtain data converted to the point value domain; when the multiplication type used for the data is standard multiplication, a rotation factor is read from the integer domain unit root table, and the data and the rotation factor are directly multiplied to obtain data converted to the point value domain.

[0018] If the current layer is the last layer, then the multiplication type of the last layer is determined to be Montgomery modular multiplication. Montgomery modular multiplication is performed on each data in the last layer to obtain data converted to the point value domain.

[0019] Based on each data point transformed to the point value domain, a point value array is generated, which includes a plaintext point value array and a perturbation point value array.

[0020] Optionally, the step of using the pre-generated NTRU public key in conjunction with the perturbation point value array to perform operations on the plaintext point value array to obtain the ciphertext point value array includes:

[0021] Perform a Montgomery modular multiplication on the pre-generated NTRU public key, the perturbation point value array, and the plaintext point value array to obtain the ciphertext of the plaintext, which is then used as the ciphertext point value array.

[0022] The ciphertext satisfies the following formula:

[0023]

[0024] in, The ciphertext, The array of disturbance point values. For the NTRU public key, For the plaintext point value array, The modulus is i, and i and j represent the row and column coordinates of the array. This refers to the summation traversal index for the circular convolution operation. This indicates the total number of rows in the array.

[0025] Optionally, the pre-generation process of the NTRU public key includes:

[0026] Based on the security requirements of the plaintext to be processed, security parameters that meet the security requirements and are applicable to the Good's Trick and Lazy-NTT strategies are selected; the security parameters include multinomial dimension, modulus, and Montgomery cardinality.

[0027] Based on the security parameters, the key polynomial required to generate the NTRU public key and the inverse key polynomial of the key polynomial in the mode are generated; the key polynomial includes a public key polynomial and a private key polynomial.

[0028] Transform the key polynomial and the inverse key polynomial into the Montgomery field to obtain the Montgomery field key polynomial and the Montgomery field inverse key polynomial.

[0029] Based on the Montgomery domain key polynomial and the Montgomery domain inverse key polynomial, the key point value array and the inverse key point value array are obtained by using the Good's Trick strategy and the Lazy-NTT strategy of the NTRU algorithm.

[0030] Perform a column-to-column circular convolution on the key point value array and the inverse key point value array to obtain the NTRU public key.

[0031] Optionally, after selecting security parameters that meet the security requirements of the plaintext to be processed and are applicable to the Good's Trick and Lazy-NTT strategies, the method further includes:

[0032] Based on the security parameters, calculate the unit root table, the anti-unit root table, and the multiplication type judgment table of the Lazy-NTT strategy;

[0033] The unit root table includes a Montgomery field unit root table and an integer field unit root table; the inverse unit root table includes a Montgomery field inverse unit root table and an integer field inverse unit root table.

[0034] Optionally, the step involves obtaining multiple ciphertext point value arrays generated based on the above steps; based on the convolutional characteristics of the Good's Trick strategy, performing column-to-column circular convolutions on the multiple ciphertext point value arrays within the point value domain, and combining this with Montgomery modular multiplication to perform homomorphic operations, resulting in a homomorphic operation result point value array, including:

[0035] Obtain the ciphertext point value arrays of the two ciphertexts to be processed, denoted as follows: and ;

[0036] If homomorphic addition is performed, the values ​​at corresponding positions in the two ciphertext point value arrays are added together and the modulo is taken. The calculation formula is as follows:

[0037]

[0038] If homomorphic multiplication is performed, then based on the convolutional properties of the Good's Trick strategy, a column-to-column circular convolution is performed on the two ciphertext point value arrays, and Montgomery modular multiplication is performed for element-wise multiplication operations in the summation operation, with the calculation formula as follows:

[0039]

[0040] in, This is an array of homomorphic addition results. Let i and j be the array of homomorphic multiplication results, where i and j represent the row and column coordinates of the array. Here, c represents the summation traversal index for the circular convolution operation, and c is the total number of rows in the array. It is the modulus.

[0041] On the other hand, the present invention also provides a high-performance data multi-domain transform lattice-based homomorphic encryption system, comprising:

[0042] The acquisition module is used to acquire the initial polynomial of the plaintext to be processed, wherein the initial polynomial includes the plaintext polynomial of the plaintext to be processed and the random perturbation polynomial.

[0043] The first transformation module is used to transform the initial polynomial to the Montgomery domain to obtain a Montgomery domain polynomial; using the Good's Trick strategy of the NTRU algorithm, the Montgomery domain polynomial is mapped to obtain a two-dimensional array; using the Lazy-NTT strategy of the NTRU algorithm, the two-dimensional array is transformed to the point value domain to obtain a point value array, the point value array including a plaintext point value array and a perturbation point value array;

[0044] The encryption module is used to perform operations on the plaintext point value array using a pre-generated NTRU public key combined with the perturbation point value array to obtain a ciphertext point value array; if there are multiple plaintexts to be processed and there is a need for ciphertext operations, then a corresponding ciphertext point value array is generated for each plaintext to be processed, thus obtaining a ciphertext point value array for each plaintext to be processed; and then homomorphic addition and / or homomorphic multiplication operations are performed directly on the multiple ciphertext point value arrays within the point value domain to obtain a homomorphic operation result point value array.

[0045] Alternatively, it may include a homomorphic operation module for obtaining multiple ciphertext point value arrays generated by the encryption module; based on the convolution characteristics of the Good's Trick strategy, performing column-to-column circular convolution on the multiple ciphertext point value arrays within the point value domain, and performing homomorphic operations in conjunction with Montgomery modular multiplication to obtain the homomorphic operation result point value array.

[0046] Optionally, the first conversion module is specifically used for:

[0047] The coefficients of the initial polynomial are multiplied by the preset Montgomery base and modulo q of the NTRU algorithm to obtain the Montgomery field polynomial.

[0048] Optionally, the first conversion module is specifically used for:

[0049] Using the Lazy-NTT strategy of the NTRU algorithm, the following multi-level Lazy-NTT transformation is performed on each row of data in the two-dimensional array:

[0050] If the current layer is not the last layer, then based on the index of each data in the current layer and in conjunction with the multiplication type determination table, the multiplication type used for each data is determined; based on each data, when the multiplication type used for the data is Montgomery modular multiplication, a rotation factor is selected from the Montgomery domain unit root table, and Montgomery modular multiplication is performed on the data and the rotation factor to obtain data converted to the point value domain; when the multiplication type used for the data is standard multiplication, a rotation factor is read from the integer domain unit root table, and the data and the rotation factor are directly multiplied to obtain data converted to the point value domain.

[0051] If the current layer is the last layer, then the multiplication type of the last layer is determined to be Montgomery modular multiplication. Montgomery modular multiplication is performed on each data in the last layer to obtain data converted to the point value domain.

[0052] Based on each data point transformed to the point value domain, a point value array is generated, which includes a plaintext point value array and a perturbation point value array.

[0053] Optionally, the first conversion module is specifically used for:

[0054] Perform a Montgomery modular multiplication on the pre-generated NTRU public key, the perturbation point value array, and the plaintext point value array to obtain the ciphertext of the plaintext, which is then used as the ciphertext point value array.

[0055] The ciphertext satisfies the following formula:

[0056]

[0057] in, The ciphertext, The array of disturbance point values. For the NTRU public key, For the plaintext point value array, The modulus is i, and i and j represent the row and column coordinates of the array. This refers to the summation traversal index for the circular convolution operation. This indicates the total number of rows in the array.

[0058] Optionally, a public key generation module is also included, used for:

[0059] Based on the security requirements of the plaintext to be processed, security parameters that meet the security requirements and are applicable to the Good's Trick and Lazy-NTT strategies are selected; the security parameters include multinomial dimension, modulus, and Montgomery cardinality.

[0060] Based on the security parameters, the key polynomial required to generate the NTRU public key and the inverse key polynomial of the key polynomial in the mode are generated; the key polynomial includes a public key polynomial and a private key polynomial.

[0061] Transform the key polynomial and the inverse key polynomial into the Montgomery field to obtain the Montgomery field key polynomial and the Montgomery field inverse key polynomial.

[0062] Based on the Montgomery domain key polynomial and the Montgomery domain inverse key polynomial, the key point value array and the inverse key point value array are obtained by using the Good's Trick strategy and the Lazy-NTT strategy of the NTRU algorithm.

[0063] Perform a column-to-column circular convolution on the key point value array and the inverse key point value array to obtain the NTRU public key.

[0064] Optionally, the public key generation module is further configured to:

[0065] Based on the security parameters, calculate the unit root table, the anti-unit root table, and the multiplication type judgment table for the Lazy-NTT strategy; the security parameters include polynomial dimension, modulus q, and Montgomery cardinality;

[0066] The unit root table includes a Montgomery field unit root table and an integer field unit root table; the inverse unit root table includes a Montgomery field inverse unit root table and an integer field inverse unit root table.

[0067] Optionally, the encryption module is specifically used for:

[0068] Obtain the ciphertext point value arrays of the two ciphertexts to be processed, denoted as follows: and ;

[0069] If homomorphic addition is performed, the values ​​at corresponding positions in the two ciphertext point value arrays are added together and the modulo is taken. The calculation formula is as follows:

[0070]

[0071] If homomorphic multiplication is performed, then based on the convolutional properties of the Good's Trick strategy, a column-to-column circular convolution is performed on the two ciphertext point value arrays, and Montgomery modular multiplication is performed for element-wise multiplication operations in the summation operation, with the calculation formula as follows:

[0072]

[0073] in, This is an array of homomorphic addition results. Let i and j be the array of homomorphic multiplication results, where i and j represent the row and column coordinates of the array. Here, c represents the summation traversal index for the circular convolution operation, and c is the total number of rows in the array. It is the modulus.

