Privacy protection homomorphic permutation method and system based on permutation factorization

Abstract

The invention provides a privacy protection homomorphic permutation method and system based on permutation factorization, and belongs to the field of computer security and cryptography. The method comprises the steps of obtaining permutation matrix representation of target permutation, and defining an ideal permutation decomposition form; searching all factor pairs meeting a depth 1 ideal decomposition form for the permutation matrix by adopting a depth 1 ideal decomposition search algorithm; traversing all factor serial numbers, and replacing the permutation matrix with a left factor in a factor pair corresponding to a serial number when iteration is performed to the factor serial number; next round of depth ideal decomposition search is carried out through iteration, and a maximum depth decomposition scheme is determined; and when the maximum decomposition depth is reached, the scheme corresponds to a permutation matrix chain: iteratively acting a permutation matrix in the permutation matrix chain obtained by decomposition on a secret state data vector to realize homomorphic permutation. According to the method, the homomorphic rotation operation frequency is reduced, the calculation load of homomorphic linear transformation is reduced, and the execution efficiency of the privacy protection calculation task is improved.

Description

Technical Field

[0001] This invention belongs to the field of computer security and cryptography, and in particular relates to a privacy-preserving homomorphic permutation method and system based on permutation factor decomposition. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] With the rapid development of cloud computing and big data technologies, data privacy protection has become increasingly prominent. Homomorphic encryption, as a cryptographic technique that enables direct computation in ciphertext, provides an important solution for privacy-preserving computation. In particular, batch homomorphic encryption schemes supporting SIMD (Single Instruction Multiple Data) operations can encode multiple messages as vectors or matrices into single plaintext elements and encrypt them into a single ciphertext to achieve encrypted parallel computation of batch data. However, when the computer wants to process the values ​​at specific positions in the encrypted batch data, it cannot achieve this through index addressing as it would with plaintext messages. Instead, it must perform basic homomorphic operations supported by homomorphic encryption, such as homomorphic addition, multiplication, and vector rotation, on the entire ciphertext.

[0004] The operation of adjusting the position of values ​​in a batch of encrypted data using homomorphic addition, multiplication, and rotation is called homomorphic batch-coded ciphertext data permutation (or simply homomorphic permutation). The implementation of homomorphic permutation typically involves two core operations: ciphertext rotation and plaintext-ciphertext multiplication. The former performs cyclic shifts on the underlying plaintext data vector, while the latter selects the elements in the vector to be permuted. Ciphertext rotation requires performing number-theoretic transformations (NTTs) on a polynomial ring, making it one of the most computationally complex operations in batch-coded homomorphic encryption systems. Furthermore, different rotation step sizes require different rotation keys, which must be pre-generated by the private key holder, and the storage size of a single key can reach several ciphertext orders of magnitude. The existence of a large number of rotation keys leads to significant communication and storage overhead. These characteristics make optimizing the efficiency of homomorphic permutation a key challenge in building upper-level homomorphic operation modules.

[0005] Currently, optimization approaches for homomorphic permutations mainly fall into two categories. One category is based on computational process optimization techniques, such as hoisting and its improved form Double-Hoisting, which reduce redundant computation by sharing intermediate results. The other category is based on permutation decomposition techniques, such as the general decomposition framework based on Benes networks. However, these methods still have significant shortcomings when applied to real-world privacy computing scenarios: while the former improves computational efficiency, it fails to effectively solve the key management problem; while the latter reduces the number of keys, it has poor adaptability to specific permutation patterns and is difficult to meet the needs of complex application scenarios. Summary of the Invention

[0006] To overcome the shortcomings of the prior art, this invention provides a privacy-preserving homomorphic permutation method and system based on permutation factorization. It employs an ideal permutation factorization search method to search for a permutation decomposition form with a defined depth of 1 for any permutation matrix. By recursively using this search algorithm in a depth-first search manner, the maximum depth ideal decomposition method for any permutation is found. The found decomposition improves the efficiency of homomorphic permutations and reduces the overhead of rotation keys by limiting the number and distribution of non-zero diagonals in the permutation matrix factorization factors.

[0007] To achieve the above objectives, one or more embodiments of the present invention provide the following technical solutions: The first aspect of this invention provides a privacy-preserving homomorphic permutation method based on permutation factor decomposition; A privacy-preserving homomorphic permutation method based on permutation factorization includes: Obtain the permutation matrix representation of the target permutation, denoted as And define the ideal permutation decomposition form of the target permutation; The permutation matrix of the target permutation The depth-1 ideal decomposition search algorithm is used to find all factor pairs that satisfy the depth-1 ideal decomposition form. ,in, Is with Same dimension, satisfying The permutation matrix of the ideal decomposition form of depth 1 has , The left factor in the factor pair. It is a right factor; Iterate through all factor indices, and for each factor indice reached in the iteration, then... Replace with the left factor in the factor pair corresponding to that index. The next round of depth-ideal decomposition search is performed iteratively, using a depth-first search strategy to determine the optimal decomposition. Maximum depth decomposition scheme; when The maximum decomposition depth is At that time, the corresponding scheme is a clause containing A chain of permutation matrices for each factor: The factors satisfy the equation ; The permutation matrices in the permutation matrix chain obtained from the decomposition are iteratively applied to the dense-state data vector to achieve homomorphic permutation.

[0008] As a further technical solution, the definition of the permutation matrix The ideal permutation decomposition forms include: Obtain the permutation matrix Distribution information of all non-zero diagonals in the data, including tolerances. and distribution interval ; Get Decomposition Function The decomposition function is valid when the following conditions are met. Permutation matrix A depth is The ideal decomposition, The matrices are decomposition permutation matrices. The resulting permutation matrix chain; when Permutation matrix A depth is In the ideal decomposition, the decomposition function Permutation matrix A full-depth ideal decomposition; wherein the decomposition function satisfies the following conditions: (1) ; (2) For any , Only the index belongs The non-zero diagonal of the set; where the index ; (3) The index of the non-zero diagonal only belongs to the interval ,in .

[0009] As a further technical solution, the target permutation matrix The depth-1 ideal decomposition search algorithm is used to find all permutation matrix factor pairs that satisfy the depth-1 ideal decomposition form, including: Determine the index based on the non-zero diagonal distribution of the permutation matrix. ,in In the definition of ideal decomposition ; Initialization matrix For the target permutation matrix Same size, full value Array; For the permutation matrix For each non-zero element in the array, keep the column index unchanged and decompose it into... The diagonal, the diagonal and the Diagonal, to obtain the matrix Several lines of conflict; Call the sub-function CheckRow to transform the matrix All lines conflict on the first Move the diagonal element to the first diagonal or the Diagonal, until there are no row conflicts; If the subfunction CheckRow does not terminate due to an unresolved row conflict, then for the current To perform record storage, specifically, to create A copy, and recorded as ,in express It is the first Second pair Created during the recording process; After the recording is completed, the sub-function continues to search for the set of permutation matrices obtained with the current record according to the above strategy. They are all different, and there is no line conflict. form; For the set of permutation matrices obtained from the records Generate the corresponding Make This is true, resulting in a set of decomposition factors consisting of several pairs of decomposition factors. .

[0010] As a further technical solution, for the permutation matrix For each non-zero element in the array, keep its column index unchanged and decompose it into... The diagonal, the diagonal and the Diagonal, including: Create key-value table ,in Used to represent The Middle One non-zero diagonal line; key-value pairs Join Add to Each key-value pair in They all represent a... Decomposed into Non-zero elements, whose keys Indicates that the element is in row index, value Indicates that the element is in The original diagonal index in; make Traversal Let the indices of all non-zero diagonals be denoted by . Traversal The Middle Row indexes with non-zero values ​​on the diagonal, for The Middle The first on the diagonal The elements of a row are denoted as Perform the following operations: (1) If and If empty, then the key-value pair Add to ; (2) If and If empty, then the key-value pair Add to ; (3) If Then Add to ; Otherwise, if there is an unresolvable conflict, the search will terminate.

[0011] As a further technical solution, the sub-function CheckRow is called to transform the matrix. All lines conflict on the first Move the diagonal element to the first diagonal or the Diagonal, until there are no line conflicts, including: Create to save the first The set of indices of rows with conflicting information on the diagonal ; for Each key-value pair in If in or There is another key-value pair. This indicates that in The There is a conflict in the lines, Add to collection ; Wait for all conflicting row indexes to be added Then, using Functions solve matrices The diagonal and the If there are row conflicts between diagonals, output all rows that satisfy the condition that there are no row conflicts. , recorded as ; When there is no condition that satisfies this condition When the time is right, output an empty set.