[0074] On the other hand, the present invention also provides a high-performance data multi-domain transform lattice basis homomorphic decryption method, comprising:

[0075] Using the pre-generated NTRU private key, the obtained ciphertext is decrypted to obtain an array of decryption point values;

[0076] The array of decryption point values ​​is converted into a time-domain decryption array using the inverse Lazy-NTT strategy of the NTRU algorithm;

[0077] The time-domain decryption array is converted into a Montgomery domain decryption array using the inverse Good's Trick strategy of the NTRU algorithm.

[0078] The plaintext of the ciphertext is obtained by performing normal field restoration on the Montgomery field decryption array.

[0079] Optionally, the step of using a pre-generated NTRU private key to decrypt the acquired ciphertext to obtain a decryption point value array includes:

[0080] The pre-generated NTRU private key and the obtained ciphertext are subjected to column-to-column circular convolution to obtain an array of decryption point values.

[0081] Optionally, the step of using the inverse Lazy-NTT strategy of the NTRU algorithm to convert the decryption point value array into a time-domain decryption array includes:

[0082] Using the inverse Lazy-NTT strategy of the NTRU algorithm, the following multi-layer inverse Lazy-NTT transformation is performed on each row of data in the decryption point value array:

[0083] If the current layer is not the last layer, then based on the index of each data in the current layer and in conjunction with the multiplication type determination table, the multiplication type used for each data is determined; based on each data, when the multiplication type used for the data is Montgomery modular multiplication, a twitch factor is selected from the Montgomery domain inverse root of unity table, and Montgomery modular multiplication is performed on the data and the twitch factor to obtain data converted to the time domain; when the multiplication type used for the data is standard multiplication, a twitch factor is read from the integer domain inverse root of unity table, and the data and the twitch factor are directly multiplied to obtain data converted to the time domain.

[0084] If the current layer is the last layer, then the multiplication type of the last layer is determined to be Montgomery modular multiplication. Montgomery modular multiplication is performed on each data in the last layer to obtain the data converted to the time domain.

[0085] A time-domain decryption array is generated based on each piece of data transformed to the time domain.

[0086] Optionally, the step of using the inverse Good's Trick strategy of the NTRU algorithm to convert the time-domain decryption array into a Montgomery-domain decryption array includes:

[0087] Using the inverse Good's Trick strategy of the NTRU algorithm, the time-domain decryption array is reverse-mapped to obtain the Montgomery domain decryption array;

[0088] The Montgomery field decryption array satisfies the following formula:

[0089]

[0090] Where s is the index data in the Montgomery field decryption array. This indicates that Dim is in the modulus. The reverse element below, It means In the modular inverse Dim, Row and Col represent the Row-th and Col-th columns of the time-domain decryption array, and Dim and k represent parameters related to the polynomial dimension.

[0091] On the other hand, the present invention also provides a high-performance data multi-domain transform lattice basis homomorphic decryption system, comprising:

[0092] The decryption module is used to decrypt the acquired ciphertext using a pre-generated NTRU private key to obtain an array of decryption point values.

[0093] The second conversion module is used to convert the decryption point value array into a time-domain decryption array using the inverse Lazy-NTT strategy of the NTRU algorithm; and to convert the time-domain decryption array into a Montgomery domain decryption array using the inverse Good's Trick strategy of the NTRU algorithm.

[0094] The restoration module is used to perform normal field restoration processing on the Montgomery field decryption array to obtain the plaintext of the ciphertext.

[0095] Optionally, the decryption module is specifically used for:

[0096] The pre-generated NTRU private key and the obtained ciphertext are subjected to column-to-column circular convolution to obtain an array of decryption point values.

[0097] Optionally, the second conversion module is specifically used for:

[0098] Using the inverse Lazy-NTT strategy of the NTRU algorithm, the following multi-layer inverse Lazy-NTT transformation is performed on each row of data in the decryption point value array:

[0099] If the current layer is not the last layer, then based on the index of each data in the current layer and in conjunction with the multiplication type determination table, the multiplication type used for each data is determined; based on each data, when the multiplication type used for the data is Montgomery modular multiplication, a twitch factor is selected from the Montgomery domain inverse root of unity table, and Montgomery modular multiplication is performed on the data and the twitch factor to obtain data converted to the time domain; when the multiplication type used for the data is standard multiplication, a twitch factor is read from the integer domain inverse root of unity table, and the data and the twitch factor are directly multiplied to obtain data converted to the time domain.

[0100] If the current layer is the last layer, then the multiplication type of the last layer is determined to be Montgomery modular multiplication. Montgomery modular multiplication is performed on each data in the last layer to obtain the data converted to the time domain.

[0101] A time-domain decryption array is generated based on each piece of data transformed to the time domain.

[0102] Optionally, the second conversion module is specifically used for:

[0103] Using the inverse Good's Trick strategy of the NTRU algorithm, the time-domain decryption array is reverse-mapped to obtain the Montgomery domain decryption array;

[0104] The Montgomery field decryption array satisfies the following formula:

[0105]

[0106] Where s is the index data in the Montgomery field decryption array. This indicates that Dim is in the modulus. The reverse element below, It means In the modular inverse Dim, Row and Col represent the Row-th and Col-th columns of the time-domain decryption array, and Dim and k represent parameters related to the polynomial dimension.

[0107] On the other hand, the present invention also provides a computer device, comprising: one or more processors;

[0108] The processor is used to store one or more programs;

[0109] When the one or more programs are executed by the one or more processors, the high-performance data multi-domain transformation lattice basis homomorphic encryption method described in any one of the above-mentioned methods is implemented, or the high-performance data multi-domain transformation lattice basis homomorphic decryption method described in any one of the above-mentioned methods is implemented.

[0110] On the other hand, the present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed, it implements the high-performance data multi-domain transform lattice basis homomorphic encryption method described in any one of the above, or implements the high-performance data multi-domain transform lattice basis homomorphic decryption method described in any one of the above.

[0111] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0112] This invention provides a high-performance data multi-domain transformation lattice basis homomorphic encryption method and system. In this method, an initial polynomial is transformed to the Montgomery domain, mapped to a two-dimensional array using the Good's Trick strategy, and then transformed to the point value domain using the Lazy-NTT strategy. Finally, encryption is completed by combining the perturbed point value array. This invention constructs the polynomial dimension into a structure adapted to two-dimensional transformation (…). This approach breaks through the parameter limitations of traditional NTT, utilizing Good's Trick to accelerate separation between different dimensions; it introduces a Lazy-NTT strategy to delay intermediate modular reduction operations, and combines this with Montgomery modular multiplication to reduce the computational complexity of the NTRU core polynomial multiplication from that of traditional time-domain convolution. Significantly reduced to quasi-linear complexity This significantly reduces the number of calls to the modular reduction operation, thereby significantly improving overall operating efficiency while ensuring calculation accuracy.

[0113] This invention offers significant performance advantages in homomorphic computation. For privacy-preserving computation scenarios, this invention supports direct homomorphic addition or multiplication of ciphertext point-value arrays within the transform domain (point-value domain). Compared to existing technologies that typically require repeated "inverse transform-time domain computation-forward transform" processes, this invention avoids the cumbersome domain transformation overhead. This allows homomorphic ciphertext computation to not only circumvent... The time-domain multiplication complexity is reduced, and the multiple transformations are eliminated. This reduces overhead and directly achieves O(N) efficient computation with complexity linearly dependent on the polynomial dimension. This low-complexity homomorphic computation capability greatly reduces resource consumption and latency in privacy-preserving computation, making it particularly suitable for environments with high real-time requirements, such as edge computing.

[0114] This invention provides a high-performance data multi-domain transformation lattice basis homomorphic decryption method and system. The method uses a pre-generated NTRU private key to decrypt the acquired ciphertext, obtaining a decryption point value array. Then, using the inverse Lazy-NTT strategy of the NTRU algorithm, the decryption point value array is converted into a time-domain decryption array. Finally, using the inverse Good's Trick strategy of the NTRU algorithm, the time-domain decryption array is converted into a Montgomery domain decryption array. The Montgomery domain decryption array is then subjected to normal domain restoration processing to obtain the plaintext of the ciphertext. This invention provides the decryption algorithm corresponding to the above encryption method, introducing the inverse Lazy-NTT strategy and the Lazy-NTT strategy, which can effectively reduce the computational complexity of decryption, thereby significantly improving the overall operating efficiency while ensuring computational accuracy. Attached Figure Description

[0115] Figure 1 This is a flowchart illustrating the high-performance data multi-domain transformation lattice basis homomorphic encryption method of the present invention;

[0116] Figure 2 This is a flowchart illustrating the high-performance data multi-domain transformation lattice basis homomorphic decryption method of the present invention;

[0117] Figure 3 This is a flowchart illustrating the multi-domain transformation NTRU encryption performance optimization method supporting privacy computing according to the present invention.

[0118] Figure 4 This is a schematic diagram of the high-performance data multi-domain transformation lattice basis homomorphic encryption system architecture of the present invention;

[0119] Figure 5 This is a schematic diagram of the high-performance data multi-domain transformation lattice basis homomorphic decryption system architecture of the present invention;

[0120] Figure 6 This is a schematic diagram of the electronic device of the present invention. Detailed Implementation

[0121] The specific embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0122] Example 1:

[0123] This invention provides a high-performance data multi-domain transformation lattice basis homomorphic encryption method flow, such as... Figure 1 As shown, it includes:

[0124] Step 101: Obtain the initial polynomial of the plaintext to be processed. The initial polynomial includes the plaintext polynomial of the plaintext to be processed and the random perturbation polynomial.