[0012] As a further technical solution, all factor indices are traversed, and each iteration to a factor indices is denoted as... , then Replace with the left factor in the factor pair corresponding to that index. The next round of depth-ideal decomposition search is performed iteratively, using a depth-first search strategy to determine the optimal decomposition. Maximum depth decomposition schemes; including: Create a collection A copy, denoted as ,in In Used to indicate the depth of decomposition; For each Perform a depth-1 ideal decomposition search to obtain the set of decomposition factor pairs. The set of factor pairs is used as a permutation. All depth-2 ideal decomposition forms; where, for ,have When the maximum decomposition depth is When the above recursive application of the depth-1 ideal decomposition search algorithm returns the following result:

[0013] Create a copy of the result, denoted as , thus obtaining the permutation matrix Maximum decomposition depth The permutation matrix chain.

[0014] As a further technical solution, the permutation matrix in the decomposed permutation matrix chain is iteratively applied to the dense-state data vector to achieve homomorphic permutation, including: For the target dense-state data vector to be replaced Using the permutation matrix chain obtained by decomposition calculate Specifically: Initialize an empty ciphertext and use it iteratively. The function will Acting sequentially on the previous one The output results, where The first received parameter is and The output ciphertext can be obtained after decryption. Record the ciphertext as Receive in each subsequent round sequentially And the previous round The output is used as input; When the last permutation matrix in the matrix chain When the number of non-zero diagonal vectors in the matrix is ​​inconsistent with the previous permutation matrix, the LinTrans function, accelerated by the BSGS algorithm, is used to calculate the last homomorphic permutation and obtain the result of the homomorphic permutation.

[0015] A second aspect of the present invention provides a privacy-preserving homomorphic permutation system based on permutation factor decomposition.

[0016] A privacy-preserving homomorphic permutation system based on permutation factorization includes: The initialization module is configured to: obtain the permutation matrix representation of the target permutation, denoted as... And define the ideal permutation decomposition form of the target permutation; The decomposition parameter calculation module is configured to: calculate the permutation matrix of the target permutation. The depth-1 ideal decomposition search algorithm is used to find all factor pairs that satisfy the depth-1 ideal decomposition form. ,in, Is with Same dimension, satisfying The permutation matrix of the ideal decomposition form of depth 1 has , The left factor in the factor pair. It is a right factor; The maximum depth decomposition module is configured to: traverse all factor indices, and upon each iteration to a factor indices, [process / decompose ... Replace with the left factor in the factor pair corresponding to that index. The next round of depth-ideal decomposition search is performed iteratively, using a depth-first search strategy to determine the optimal decomposition. Maximum depth decomposition scheme; when The maximum decomposition depth is At that time, the corresponding scheme is a clause containing A chain of permutation matrices for each factor: The factors satisfy the equation ; The homomorphic permutation module is configured to iteratively apply the permutation matrix in the decomposed permutation matrix chain to the dense data vector to achieve homomorphic permutation.

[0017] A third aspect of the present invention provides a computer-readable storage medium having a program stored thereon that, when executed by a processor, implements the steps of a privacy-preserving homomorphic permutation method based on permutation factor decomposition as described in the first aspect of the present invention.

[0018] A fourth aspect of the present invention provides an electronic device, including a memory, a processor, and a program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of a privacy-preserving homomorphic permutation method based on permutation factor decomposition as described in the first aspect of the present invention.

[0019] The above one or more technical solutions have the following beneficial effects: (1) This invention decomposes a complex permutation matrix into a series of simple permutation matrices containing only a small number of non-zero diagonals by defining an ideal permutation decomposition form and designing a depth-first search algorithm. This decomposition method reduces the computational complexity of homomorphic permutations from linearly dependent on the permutation size to logarithmically dependent, significantly reducing the number of homomorphic rotation operations required. Simultaneously, by restricting the distribution of non-zero diagonals in the decomposed permutation matrix, the computational load of homomorphic linear transformations is effectively reduced, thereby significantly improving the execution efficiency of privacy-preserving computational tasks.

[0020] (2) This invention optimizes the permutation decomposition form so that the permutation matrix in each decomposition stage only needs to retain specific non-zero diagonals, thereby reducing the number of homomorphic rotation keys required to the logarithmic level. This not only significantly reduces the key storage requirements but also reduces the communication overhead in the key negotiation stage. In addition, the decomposed permutation matrix can be pre-computed and reused, further reducing the number of key interactions in the actual computation process and providing a more efficient key management scheme for privacy-preserving computation.

[0021] Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0022] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0023] Figure 1 This is a flowchart of the method in the first embodiment.

[0024] Figure 2 The original permutation matrix in the first embodiment is shown, with non-zero values ​​highlighted in dark blue.

[0025] Figure 3 After the decomposition elements in the first embodiment The view, whose non-zero values ​​are marked in red.

[0026] Figure 4 After resolving the conflict in the first embodiment The final view shows non-zero values ​​marked in red and values ​​that were moved due to conflicts marked in gray.

[0027] Figure 5 Use in the first embodiment Reconstruction A schematic diagram.

[0028] Figure 6 This is a system structure diagram of the second embodiment. Detailed Implementation

[0029] It should be noted that the following detailed descriptions are exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0030] It should be noted that the terminology used herein is for the purpose of describing particular implementations only and is not intended to limit the exemplary implementations of the present invention.

[0031] Where there is no conflict, the embodiments and features in the embodiments of the present invention can be combined with each other.

[0032] Example 1 This embodiment discloses a privacy-preserving homomorphic permutation method based on permutation factor decomposition; like Figure 1 As shown, a privacy-preserving homomorphic permutation method based on permutation factor decomposition includes: Step S1, obtain the permutation matrix representation of the target permutation, denoted as And define the ideal permutation decomposition form of the target permutation; Step S2, the permutation matrix of the target permutation. The depth-1 ideal decomposition search algorithm is used to find all factor pairs that satisfy the depth-1 ideal decomposition form. Among them, factor pairs Is with Same dimension, satisfying The permutation matrix of the ideal decomposition form of depth 1 has , The left factor in the factor pair. It is a right factor; Step S3: Iterate through all factor indices. For each factor indice reached in iteration, [the following steps are taken]. Replace with the left factor in the factor pair corresponding to that index. The next round of depth-ideal decomposition search is performed iteratively, using a depth-first search strategy to determine the optimal decomposition. Maximum depth decomposition scheme; when The maximum decomposition depth is At that time, the corresponding scheme is a clause containing A chain of permutation matrices for each factor: The factors satisfy the equation ; Step S4: Iteratively apply the permutation matrix in the decomposed permutation matrix chain to the dense data vector to achieve homomorphic permutation.

[0033] Specifically, it also includes the following: In step S1, the target permutation is obtained. permutation matrix form and define The ideal permutation decomposition form. Specifically: permutation matrix. The method to obtain it is: Initialized to contain only Value Matrix, where for The dimension of the received vector. If The first of any input vector The n components (or elements) are mapped (or rearranged) to the nth element of the vector. Each position will from Set as .

[0034] Next, obtain Distribution information of all non-zero diagonals, including tolerances. and distribution interval Here, non-zero diagonals represent the diagonals in the matrix that contain non-zero values. For any The index in the matrix is The diagonal of the matrix contains sets. A vector of elements. It is obtained by calculating the minimum value of the index difference (absolute value) of each pair of adjacent non-zero diagonals. Then take Non-zero diagonal index in the centralized module The maximum absolute value in the interval, where for The dimension, centralized model An interval refers to any integer modulo 1. And make it fall into Interval.

[0035] At this point, if a certain decomposition function exists Receive a permutation matrix and an integer As input, and output This makes the following conditions true: (1) ; (2) For any , Only the index belongs The non-zero diagonal of the set; where, ; (3) The index of the non-zero diagonal only belongs to the interval ,in , then call for A depth is The ideal decomposition of . If for A depth is The ideal decomposition of is called yes A full-depth ideal decomposition.

[0036] Step S2, the permutation matrix of the target permutation. The depth-1 ideal decomposition search algorithm is used to find all factor pairs that satisfy the depth-1 ideal decomposition form. Among them, factor pairs Is with Same dimension, satisfying The permutation matrix of the ideal decomposition form of depth 1 has , The left factor in the factor pair. It is a right factor.

[0037] Step S21, the preparatory step of the search algorithm. Specifically, the permutation matrix... The elements in the array are stored in diagonal index-first order, i.e. Representation matrix The middle is located in the first diagonal and located at the th The elements of the row. This matrix can be stored in the form of a key-value table, storing only non-zero elements to save space. For the interval obtained in the previous step and tolerances Calculate the index .

[0038] Step S22, for For each non-zero element in the matrix, decompose it into... The diagonal, the diagonal or the diagonal, at this time Several line conflicts will occur.