[0125] Step 102: Transform the initial polynomial to the Montgomery field to obtain the Montgomery field polynomial;

[0126] Step 103: Using the Good's Trick strategy of the NTRU algorithm, map the Montgomery field polynomial to obtain a two-dimensional array;

[0127] Step 104: Using the Lazy-NTT strategy of the NTRU algorithm, the two-dimensional array is transformed into the point value domain to obtain the point value array, which includes the plaintext point value array and the perturbation point value array;

[0128] Step 105: Using the pre-generated NTRU public key and the perturbation point value array, perform operations on the plaintext point value array to obtain the ciphertext point value array.

[0129] If there are multiple plaintexts to be processed and there is a need for ciphertext operations, then repeat steps 101 to 105 above for multiple plaintexts to be processed to obtain a ciphertext point value array for each plaintext to be processed; then directly perform homomorphic addition and / or homomorphic multiplication operations on multiple ciphertext point value arrays within the point value domain to obtain a homomorphic operation result point value array.

[0130] This invention constructs the polynomial dimension into a structure adapted to two-dimensional transformations, utilizes the Good's Trick strategy to accelerate separation between different dimensions, improves parameter flexibility and security, and introduces the Lazy-NTT strategy to delay intermediate modular reduction operations, effectively reducing the computational complexity caused by the number of modular reductions. This can reduce computational complexity and overhead, thereby significantly improving overall operating efficiency while ensuring computational accuracy.

[0131] This invention relates to a high-performance homomorphic encryption method for data based on the multi-domain transform NTRU algorithm, which is particularly suitable for application scenarios such as privacy computing that require large-scale encrypted data processing.

[0132] The core idea of ​​the NTRU cryptographic algorithm is to transform plaintext or ciphertext into a polynomial on a ring, and then perform encryption and decryption through operations. This invention introduces the Good's Trick strategy into the NTRU cryptographic algorithm. This strategy can construct a one-dimensional polynomial with dimension N using index mapping. The two-dimensional structure, where Dim is typically a prime number less than 10 and k is a positive integer; this strategy, by decomposing the dimension, enables efficient computation of convolutions even for non-power-2 length polynomials that originally did not support NTT (Number Theoretic Transform). Furthermore, this invention introduces a Lazy-NTT strategy into the NTRU cryptographic algorithm, which optimizes the traditional NTT strategy. During the Lazy-NTT transformation, some multiplications are temporarily not performed modulo operations. q Instead of performing computational operations, this method relies on a pre-computed decision table and alternates between standard multiplication and Montgomery modular multiplication in number-theoretic transformations, ensuring correct reduction of the result only at the last level. This method reduces the number of modular operations and improves computational efficiency by delaying modular reduction operations. The Good's Trick strategy and the Lazy-NTT strategy will be explained in detail later in conjunction with the corresponding steps.

[0133] In step 101 above, the plaintext to be processed is the plaintext to be sent. After obtaining the plaintext, the encrypting party can convert the plaintext into a plaintext polynomial. And the random perturbation polynomial used for encryption. .

[0134] In one implementation, in step 102 above, the coefficients of the initial polynomial can be multiplied by a preset Montgomery base R and modulo q of the NTRU algorithm to obtain a Montgomery-domain polynomial. This implementation can convert the coefficients of the plaintext polynomial and the randomly perturbed polynomial to the Montgomery domain to facilitate subsequent Montgomery modular multiplication. The initial polynomial includes both plaintext and randomly perturbed polynomials; correspondingly, the Montgomery-domain polynomial includes both plaintext and perturbed Montgomery-domain polynomials.

[0135] This invention introduces a Good's Trick strategy into the NTRU algorithm. In step 103, the coefficients of the Montgomery field polynomial can be mapped to a two-dimensional array using the Good's Trick. The Montgomery field polynomial includes plaintext Montgomery field polynomials and perturbed Montgomery field polynomials; correspondingly, the two-dimensional array includes plaintext two-dimensional arrays and perturbed two-dimensional arrays. For example, the Good's Trick technique can be used to cleverly construct the dimension N of the one-dimensional polynomial into... The two-dimensional structure allows the computation to be decomposed into recurrent convolutions along dimension Dim and along dimension Dim. The fast number theory transformation breaks through the dimensionality limitation of traditional NTT, allowing for more flexible and safer parameter selection, where k is a positive integer.

[0136] In step 104 above, a Lazy-NTT transformation can be performed on the values ​​of each row in the mapped two-dimensional data to obtain a point value array. By introducing a Lazy-NTT strategy during the NTT transformation process—that is, selectively delaying the execution of expensive modulo reduction operations in the intermediate steps of the transformation—the computational overhead is significantly reduced. The two-dimensional array includes a plaintext two-dimensional array and a perturbed two-dimensional array; correspondingly, the point value array includes a plaintext point value array. and perturbation point value array .

[0137] In one implementation, step 104 above can utilize the Lazy-NTT strategy of the NTRU algorithm. Based on a multiplication type judgment table, standard multiplication and Montgomery modular multiplication are alternately applied to each row of data in the two-dimensional array to obtain each row of data transformed to the point value domain. Based on each row of data transformed to the point value domain, a point value array is generated. This implementation combines Montgomery modular multiplication technology, replacing traditional modular multiplication operations with a series of more efficient shift and addition operations in key steps such as point value domain multiplication, further reducing computational complexity.

[0138] For example, the Lazy-NTT strategy of the NTRU algorithm can be used to perform the following multi-level Lazy-NTT transformation on each row of data in a two-dimensional array:

[0139] If the current layer is not the last layer, the multiplication type for each data point is determined based on the index of each data point in the current layer and the multiplication type determination table. For each data point, if the multiplication type is Montgomery modular multiplication, a rotation factor is selected from the Montgomery domain unit root table, and Montgomery modular multiplication is performed on the data and the rotation factor to obtain the data converted to the point value domain. If the multiplication type is standard multiplication, the rotation factor is read from the integer domain unit root table, and the data and the rotation factor are multiplied directly to obtain the data converted to the point value domain.

[0140] If the current layer is the last layer, then the multiplication type of the last layer is determined to be Montgomery modular multiplication. Montgomery modular multiplication is performed on each data in the last layer to obtain the data transformed to the point value domain.

[0141] For each data point transformed to the point value domain, a point value array is generated, comprising a plaintext point value array and a perturbation point value array. See the subsequent description for a detailed implementation of this example.

[0142] In step 105 above, a Montgomery modular multiplication can be performed on the pre-generated NTRU public key, the perturbation point value array, and the plaintext point value array to obtain the ciphertext of the plaintext, which serves as the ciphertext point value array. In one implementation, the NTRU public key... and random perturbation polynomial The ciphertext polynomial is obtained by performing a column-by-column circular convolution on the two-dimensional array of point values, and then adding it to the corresponding values ​​in the plaintext point value array. Two-dimensional array form Then, it is sent to the decryptor in this form so that the decryptor can decrypt it. For example, the ciphertext (in two-dimensional array form) satisfies the following formula:

[0143]

[0144] in, It is a ciphertext. For the array of perturbation point values, For NTRU public key, For the plaintext point value array, Let i and j be the modulus, and i and j represent the row and column coordinates of the array. This refers to the summation traversal index for the circular convolution operation. This represents the total number of rows in the array. It is the modulus.

[0145] In one implementation, the pre-generation process of the NTRU public key in step 105 above includes:

[0146] 105-1: Based on the security requirements of the plaintext to be processed, select security parameters that meet the security requirements and are applicable to the Good's Trick and Lazy-NTT strategies; the security parameters include multinomial dimension, modulus, and Montgomery cardinality;

[0147] 105-2: Based on security parameters, generate the key polynomial required to generate the NTRU public key and the inverse key polynomial of the key polynomial in modulus; the key polynomial includes the public key polynomial and the private key polynomial;

[0148] 105-3: Transform the key polynomial and inverse key polynomial to the Montgomery field to obtain the Montgomery field key polynomial and the Montgomery field inverse key polynomial.

[0149] 105-4: Based on the Montgomery field key polynomial and the Montgomery field inverse key polynomial, the key point value array and the inverse key point value array are obtained by using the Good's Trick strategy and the Lazy-NTT strategy of the NTRU algorithm.

[0150] 105-5: Perform column-to-column circular convolution on the key point value array and the inverse key point value array to obtain the NTRU public key.

[0151] The polynomial dimension in the aforementioned 105-1 safety parameters Where Dim is generally a prime number less than 10, and k is a positive integer; the modulus is guaranteed. To satisfy the condition that number-theoretic transformations have usable roots of unity; due to the introduction of Lazy-NTT, to ensure that Montgomery modular multiplication and standard multiplication can be correctly alternated, the Montgomery cardinality R must satisfy... R is typically a power of 2. For example, the NTRU algorithm operates within a ring of... Z represents the finite integer ring containing the coefficients, indicating the range of values ​​for all polynomials. X is a placeholder in the polynomial, representing a cyclic shift operation. In this implementation, the polynomial dimension N is related to the security level, key size, and computational complexity, while the modulus q controls the noise range, security strength, and computational precision.

[0152] The key polynomial required to generate the NTRU public key in section 105-2 above includes the public key polynomial. and private key polynomial For example, the inverse key polynomial can be a polynomial of the key polynomial computed using the extended Euclidean algorithm at modulo q and modulo p, including inverse public-key polynomials such as... or , and the inverse private key polynomial, such as or X is a placeholder in the polynomial, and N is the dimension of the polynomial.

[0153] In the above 105-3, the coefficients of the key polynomial and the inverse key polynomial can be multiplied by the Montgomery base R and modulo q, so that the coefficients of the polynomial are transformed into the Montgomery field for use in subsequent Montgomery modular multiplications.

[0154] The above 105-4 refers to , The polynomial coefficients are mapped to a two-dimensional array using Good's Trick mapping, and then subjected to a Lazy-NTT transformation. During the transformation, standard multiplication and Montgomery modular multiplication are used alternately based on a multiplication type determination table. For example, for... , The mapping rule formula for converting polynomial coefficients into a two-dimensional array using Good's Trick mapping is as follows: If the original polynomial coefficient index s satisfies The formula for calculating the position of the index in the two-dimensional array is: According to this mapping rule, a two-dimensional array is obtained. The value of the position, where Row and Col are the row and column of the two-dimensional array, respectively. Dim is generally a prime number less than 10, usually the row number of Good's Trick, and k is a positive integer.

[0155] When performing a Lazy-NTT transformation, the values ​​in each row of the mapped two-dimensional array are transformed using the Lazy-NTT transformation. For example, the transformation rules are as follows:

[0156] Taking a two-dimensional array `map` as an example, the number of number-theoretic transformation layers for the `i` rows of a Lazy-NTT transformation is: That is, the number of transformation layers is k. In the Lazy-NTT transformation of the row, each layer uses the Cooley-Tukey method for binary recursion. The calculation method between layers is as follows: for the s-th layer of the Lazy-NTT in column j... The block size of this layer transformation The rotation factor of this layer transformation for: For all each Where z is a set of parameters related to the block size, For parameters related to block size m, execute:

[0157] (1) , where u and v are intermediate quantities;

[0158] (2) Calculation The type of multiplication is determined by the multiplication type judgment table. If the value in the table is 1, Montgomery modular multiplication is used; if the value in the table is 0, standard multiplication is used.

[0159] As shown in the steps above, v is currently in the Montgomery domain. If we use Montgomery modular multiplication, we only need to look up the table of roots of unity in the Montgomery domain to obtain the twiddle factor. The values ​​of the Montgomery domain are then calculated, followed by Montgomery modular multiplication. The calculation steps are as follows:

[0160] 1. Calculate the product of two values ​​located in the Montgomery region. Where t is the raw (unreduced) product of the two Montgomery domain values, and is an intermediate quantity. The rotation factor is the size m of column j.

[0161] 2. Introduce an auxiliary value b. ,in It belongs to the intermediate quantity, that is .

[0162] 3. Perform specifications and calculations. From the characteristics of auxiliary values, it can be seen that... It is definitely divisible by R, and t' is an intermediate quantity.

[0163] 4. Make corrections if... ,but ,otherwise .

[0164] In the above calculation, since R is an integer power of 2, the division and modulo operations involved can be replaced by shift operations, which greatly improves the efficiency of the calculation compared to traditional modulo operations.

[0165] If a lookup table indicates that standard multiplication is used in this step, then it is necessary to look up the table of units in the normal real number domain and then perform the calculation. There is no need to perform a modular q operation. Instead, reducing the value to a suitable range guarantees the next Montgomery modular multiplication. Therefore, the last multiplication calculation of an index must be a Montgomery modular multiplication.

[0166] (3) Based on the above calculation results, calculate the value corresponding to the index in the next layer until the last layer is calculated, and the Lazy-NTT transformation is completed.

[0167]

[0168]

[0169] In the above 105-5, it can be The transformed two-dimensional arrays are denoted as follows: The public key is obtained by calculating the column-to-column circular convolution between these two arrays. The two-dimensional array form is denoted as the public key. Its calculation formula is

[0170]

[0171] in , , For modulus, Represents the row and column coordinates of the array. This refers to the summation traversal index for the circular convolution operation. This represents the total number of rows in the array. All multiplications used in this step employ Montgomery modular multiplication to improve the efficiency of the modular operation after multiplication.

[0172] Understandably, to make it easier for encryptors to use the same optimized method for encryption, it can be directly... It is published in the form of a two-dimensional array, that is At this point, the values ​​in each row of the array are in the dotted range. The encryptor can then use this key directly for calculations.

[0173] Optionally, after selecting security parameters that meet the security requirements of the plaintext to be processed and are applicable to the Good's Trick and Lazy-NTT strategies based on the security parameters, the above 105-1 can also calculate the unit root table of the Lazy-NTT strategy based on the security parameters. and inverse unit root table And a multiplication type determination table. Unit root table. and inverse unit root table Both the multiplication type judgment table and the multiplication type judgment table contain reusable values. After storage, subsequent calculations can be accelerated and simplified.

[0174] root of unity w and anti-root of unity Each table needs to have two versions: one in the Montgomery domain and the other in the normal integer domain. For example, the root of unity table includes both the Montgomery domain root of unity table and the integer domain root of unity table; the inverse root of unity table includes both the Montgomery domain inverse root of unity table and the integer domain inverse root of unity table. The multiplication type determination table represents the inference table for which type of multiplication Lazy-NTT uses.

[0175] The unit root table contains unit roots. The set of powers is The inverse unit root table contains inverse unit roots. The set of powers is The exponent variable i represents the power of the root of unity or inverse root of unity. Corresponding to a different twitch factor (e.g.) or In NTT butterfly operations, each level uses different... The unit root, for example, in the s-th layer (s=0,1,...,k) 1) The unit root used is ,in This refers to the index offset, where n is related to the polynomial dimension. Only half the unit root or the inverse unit root needs to be stored in the table, effectively reducing pre-computation overhead.

[0176] In addition, a unit root table and an anti-unit root table need to be prepared for the Montgomery domain. This involves multiplying all values ​​in the original table (unit root table or anti-unit root table) by the Montgomery base R and performing a modulo q operation. In this way, when Montgomery modular multiplication is needed, this table can be looked up directly, avoiding frequent entries and exits from the domain.

[0177] The multiplication type determination table can be deduced based on the rules used in Lazy-NTT for Montgomery modular multiplication and standard multiplication. The deduction rule is as follows: k levels of operations are performed in number-theoretical transformations. It is guaranteed that the last level of multiplication for a given index is a Montgomery modular multiplication, while multiplication operations in other levels are performed alternately by Montgomery modular multiplication and standard multiplication. To determine which level of the number-theoretical transformation a given index will have multiplication, simply convert the index to binary form. From the most significant bit to the least significant bit, the bit with a value of 1 corresponds to the level where multiplication occurs.

[0178] In this embodiment of the invention, the encryptor transforms the plaintext into a polynomial form. Choose a random perturbation polynomial The two polynomials are mapped to a two-dimensional array using Good's Trick, and then a Lazy-NTT transformation is performed to convert the values ​​in each row of the two-dimensional array to the point value range. This is done using a public key. plaintext Encrypt, and Perform column-to-column convolution on the two-dimensional array, and then... The values ​​at corresponding positions in the two-dimensional array are added together. This process yields the ciphertext polynomial. Two-dimensional array form Then, it is sent directly to the decryptor in that form.

[0179] In one implementation, the process of directly performing homomorphic addition and / or homomorphic multiplication on multiple ciphertext point value arrays within the point value domain to obtain a homomorphic operation result point value array includes:

[0180] Within the dot value domain, sequentially obtain two ciphertext dot value arrays of the ciphertext to be processed from multiple ciphertext dot value arrays, denoted as follows: and ;

[0181] If two ciphertext point value arrays are homomorphically added, the values ​​at corresponding positions in the two ciphertext point value arrays are added and the modulo is taken. The calculation formula is as follows:

[0182]

[0183] If two ciphertext point value arrays are homomorphically multiplied, then based on the convolutional properties of the Good's Trick strategy, a column-to-column circular convolution is performed on the two ciphertext point value arrays, calculated as follows:

[0184]

[0185] in, This is an array of homomorphic addition results. Let i and j be the array of homomorphic multiplication results, where i and j represent the row and column coordinates of the array. c is the summation traversal index for the circular convolution operation, and c is the total number of rows in the array; and in the summation operation of homomorphic multiplication, Montgomery modular multiplication is performed for the multiplication operation between the elements of the ciphertext point value array.

[0186] It is understood that the homomorphic addition and homomorphic multiplication proposed in this implementation method are applicable to any two ciphertext point value arrays that have ciphertext operation requirements. In this embodiment of the invention, only two ciphertext point value values ​​in multiple ciphertext point value arrays are used for illustration. The homomorphic addition and / or homomorphic multiplication can also be used for intermediate arrays generated during the ciphertext operation process.

[0187] Example 2:

[0188] Based on the same inventive concept, this invention also provides a high-performance data multi-domain transformation lattice basis homomorphic decryption method flow, such as... Figure 2 As shown, it includes:

[0189] Step 201: Use the pre-generated NTRU private key to decrypt the obtained ciphertext and obtain an array of decryption point values;

[0190] Step 202: Using the inverse Lazy-NTT strategy of the NTRU algorithm, convert the decryption point value array into a time-domain decryption array;

[0191] Step 203: Using the inverse Good's Trick strategy of the NTRU algorithm, convert the time-domain decryption array into a Montgomery domain decryption array;

[0192] Step 204: Perform normal field restoration on the Montgomery field decryption array to obtain the plaintext of the ciphertext.

[0193] The embodiments of the present invention can reduce the computational complexity of decryption, thereby significantly improving the overall operating efficiency while ensuring computational accuracy.

[0194] The ciphertext obtained in step 201 above can be ciphertext. Two-dimensional array style In one implementation, step 201 above can be performed on the pre-generated NTRU private key (as in the above embodiment). The decryption point value array is obtained by performing a column-by-column convolution on the obtained ciphertext (in the form of a two-dimensional array) and the ciphertext. This decryption point value array can be a polynomial. Two-dimensional array form .