[0039] Specifically, let It is a with Matrices of the same size have their values ​​initialized to 0 in each row and column. In subsequent steps, a key-value table is used to uniquely define... Create three key-value tables , where, for any index Key-value table correspond The Middle A non-zero diagonal line, Each key-value pair in Both represent a factorized non-zero element whose bond Indicates that the element is in row index, value Indicates that the element is in The original diagonal index in the table. The three key-value tables contained therein uniquely identify a ,Right now Only in its first There is a non-zero value on the diagonal, and the values ​​at other positions are all zero. .make Traversal Let the indices of all non-zero diagonals be denoted by . Traversal The Middle Row indexes with non-zero values ​​on the diagonal, for The Middle The first on the diagonal The elements of a row are denoted as ,for Each non-zero element in Perform the following operations: (1) If and If empty, then the key-value pair Add to ; (2) If and If empty, then the key-value pair Add to ; (3) If Then Add to ; Otherwise, if there is an unresolvable conflict, the search will terminate.

[0040] Step S23: Call the CheckRow function to attempt a solution. For all line conflicts, recursively move the conflicting line to the next line. Move the diagonal element to the first diagonal or the Diagonal, until there are no row conflicts.

[0041] First, create a collection. and initialize it to empty. Used to store all non-conflicting items found in subsequent CheckRow operations. At the same time, create a collection. Used to store No. The row index of non-zero values ​​on the diagonal, where each non-zero value on the 0th diagonal may be related to the row index of the 1st diagonal. and There is a conflict in the corresponding rows on the diagonal. For Each key-value pair in ,Will Add to collection .

[0042] Wait for all conflicting row indexes to be added Then, calculate .like After returning, If the set contains at least one element, the conflict is successfully resolved; otherwise, the conflict remains unresolved, and the search terminates. The function attempts to solve the matrix. The diagonal and the The goal is to identify all row conflicts between the diagonals and find all solutions to resolve them. The function's input includes: a set of non-zero diagonals. Matrix Dimension Diagonal index Row index to be checked The set of non-zero row indices on the 0th diagonal , The number of rows where conflicts have been resolved (i.e., no conflicts). and for loading Found set Among them, variables It is a global variable, meaning it will be used in subsequent... When a function calls itself recursively, these variables are identical and unique across all called function instances, and any changes made to these variables by any function instance will be reflected in all other function instances.

[0043] Specifically, Functions solve matrices The diagonal and the Find row conflicts between diagonals and identify all rows that do not have row conflicts. The process includes: First, check if there are any conflicts in the current line. If Empty indicates the first If there are no row conflicts, then if the index set There are still unprocessed lines ( ):Will Increase (Update the number of resolved lines), Set as (traversal) (The index of the next row in the table). If there are no unprocessed rows, it indicates... All conflicts in all rows have been resolved. At this point, based on the known information above... The only decision ,Right now for A key-value table representation, therefore based on the current The state is generated directly The permutation matrix form and add it to Then the function returns. If If not empty, then for the first... To handle potential conflicts, at this time, let , obtain the first The values ​​of the elements on the diagonal; Set to empty, calculate towards the first Target row index during diagonal movement .

[0044] Then try to... Move elements diagonally: if and If empty, the surface element allows the first... Move diagonally, and target row The There are no elements on the diagonal. At this point, move the element to the [position not specified]. diagonal Okay, soon Set as Recursive call Processing new bank .

[0045] If the problem persists, try referring to the [relevant authority / organization]. Move the element diagonally. If This indicates that the element allows access to the first... Move diagonally. At this point... Set to empty, recalculate That is, to the first The target row index when moving diagonally. If If empty, then Set as Moving the element to the next position diagonal Okay. Recursive call. Processing new bank .

[0046] Finally, the function backtracks, and and Setting it to empty clears all possible moves caused by CheckRow's recursive calls to itself; Restore to The element will be put back into the first position. The original position of the diagonal.

[0047] Step S24, if the previous calculation If it is still an empty set, then it means The algorithm terminates if an ideal decomposition with depth 1 does not exist. Not an empty set, denoted as For , The CheckRow function was added to The One that does not contain any conflict Instances. At this point, calculate each... The other corresponding factor ,get . in express The reversal makes This is valid, and ultimately several pairs of decomposition factors are obtained. .