[0195] In one possible implementation, in step 202 above, the polynomial can be... The inverse lazy-NTT is performed on the two-dimensional array form, so that the values ​​of each row are transformed from the point domain to the time domain.

[0196] For example, using the inverse Lazy-NTT strategy of the NTRU algorithm, the following multi-layer inverse Lazy-NTT transformation is performed on each row of data in the decryption point value array: If the current layer is not the last layer, the multiplication type used for each data is determined based on the index of each data in the current layer and the multiplication type judgment table; for each data, when the multiplication type used by the data is Montgomery modular multiplication, a rotation factor is selected from the Montgomery domain inverse root of unity table, and Montgomery modular multiplication is performed on the data and the rotation factor to obtain the data converted to the time domain; when the multiplication type used by the data is standard multiplication, the rotation factor is read from the integer domain inverse root of unity table, and the data and the rotation factor are directly multiplied to obtain the data converted to the time domain; if the current layer is the last layer, the multiplication type of the last layer is determined to be Montgomery modular multiplication, and Montgomery modular multiplication is performed on each data in the last layer to obtain the data converted to the time domain; based on each data converted to the time domain, a time-domain decryption array is generated.

[0197] The following is a specific example illustrating this example. In a two-dimensional array... In the inverse Lazy-NTT calculation, the number of inverse transformation layers is: That is, the transformation has k layers, and the layers are recursively transformed using the Cooley-Tukey method with binary search. The calculation method is as follows: for the s-th layer of the inverse Lazy-NTT of column j... The block size of this layer transformation The rotation factor of this layer transformation is For all each ,implement:

[0198] (1)

[0199] (2) Calculation The type of multiplication is determined by the multiplication type judgment table. If the value in the table is 1, Montgomery modular multiplication is used; if the value in the table is 0, standard multiplication is used.

[0200] As shown in the steps above, v is currently in the Montgomery domain. If we use Montgomery modular multiplication, we only need to look up the table of inverse roots of unity in the Montgomery domain to obtain the twiddle factor. The values ​​of the Montgomery field are then used for Montgomery modular multiplication, with the following steps:

[0201] 1. Calculate the product of two values ​​located in the Montgomery region. .

[0202] 2. Introduce an auxiliary value b. ,in ,Right now .

[0203] 3. Perform specifications and calculations. From the characteristics of the auxiliary value, we can know that... It is definitely divisible by R.

[0204] 4. Make corrections if... ,but ,otherwise .

[0205] In the above calculation, since R is an integer power of 2, the division and modulo operations involved can be replaced by shift operations, which greatly improves the efficiency of the calculation compared to traditional modulo operations.

[0206] If a lookup table indicates that the multiplication step uses standard multiplication, then it's necessary to look up the table for inverse roots of unity in the normal real number domain, and then perform the calculation. Since there is no need to perform a modular q operation, this calculation method directly simplifies the calculation. Furthermore, reducing the value to a suitable range is guaranteed by the next Montgomery modular multiplication. Therefore, the last multiplication calculation of an index must be a Montgomery modular multiplication.

[0207] (3) Based on the above calculation results, calculate the value corresponding to the index in the next layer until the last layer is calculated, and the inverse Lazy-NTT transformation is completed.

[0208]

[0209]

[0210] (4) After all layers have been executed, all elements in the array need to be normalized. The calculation formula is as follows:

[0211]

[0212] in , .

[0213] In one implementation, step 203 above can utilize the inverse Good's Trick strategy of the NTRU algorithm to perform an inverse mapping of the time-domain decryption array, resulting in a Montgomery domain decryption array. This implementation can convert the coefficients of the time-domain decryption array from a two-dimensional array representation to a one-dimensional array representation. For example, the Montgomery domain decryption array satisfies the following formula:

[0214]

[0215] Where s is the index data in the Montgomery field decryption array. This indicates that Dim is in the modulus. The reverse element below, It means In the modular inverse Dim, Row and Col represent the Row-th and Col-th columns of the time-domain decryption array, and Dim and k represent parameters related to the polynomial dimension.

[0216] In step 204 above, the Montgomery field can be used to decrypt the array. All coefficients multiplied by the base Then, a modulo-q operation is performed to restore the coefficients from the Montgomery domain to the normal real number domain. Additionally, a center lifting operation is performed on all coefficients in the array, i.e., plaintext restoration, to prevent modulo misalignment during the final decryption step. Plaintext restoration can be achieved by... One-dimensional arrays and Perform general polynomial multiplication over the ring and then modulo p to obtain the plaintext polynomial.

[0217] In this embodiment of the invention, the decryptor receives Then, use the pre-converted form Performing a column-by-column circular convolution between a two-dimensional array and the ciphertext yields a polynomial. Two-dimensional array .Will Perform inverse lazy-NTT, followed by the inverse Good's Trick mapping, to transform the coefficients from a two-dimensional array representation to a one-dimensional array representation. Multiply all coefficients by the base Then, a modulo-q operation is performed to restore the coefficients from the Montgomery domain to the normal domain. After further restoration, the plaintext polynomial can be obtained.

[0218] The following is based on Figure 3 The multi-domain transformation NTRU encryption performance optimization process shown below illustrates the encryption and decryption processes, including the following steps:

[0219] Step 1: Select the NTRU parameters applicable to the Good's Trick and Lazy-NTT methods.

[0220] Step 2: Pre-calculate and store reusable values, such as unit root tables and multiplication type inference tables.

[0221] Step 3: Generate the polynomial used to compute the NTRU public key, such as the public key polynomial. and private key polynomial And calculating the inverse key polynomial, such as the inverse public key polynomial. and inverse private key polynomial .

[0222] Step 4: Transform the coefficients of the polynomials to the Montgomery field. Specifically, the coefficients of each polynomial in Step 3 above can be multiplied by the Montgomery base R and modulo q to transform them to the Montgomery field.

[0223] Step 5: Perform Good's Trick mapping and Lazy-NTT transformation on the coefficients of each polynomial to obtain the point value array.

[0224] Step 6: Calculate the public-key polynomial And publish the public key.

[0225] Step 7: The encryptor uses the public key to encrypt the plaintext. Specifically, the same Good's Trick mapping and Lazy-NTT transformation can be performed on both the plaintext polynomial and the perturbation polynomial, and then the encryption is calculated to obtain the ciphertext.

[0226] Step 8: The cloud or computing party performs homomorphic ciphertext operations in the transform domain. When it is necessary to calculate the homomorphic product of two ciphertexts, the corresponding two-dimensional array form is directly used to perform column-to-column circular convolution on the two-dimensional array based on the convolution characteristics of Good's Trick.

[0227] Step 9: The decryptor decrypts the ciphertext upon receiving it, specifically by combining the ciphertext with... Perform circular convolution, then inverse Lazy-NTT and inverse Good's Trick, and finally restore the coefficients to the normal domain.

[0228] Step 10: Perform plaintext multi-form restoration, specifically by restoring the array to the normal field and... Multiply the ring by the modulo p to obtain the plaintext.

[0229] The working principle of this invention lies in mapping polynomial computation to a multidimensional space for collaborative optimization. By constructing the polynomial dimension into a structure adapted to two-dimensional transformations, Good's Trick is used to accelerate the separation between different dimensions. A Lazy-NTT strategy is introduced in the frequency domain to delay intermediate modular reduction operations. Furthermore, Montgomery modular multiplication is combined to achieve efficient modular multiplication and fast reconstruction. Especially in homomorphic computation scenarios, this invention saves additional transformation time by performing operations directly in the transform domain, utilizing the characteristic that the ciphertext is already in a transformed state. This reduces the complexity originally in the time domain to O(n). Polynomial multiplication is transformed into linear complexity in the frequency domain. This method significantly improves overall operational efficiency while ensuring computational accuracy. It exhibits good structural compatibility and computational versatility, and is applicable to polynomials with dimensions of [insert dimensions here]. The NTRU implementation framework based on a ring structure has good potential for application and promotion.

[0230] Traditional NTRU optimization schemes mainly focus on polynomial multiplication acceleration, modular reduction optimization, and parameter structure design. For example, privacy computing scenarios often involve massive data processing, requiring NTRU optimization to balance high throughput and low latency. However, existing optimization methods are generally still relatively singular, with limited application scope and insufficient synergy. Currently, polynomial multiplication acceleration in NTRU mainly relies on algorithms such as number-theoretic transformations (NTT), Toom-Cook multiplication, and Karatsuba multiplication. While Toom-Cook and Karatsuba are effective in low-dimensional scenarios, their optimization in high-dimensional high-performance computing is still insufficient and cannot compare with NTT-type methods. Modular reduction optimization mainly includes techniques such as Montgomery modular multiplication and Barrett reduction. Although these methods can improve computational efficiency at certain stages, they have not yet formed a complete optimization framework closely integrated with polynomial multiplication acceleration, resulting in weak overall synergy and versatility. Especially in homomorphic computing, if traditional methods directly perform ciphertext multiplication in the time domain, the computational complexity is O(n log n). This severely restricts computational performance; even with conventional transformation acceleration, the lack of direct utilization of the transformed ciphertext results in redundant transformation operations in the computation process, failing to fully unleash the potential for algorithm optimization.

[0231] Significant differences exist regarding parameter structures. Some NTRU variants, in pursuit of higher security, employ parameters with a polynomial dimension of prime numbers; however, this structure struggles to support standard number-theoretic transformation algorithms. Other schemes, to ensure compatibility with NTT, opt for integer powers of 2, which, while beneficial for rapid transformations, raises security concerns. Existing research indicates that integer powers of 2 may introduce symmetry into the polynomial ring, potentially weakening the algorithm's lattice resistance under certain attack models, particularly exhibiting potential risks in the context of algebraic attacks or selected parameter attacks. Therefore, current NTRU optimization requires the introduction of more efficient and structurally sound improvements to address the dual demands of performance and security in privacy-preserving computing applications.