[0048] Step S3: Iterate through all factor indices. For each factor indice reached in iteration, [the following steps are taken]. Replace with the left factor in the factor pair corresponding to that index. The next round of depth-ideal decomposition search is performed iteratively, using a depth-first search strategy to determine the optimal decomposition. Maximum depth decomposition scheme; when The maximum decomposition depth is At that time, the corresponding scheme is a clause containing A chain of permutation matrices for each factor: The factors satisfy the equation .

[0049] Specifically, create A copy, denoted as ,in , Numbers in Used to identify depth. For each ,because yes The permutation matrix obtained after depth 1 ideal decomposition, therefore for Performing a depth-1 ideal decomposition search is equivalent to... The search is performed using the ideal 2-dimensional decomposition form of the depth, therefore, in order to perform this operation, let ,right Perform a depth-1 ideal decomposition search to obtain several pairs of decomposition factor pairs, denoted as... Therefore, for all Using a depth-1 ideal decomposition search will yield the set of factor pairs: This constitutes All depth-2 ideal decomposition forms, i.e., for ,have This method is used for all elements in the set. Using the Depth-1 Ideal Decomposition Search algorithm, we can further obtain... The ideal form of depth 3 decomposition, repeated and iterated, will yield The ideal decomposition form with the maximum depth, if the maximum decomposition depth is The factor set can then be obtained from the results of the recursive use of the depth-1 ideal decomposition search algorithm described above. This makes the equation Establishment; creation of factor set A copy, denoted as , it is The permutation matrix chain at the maximum decomposition depth. Where the total decomposition depth... ,in This is the decomposition depth corresponding to the full-depth ideal decomposition defined in the definition of ideal decomposition.

[0050] Step S4: Iteratively apply the permutation matrix in the decomposed permutation matrix chain to the dense data vector to achieve homomorphic permutation.

[0051] Let the given dense-state data vector to be permuted be... It indicates that the vector is encrypted. The encrypted text. Among them, for... The cryptographic system used for encryption needs to be a batch-encoding homomorphic encryption scheme based on the RLWE (Ring-Learning With Error) security assumption, supporting vector space as the plaintext space and allowing element-wise homomorphic operations on the ciphertext. For example, encrypting a 1x1000 ciphertext... vector The batch coding homomorphic encryption scheme first maps it to a certain polynomial ring space. ,in Refers to a ring structure consisting of all polynomials with integer coefficients. It is a power of 2, and The mapped plaintext polynomial is denoted as... It will then be encrypted into ciphertext ct(z), which resides in the ring polynomial vector space. Among them ,and It is a pre-defined modulus chain, and batch-encoded homomorphic encryption ciphertext supports the following homomorphic operations: (1) For input ciphertext and Output its modulus The sum of: The result is a vector sum. Legitimate encrypted text.

[0052] (2) For ciphertext He Mingwen Output its modulus The product of: The result is an element-wise product. The valid ciphertext. This example uses constant homomorphic multiplication (CMult) to "filter" the elements in the vector under the ciphertext: that is, by multiplying the ciphertext vector by the plaintext vector containing only 0 and 1 values.

[0053] (3) For input ciphertext This operation will reduce the scaling factor of the plaintext. The output is as follows: This operation is used for noise control after CMult.

[0054] (4) For input ciphertext and any integer Homomorphically transfer vectors on the ciphertext Each component is shifted cyclically to the left. Position, among which It is a vector The dimension. This operation requires a corresponding rotation key. As implicit input, where It is by A pre-defined modulus chain consisting of moduli. .

[0055] In order to apply the given permutation function (The corresponding permutation matrix is) ) Acting on ciphertext Plaintext vector below In order to obtain ,Will Make a copy of the notes and set Then calculate and order Increment by 1, repeat the process, until... ; final calculation The result This is the ciphertext that encrypts the plaintext vector after the target permutation, i.e., for Decryption yields Among them, the linear transformation function Upon receiving input Time calculation:

[0056] In the formula, Traversal The index of each diagonal vector containing a non-zero value. The non-zero diagonal vector corresponding to this index. To The plaintext element obtained after encoding, and the summation symbol. Indicates all Using the above homomorphic encryption scheme The function performs summation. When input is received... hour, Judgment: When The number of non-zero diagonals and other permutation matrices When consistent, calculate:

[0057] In the formula, Traversal The index of each diagonal vector containing a non-zero value. The non-zero diagonal vector corresponding to this index. To The plaintext element obtained after encoding, and the summation symbol. Indicates all Using the above homomorphic encryption scheme The function performs summation.