[0232] To address the issues of low efficiency in polynomial multiplication, high overhead in modular reduction, and high computational complexity in homomorphic computation in traditional NTRU encryption algorithms, this invention proposes a collaborative optimization method combining multi-domain transformations. First, Good's Trick enhances parameter flexibility and security. Second, the Lazy-NTT strategy effectively reduces the number of modular reductions, significantly lowering computational overhead. Third, Montgomery modular multiplication is incorporated, transforming time-consuming modular multiplication operations into efficient computations, further improving computational efficiency. Finally, for homomorphic computation, direct computation using transform domain data not only reduces the core multiplication complexity from... Reduced to linear complexity Furthermore, it eliminates the time overhead of the transformation process. This invention deeply integrates multiple optimization techniques to form a complete collaborative optimization framework, solving the problems of single strategy and insufficient collaboration in existing solutions. It can significantly improve the overall computational efficiency of the NTRU algorithm while ensuring security, making it better suited for high-performance scenarios such as privacy computing, especially for accelerating high-dimensional polynomial convolutions in privacy computing.

[0233] The advantages of this invention compared to traditional NTRU encryption algorithms are as follows: It proposes an optimized method for NTRU encryption and homomorphic computation that systematically combines Good's Trick, Lazy-NTT, and Montgomery modular multiplication techniques. Firstly, the key point is the innovative computational framework that utilizes Good's Trick to map a one-dimensional polynomial to a two-dimensional array structure and decomposes polynomial multiplication into columnar circular convolutions between two-dimensional arrays. Secondly, the key point is the adoption of a Lazy-NTT strategy during the transformation process, and the alternating use of a hybrid operation mechanism of standard multiplication and Montgomery modular multiplication based on a pre-computed decision table. Thirdly, the key point is that throughout the entire process of key generation, encryption, homomorphic computation, and decryption, data is transmitted and computed in the two-dimensional point domain or Montgomery domain, supporting direct computation of homomorphic ciphertext in the transformation domain, thus reducing computational complexity from... Reduce to Furthermore, it eliminates the need for transformation steps. Therefore, the scope of protection of this invention covers the NTRU key generation, encryption, homomorphic computation, and decryption system implemented based on the above-mentioned systematic method, as well as its specific deployment and implementation in application scenarios such as privacy computing.

[0234] Example 3:

[0235] Based on the same inventive concept, this invention also provides a high-performance data multi-domain transformation lattice-based homomorphic encryption system, the structural diagram of which is shown below. Figure 4 As shown, it includes:

[0236] The acquisition module is used to acquire the initial polynomial of the plaintext to be processed, wherein the initial polynomial includes the plaintext polynomial of the plaintext to be processed and the random perturbation polynomial.

[0237] The first transformation module is used to transform the initial polynomial to the Montgomery domain to obtain a Montgomery domain polynomial; using the Good's Trick strategy of the NTRU algorithm, the Montgomery domain polynomial is mapped to obtain a two-dimensional array; using the Lazy-NTT strategy of the NTRU algorithm, the two-dimensional array is transformed to the point value domain to obtain a point value array, the point value array including a plaintext point value array and a perturbation point value array;

[0238] The encryption module is used to perform operations on the plaintext point value array using a pre-generated NTRU public key combined with the perturbation point value array to obtain a ciphertext point value array; if there are multiple plaintexts to be processed and there is a need for ciphertext operations, then a corresponding ciphertext point value array is generated for each plaintext to be processed, thus obtaining a ciphertext point value array for each plaintext to be processed; and then homomorphic addition and / or homomorphic multiplication operations are performed directly on the multiple ciphertext point value arrays within the point value domain to obtain a homomorphic operation result point value array.

[0239] In one specific implementation, the first conversion module is specifically used for:

[0240] The coefficients of the initial polynomial are multiplied by the preset Montgomery base and modulo q of the NTRU algorithm to obtain the Montgomery field polynomial.

[0241] In one specific implementation, the first conversion module is specifically used for:

[0242] Using the Lazy-NTT strategy of the NTRU algorithm, the following multi-level Lazy-NTT transformation is performed on each row of data in the two-dimensional array:

[0243] If the current layer is not the last layer, then based on the index of each data in the current layer and in conjunction with the multiplication type determination table, the multiplication type used for each data is determined; based on each data, when the multiplication type used for the data is Montgomery modular multiplication, a rotation factor is selected from the Montgomery domain unit root table, and Montgomery modular multiplication is performed on the data and the rotation factor to obtain data converted to the point value domain; when the multiplication type used for the data is standard multiplication, a rotation factor is read from the integer domain unit root table, and the data and the rotation factor are directly multiplied to obtain data converted to the point value domain.

[0244] If the current layer is the last layer, then the multiplication type of the last layer is determined to be Montgomery modular multiplication. Montgomery modular multiplication is performed on each data in the last layer to obtain data converted to the point value domain.

[0245] For each data point transformed to the point value domain, a point value array is generated, which includes a plaintext point value array and a perturbation point value array.

[0246] In one specific implementation, the first conversion module is specifically used for:

[0247] Perform a Montgomery modular multiplication on the pre-generated NTRU public key, the perturbation point value array, and the plaintext point value array to obtain the ciphertext of the plaintext, which is then used as the ciphertext point value array.

[0248] The ciphertext satisfies the following formula:

[0249]

[0250] in, The ciphertext, The array of disturbance point values. For the NTRU public key, For the plaintext point value array, The modulus is i, and i and j represent the row and column coordinates of the array. This refers to the summation traversal index for the circular convolution operation. This indicates the total number of rows in the array.

[0251] In one specific implementation, a public key generation module is also included, used for:

[0252] Based on the security requirements of the plaintext to be processed, security parameters that meet the security requirements and are applicable to the Good's Trick and Lazy-NTT strategies are selected; the security parameters include multinomial dimension, modulus, and Montgomery cardinality.

[0253] Based on the security parameters, the key polynomial required to generate the NTRU public key and the inverse key polynomial of the key polynomial in the mode are generated; the key polynomial includes a public key polynomial and a private key polynomial.

[0254] Transform the key polynomial and the inverse key polynomial into the Montgomery field to obtain the Montgomery field key polynomial and the Montgomery field inverse key polynomial.

[0255] Based on the Montgomery domain key polynomial and the Montgomery domain inverse key polynomial, the key point value array and the inverse key point value array are obtained by using the Good's Trick strategy and the Lazy-NTT strategy of the NTRU algorithm.

[0256] Perform a column-to-column circular convolution on the key point value array and the inverse key point value array to obtain the NTRU public key.

[0257] In one specific implementation, the public key generation module is further configured to:

[0258] Based on the aforementioned security parameters, calculate the unit root table, the anti-unit root table, and the multiplication type judgment table for the Lazy-NTT strategy; the security parameters include polynomial dimension, modulus q, and Montgomery cardinality;

[0259] The unit root table includes a Montgomery field unit root table and an integer field unit root table; the inverse unit root table includes a Montgomery field inverse unit root table and an integer field inverse unit root table.

[0260] The encryption module is specifically used for:

[0261] Within the dot value domain, sequentially obtain two ciphertext dot value arrays of the ciphertext to be processed from multiple ciphertext dot value arrays, denoted as follows: and ;

[0262] If two ciphertext point value arrays are homomorphically added, the values ​​at corresponding positions in the two ciphertext point value arrays are added and the modulo is taken. The calculation formula is as follows:

[0263]

[0264] If two ciphertext point value arrays are homomorphically multiplied, then based on the convolutional properties of the Good's Trick strategy, a column-to-column circular convolution is performed on the two ciphertext point value arrays, and in the summation operation, Montgomery modular multiplication is performed for the multiplication operations between elements, with the calculation formula as follows:

[0265]

[0266] in, This is an array of homomorphic addition results. Let i and j be the array of homomorphic multiplication results, where i and j represent the row and column coordinates of the array. is the summation traversal index for the circular convolution operation, and c is the total number of rows in the array.

[0267] Example 4:

[0268] Based on the same inventive concept, this invention also provides a high-performance data multi-domain transformation lattice basis homomorphic decryption system, the structural schematic diagram of which is shown below. Figure 5 As shown, it includes:

[0269] The decryption module is used to decrypt the acquired ciphertext using a pre-generated NTRU private key to obtain an array of decryption point values.

[0270] The second conversion module is used to convert the decryption point value array into a time-domain decryption array using the inverse Lazy-NTT strategy of the NTRU algorithm; and to convert the time-domain decryption array into a Montgomery domain decryption array using the inverse Good's Trick strategy of the NTRU algorithm.

[0271] The restoration module is used to perform normal field restoration processing on the Montgomery field decryption array to obtain the plaintext of the ciphertext.

[0272] In one specific implementation, the decryption module is specifically used for:

[0273] The pre-generated NTRU private key and the obtained ciphertext are subjected to column-to-column circular convolution to obtain an array of decryption point values.

[0274] In one specific implementation, the second conversion module is specifically used for:

[0275] Using the inverse Lazy-NTT strategy of the NTRU algorithm, the following multi-layer inverse Lazy-NTT transformation is performed on each row of the decryption point value array:

[0276] If the current layer is not the last layer, then based on the index of each data in the current layer and in conjunction with the multiplication type determination table, the multiplication type used for each data is determined; based on each data, when the multiplication type used for the data is Montgomery modular multiplication, a twitch factor is selected from the Montgomery domain inverse root of unity table, and Montgomery modular multiplication is performed on the data and the twitch factor to obtain data converted to the time domain; when the multiplication type used for the data is standard multiplication, a twitch factor is read from the integer domain inverse root of unity table, and the data and the twitch factor are directly multiplied to obtain data converted to the time domain.

[0277] If the current layer is the last layer, then the multiplication type of the last layer is determined to be Montgomery modular multiplication. Montgomery modular multiplication is performed on each data in the last layer to obtain the data converted to the time domain.

[0278] A time-domain decryption array is generated based on each piece of data transformed to the time domain.

[0279] In one specific implementation, the second conversion module is specifically used for:

[0280] Using the inverse Good's Trick strategy of the NTRU algorithm, the time-domain decryption array is reverse-mapped to obtain the Montgomery domain decryption array;

[0281] The Montgomery field decryption array satisfies the following formula:

[0282]

[0283] Where s is the index data in the Montgomery field decryption array. This indicates that Dim is in the modulus. The reverse element below, It means In the modular inverse Dim, Row and Col represent the Row-th and Col-th columns of the time-domain decryption array, and Dim and k represent parameters related to the polynomial dimension.

[0284] Example 5:

[0285] like Figure 6 As shown, the present invention also provides an electronic device, which may be a computer device, a microcontroller device, a smart mobile device, etc. The electronic device in this embodiment may include a processor, a memory, a transceiver component, etc. The memory, processor, and transceiver component are connected via a bus; the memory can be used to store executable programs, and an exemplary executable program may include instructions; the processor is used to execute the instructions stored in the memory. The memory can also be used to store data, which can be accessed and / or modified when instructions are executed.

[0286] The processor may be a Central Processing Unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing and control core of the terminal, and it is suitable for implementing one or more instructions. Specifically, it is suitable for loading and executing one or more instructions in the storage medium to implement the corresponding method flow or corresponding function, so as to implement the steps of a high-performance data multi-domain transformation lattice basis homomorphic encryption method in the above embodiments, or to implement the steps of a high-performance data multi-domain transformation lattice basis homomorphic decryption method in the above embodiments.

[0287] Example 6:

[0288] Based on the same inventive concept, this invention also provides a readable storage medium, specifically an electronic device readable storage medium (Memory). This readable storage medium is a memory device within an electronic device used to store programs and data. It is understood that the storage medium here can include both built-in storage media within the electronic device and extended storage media supported by the electronic device. The storage medium provides storage space, which stores the terminal's operating system. Furthermore, this storage space also stores one or more instructions suitable for loading and execution by a processor. These instructions can be one or more executable programs (including program code). It should be noted that the storage medium here can be high-speed RAM or non-volatile memory, such as at least one disk storage device. Loading and executing one or more instructions stored in the storage medium by the processor can implement the steps of the high-performance data multi-domain transformation lattice-based homomorphic encryption method described in the above embodiments, or implement the steps of the high-performance data multi-domain transformation lattice-based homomorphic decryption method described in the above embodiments.

[0289] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0290] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0291] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0292] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0293] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit its scope of protection. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that after reading the present invention, they can still make various changes, modifications or equivalent substitutions to the specific implementation methods of the application, but these changes, modifications or equivalent substitutions are all within the scope of protection of the claims pending approval.

Claims

1. A high-performance data multi-domain transform lattice basis homomorphic encryption method, characterized in that, include: Obtain the initial polynomial of the plaintext to be processed. The initial polynomial includes the plaintext polynomial and the random perturbation polynomial of the plaintext to be processed. Transform the initial polynomial to the Montgomery field to obtain the Montgomery field polynomial; Using the Good's Trick strategy, the Montgomery field polynomial is mapped to a two-dimensional array; Using the Lazy-NTT strategy of the NTRU algorithm, the following multi-level Lazy-NTT transformation is performed on each row of data in the two-dimensional array: If the current layer is not the last layer, the multiplication type for each data point is determined based on the index of each data point in the current layer and the multiplication type determination table. For each data point, if the multiplication type is Montgomery modular multiplication, a rotation factor is selected from the Montgomery domain unit root table, and Montgomery modular multiplication is performed on the data and the rotation factor to obtain the data converted to the point value domain. If the multiplication type is standard multiplication, the rotation factor is read from the integer domain unit root table, and the data and the rotation factor are multiplied directly to obtain the data converted to the point value domain. If the current layer is the last layer, then the multiplication type of the last layer is determined to be Montgomery modular multiplication. Montgomery modular multiplication is performed on each data in the last layer to obtain the data transformed to the point value range. Based on each data point transformed to the point value domain, a point value array is generated, which includes a plaintext point value array and a perturbation point value array. The ciphertext array is obtained by using a pre-generated NTRU public key combined with a perturbation array of point values ​​to perform operations on the plaintext array of point values. If there are multiple plaintexts to be processed and there is a need for ciphertext operations, repeat the above steps for multiple plaintexts to be processed to obtain an array of ciphertext point values ​​for each plaintext to be processed. Homomorphic addition and / or homomorphic multiplication operations are performed directly on multiple ciphertext point value arrays within the point value domain to obtain the homomorphic operation result point value array.

2. The high-performance data multi-domain transformation lattice basis homomorphic encryption method as described in claim 1, characterized in that, The step of transforming the initial polynomial to the Montgomery field to obtain the Montgomery field polynomial includes: The coefficients of the initial polynomial are multiplied by the preset Montgomery base and modulo q of the NTRU algorithm to obtain the Montgomery field polynomial.

3. The high-performance data multi-domain transformation lattice basis homomorphic encryption method as described in claim 1, characterized in that, The step of using a pre-generated NTRU public key in conjunction with the perturbation point value array to perform operations on the plaintext point value array to obtain the ciphertext point value array includes: Perform a Montgomery modular multiplication on the pre-generated NTRU public key, the perturbation point value array, and the plaintext point value array to obtain the ciphertext of the plaintext, which is then used as the ciphertext point value array. The ciphertext satisfies the following formula: in, The ciphertext, For the array of disturbance point values, For the NTRU public key, For the plaintext point value array, Let i and j be the modulus, and i and j represent the row and column coordinates of the array. This refers to the summation traversal index for the circular convolution operation. This indicates the total number of rows in the array.

4. The high-performance data multi-domain transformation lattice basis homomorphic encryption method as described in claim 1 or 3, characterized in that, The pre-generation process of the NTRU public key includes: Based on the security requirements of the plaintext to be processed, security parameters that meet the security requirements and are applicable to the Good's Trick and Lazy-NTT strategies are selected; the security parameters include multinomial dimension, modulus, and Montgomery cardinality. Based on the security parameters, the key polynomial required to generate the NTRU public key and the inverse key polynomial of the key polynomial in the mode are generated; the key polynomial includes a public key polynomial and a private key polynomial. Transform the key polynomial and the inverse key polynomial into the Montgomery field to obtain the Montgomery field key polynomial and the Montgomery field inverse key polynomial. Based on the Montgomery domain key polynomial and the Montgomery domain inverse key polynomial, the key point value array and the inverse key point value array are obtained by using the Good's Trick strategy and the Lazy-NTT strategy of the NTRU algorithm. Perform a column-to-column circular convolution on the key point value array and the inverse key point value array to obtain the NTRU public key.

5. The high-performance data multi-domain transformation lattice basis homomorphic encryption method as described in claim 4, characterized in that, After selecting security parameters that meet the security requirements of the plaintext to be processed and are applicable to the Good's Trick and Lazy-NTT strategies, the following is also included: Based on the security parameters, calculate the unit root table, the anti-unit root table, and the multiplication type judgment table for the Lazy-NTT strategy; the security parameters include polynomial dimension, modulus q, and Montgomery cardinality; The unit root table includes a Montgomery field unit root table and an integer field unit root table; the inverse unit root table includes a Montgomery field inverse unit root table and an integer field inverse unit root table.

6. The high-performance data multi-domain transformation lattice basis homomorphic encryption method as described in claim 1, characterized in that, The method of directly performing homomorphic addition and / or homomorphic multiplication operations on multiple ciphertext point value arrays within the point value domain to obtain a homomorphic operation result point value array includes: Within the dot value domain, sequentially obtain two ciphertext dot value arrays of the ciphertext to be processed from multiple ciphertext dot value arrays, denoted as follows: and ; If two ciphertext point value arrays are homomorphically added, the values ​​at corresponding positions in the two ciphertext point value arrays are added and the modulo is taken. The calculation formula is as follows: If two ciphertext point value arrays are homomorphically multiplied, then based on the convolutional properties of the Good's Trick strategy, a column-to-column circular convolution is performed on the two ciphertext point value arrays, calculated as follows: in, This is an array of homomorphic addition results. Let i and j be the array of homomorphic multiplication results, where i and j represent the row and column coordinates of the array. Here, c represents the summation traversal index for the circular convolution operation, and c is the total number of rows in the array. The modulus is used; and in the summation operation of homomorphic multiplication, Montgomery modular multiplication is performed for the multiplication operation between the elements of the ciphertext point value array.

7. A high-performance data multi-domain transform lattice basis homomorphic encryption system, characterized in that, include: The acquisition module is used to acquire the initial polynomial of the plaintext to be processed. The initial polynomial includes the plaintext polynomial and the random perturbation polynomial of the plaintext to be processed. The first transformation module transforms the initial polynomial to the Montgomery domain, obtaining a Montgomery domain polynomial. Using the Good's Trick strategy of the NTRU algorithm, the Montgomery domain polynomial is mapped to obtain a two-dimensional array. Then, using the Lazy-NTT strategy of the NTRU algorithm, the following multi-level Lazy-NTT transformation is performed on each row of the two-dimensional array: If the current layer is not the last layer, then based on the index of each data point in the current layer and the multiplication type determination table, the multiplication type used for each data point is determined. For each data point, if the multiplication type is Montgomery modular multiplication, a twitch factor is selected from the Montgomery domain unit root table, and Montgomery modular multiplication is performed on the data and the twitch factor to obtain data transformed to the point value domain. If the multiplication type is standard multiplication, a twitch factor is read from the integer domain unit root table, and the data and the twitch factor are directly multiplied to obtain data transformed to the point value domain. If the current layer is the last layer, then the multiplication type of the last layer is determined to be Montgomery modular multiplication, and Montgomery modular multiplication is performed on each data point in the last layer to obtain data transformed to the point value domain. Based on each data point transformed to the point value domain, a point value array is generated, which includes a plaintext point value array and a perturbation point value array. The encryption module is used to use a pre-generated NTRU public key combined with a perturbation point value array to perform operations on the plaintext point value array to obtain a ciphertext point value array; If there are multiple plaintexts to be processed and there is a need for ciphertext operations, then generate corresponding ciphertext point value arrays for each plaintext to be processed, thus obtaining the ciphertext point value array for each plaintext to be processed. Homomorphic addition and / or homomorphic multiplication operations are performed directly on multiple ciphertext point value arrays within the point value domain to obtain the homomorphic operation result point value array.

8. The system as described in claim 7, characterized in that, The first conversion module is specifically used for: The coefficients of the initial polynomial are multiplied by the preset Montgomery base and modulo q of the NTRU algorithm to obtain the Montgomery field polynomial.

9. The system as described in claim 7, characterized in that, The first conversion module is specifically used for: Perform a Montgomery modular multiplication on the pre-generated NTRU public key, the perturbation point value array, and the plaintext point value array to obtain the ciphertext of the plaintext, which is then used as the ciphertext point value array. The ciphertext satisfies the following formula: in, The ciphertext, The array of disturbance point values. For the NTRU public key, For the plaintext point value array, The modulus is i, and i and j represent the row and column coordinates of the array. This refers to the summation traversal index for the circular convolution operation. This indicates the total number of rows in the array.

10. The system as described in claim 7 or 9, characterized in that, It also includes a public key generation module, used for: Based on the security requirements of the plaintext to be processed, security parameters that meet the security requirements and are applicable to the Good's Trick and Lazy-NTT strategies are selected; the security parameters include multinomial dimension, modulus, and Montgomery cardinality. Based on the security parameters, the key polynomial required to generate the NTRU public key and the inverse key polynomial of the key polynomial in the mode are generated; the key polynomial includes a public key polynomial and a private key polynomial. Transform the key polynomial and the inverse key polynomial into the Montgomery field to obtain the Montgomery field key polynomial and the Montgomery field inverse key polynomial. Based on the Montgomery domain key polynomial and the Montgomery domain inverse key polynomial, the key point value array and the inverse key point value array are obtained by using the Good's Trick strategy and the Lazy-NTT strategy of the NTRU algorithm. Perform a column-to-column circular convolution on the key point value array and the inverse key point value array to obtain the NTRU public key.

11. The system as claimed in claim 10, characterized in that, The public key generation module is also used for: Based on the security parameters, calculate the unit root table, the anti-unit root table, and the multiplication type judgment table for the Lazy-NTT strategy; the security parameters include polynomial dimension, modulus q, and Montgomery cardinality; The unit root table includes a Montgomery field unit root table and an integer field unit root table; the inverse unit root table includes a Montgomery field inverse unit root table and an integer field inverse unit root table.

12. The system as described in claim 7, characterized in that, The encryption module is specifically used for: Within the dot value domain, sequentially obtain two ciphertext dot value arrays of the ciphertext to be processed from multiple ciphertext dot value arrays, denoted as follows: and ; If two ciphertext point value arrays are homomorphically added, the values ​​at corresponding positions in the two ciphertext point value arrays are added and the modulo is taken. The calculation formula is as follows: If two ciphertext point value arrays are homomorphically multiplied, then based on the convolutional properties of the Good's Trick strategy, a column-to-column circular convolution is performed on the two ciphertext point value arrays, calculated as follows: in, This is an array of homomorphic addition results. Let i and j be the array of homomorphic multiplication results, where i and j represent the row and column coordinates of the array. Here, c represents the summation traversal index for the circular convolution operation, and c is the total number of rows in the array. The modulus is used; and in the summation operation of homomorphic multiplication, Montgomery modular multiplication is performed for the multiplication operation between the elements of the ciphertext point value array.

13. A high-performance data multi-domain transformation lattice basis homomorphic decryption method, characterized in that, include: Using the pre-generated NTRU private key, the obtained ciphertext is decrypted to obtain an array of decryption point values; Using the inverse Lazy-NTT strategy of the NTRU algorithm, the following multi-layer inverse Lazy-NTT transformation is performed on each row of data in the decryption point value array: If the current layer is not the last layer, the multiplication type for each data point is determined based on the index of each data point in the current layer and the multiplication type determination table. For each data point, if the multiplication type is Montgomery modular multiplication, a twitch factor is selected from the Montgomery domain inverse root of unity table, and Montgomery modular multiplication is performed on the data and the twitch factor to obtain the data converted to the time domain. If the multiplication type is standard multiplication, a twitch factor is read from the integer domain inverse root of unity table, and the data and the twitch factor are multiplied directly to obtain the data converted to the time domain. If the current layer is the last layer, then the multiplication type of the last layer is determined to be Montgomery modular multiplication. Montgomery modular multiplication is performed on each data in the last layer to obtain the data converted to the time domain. Generate a time-domain decryption array based on each piece of data converted to the time domain; Using the inverse Good's Trick strategy of the NTRU algorithm, the time-domain decryption array is converted into a Montgomery-domain decryption array; The plaintext of the ciphertext is obtained by restoring the normal field of the Montgomery field decryption array.

14. The high-performance data multi-domain transformation lattice basis homomorphic decryption method as described in claim 13, characterized in that, The pre-generated NTRU private key is used to decrypt the acquired ciphertext, resulting in a decryption point value array, including: The pre-generated NTRU private key and the obtained ciphertext are subjected to column-to-column circular convolution to obtain an array of decryption point values.

15. The high-performance data multi-domain transformation lattice basis homomorphic decryption method as described in claim 13, characterized in that, The method of using the inverse Good's Trick strategy of the NTRU algorithm to convert the time-domain decryption array into a Montgomery domain decryption array includes: Using the inverse Good's Trick strategy of the NTRU algorithm, the time-domain decryption array is reverse-mapped to obtain the Montgomery domain decryption array; The Montgomery field decryption array satisfies the following formula: Where s is the index data in the Montgomery field decryption array. This indicates that Dim is in the modulus. The reverse element below, It means In the modular inverse Dim, Row and Col represent the Row-th and Col-th columns of the time-domain decryption array, and Dim and k represent parameters related to the polynomial dimension.

16. A high-performance data multi-domain transform lattice basis homomorphic decryption system, characterized in that, include: The decryption module is used to decrypt the acquired ciphertext using a pre-generated NTRU private key to obtain an array of decryption point values. The second conversion module is used to convert the decryption point value array into a time-domain decryption array using the inverse Lazy-NTT strategy of the NTRU algorithm. Using the inverse Lazy-NTT strategy of the NTRU algorithm, the following multi-level inverse Lazy-NTT transformation is performed on each row of data in the decryption point value array: if the current layer is not the last layer, the multiplication type used for each data is determined based on the index of each data in the current layer, combined with the multiplication type judgment table; based on each data, when the multiplication type used by the data is Montgomery modular multiplication, a rotation is selected from the Montgomery domain inverse unit root table. The data is converted to a time domain by performing a Montgomery modular multiplication on the data and the twitch factor. When the data uses standard multiplication, the twitch factor is read from the inverse unit root table of the integer field, and the data and the twitch factor are multiplied directly to obtain the data converted to the time domain. If the current layer is the last layer, the multiplication type of the last layer is determined to be Montgomery modular multiplication, and Montgomery modular multiplication is performed on each data in the last layer to obtain the data converted to the time domain. Based on each data converted to the time domain, a time-domain decryption array is generated. Using the inverse Good's Trick strategy of the NTRU algorithm, the time-domain decryption array is reverse-mapped to obtain a Montgomery domain decryption array. The restoration module is used to restore the Montgomery field decryption array to its normal fields to obtain the plaintext of the ciphertext.

17. The system as claimed in claim 16, characterized in that, The decryption module is specifically used for: The pre-generated NTRU private key and the obtained ciphertext are subjected to column-to-column circular convolution to obtain an array of decryption point values.

18. The system as claimed in claim 17, characterized in that, The Montgomery field decryption array satisfies the following formula: Where s is the index data in the Montgomery field decryption array. This indicates that Dim is in the modulus. The reverse element below, It means In the modular inverse Dim, Row and Col represent the Row-th and Col-th columns of the time-domain decryption array, and Dim and k represent parameters related to the polynomial dimension.

19. An electronic device, characterized in that, include: At least one processor and memory; The memory and processor are connected via a bus; The memory is used to store one or more programs; When the one or more programs are executed by the at least one processor, the high-performance data multi-domain transform lattice-based homomorphic encryption method as described in any one of claims 1 to 6, or the high-performance data multi-domain transform lattice-based homomorphic decryption method as described in any one of claims 13 to 15, is implemented.

20. A readable storage medium, characterized in that, It contains an executable program, which, when executed, implements the high-performance data multi-domain transformation lattice basis homomorphic encryption method as described in any one of claims 1 to 6, or the high-performance data multi-domain transformation lattice basis homomorphic decryption method as described in any one of claims 13 to 15.

Images