[0058] And when The number of non-zero diagonals is greater than that of other permutation matrices. hour, Calculate the BSGS (Baby Step Giant Step) variant of the above formula:

[0059] In the formula It is The index is Circularly shift all elements on the non-zero diagonal to the right The results for each position. It is two satisfactions A positive integer is used to control the iteration rounds of the inner and outer summation loops in the above calculation formula.

[0060] Furthermore, such as Figures 2-5 The method of the present invention is used to treat a Permutation matrix The instance performs a depth-1 ideal decomposition search, where The permutation corresponding to this permutation matrix can transform a row-encoded... The matrix is ​​transposed. Where, due to The index of the non-zero diagonal has tolerance And they are all distributed in the interval Therefore, the settings are as follows. .

[0061] The elemental decomposition steps of this invention are shown in Figure 3. The middle is located in the first and The elements on the diagonal are decomposed into On the diagonal of the 6th and -6th lines; while located on The diagonal elements are then uniformly decomposed to the 0th diagonal. This process introduces conflicts in lines 6 and 9. Figure 4 This demonstrates one of the conflict-free scenarios found by the CheckRow function in the "Resolve Conflicts" step. For example, the dashed path illustrates the solution. The process of resolving conflicts. For example, suppose the CheckRow function starts from line 9: CheckRow first checks for elements that have conflicts. Move to the 6th diagonal, because The target line for this is line 3. Then, CheckRow recursively calls itself to check line 3. Since there is no conflict in line 3, the call returns and continues resolving the conflict in line 6. Once resolved... All conflicts can be recovered. , making ,like Figure 5 As shown.

[0062] Example 2 This embodiment discloses a privacy-preserving homomorphic permutation system based on permutation factor decomposition; like Figure 6 As shown, a privacy-preserving homomorphic permutation system based on permutation factor decomposition includes: The initialization module is configured to: obtain the permutation matrix representation of the target permutation, denoted as... And define the ideal permutation decomposition form of the target permutation; The decomposition parameter calculation module is configured to: calculate the permutation matrix of the target permutation. The depth-1 ideal decomposition search algorithm is used to find all factor pairs that satisfy the depth-1 ideal decomposition form. Among them, factor pairs Is with Same dimension, satisfying The permutation matrix of the ideal decomposition form of depth 1 has , The left factor in the factor pair. It is a right factor; The maximum depth decomposition module is configured to: traverse all factor indices, and upon each iteration to a factor indices, [process / decompose ... Replace with the left factor in the factor pair corresponding to that index. The next round of depth-ideal decomposition search is performed iteratively, using a depth-first search strategy to determine the optimal decomposition. Maximum depth decomposition scheme; when The maximum decomposition depth is At that time, the corresponding scheme is a clause containing A chain of permutation matrices for each factor: The factors satisfy the equation ; The homomorphic permutation module is configured to iteratively apply the permutation matrix in the decomposed permutation matrix chain to the dense data vector to achieve homomorphic permutation.

[0063] Example 3 The purpose of this embodiment is to provide a computer-readable storage medium.

[0064] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of a privacy-preserving homomorphic permutation method based on permutation factor decomposition as described in Example 1.

[0065] Example 4 The purpose of this embodiment is to provide an electronic device.

[0066] An electronic device includes a memory, a processor, and a program stored in the memory and executable on the processor. When the processor executes the program, it implements the steps in a privacy-preserving homomorphic permutation method based on permutation factor decomposition as described in Embodiment 1.

[0067] The steps and methods involved in the apparatuses of Embodiments 2, 3, and 4 above correspond to those in Embodiment 1. For specific implementation details, please refer to the relevant description section of Embodiment 1. The term "computer-readable storage medium" should be understood as a single medium or multiple media including one or more instruction sets; it should also be understood as including any medium capable of storing, encoding, or carrying an instruction set for execution by a processor and enabling the processor to perform any of the methods in this invention.

[0068] Those skilled in the art will understand that the modules or steps of the present invention described above can be implemented using general-purpose computer devices. Optionally, they can be implemented using computer-executable program code, thereby allowing them to be stored in a storage device for execution by a computer device, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. The present invention is not limited to any particular combination of hardware and software.

[0069] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of the present invention are still within the scope of protection of the present invention.

Claims

1. A privacy-preserving homomorphic permutation method based on permutation factor decomposition, characterized in that, include: Obtain the permutation matrix representation of the target permutation, denoted as And define the ideal permutation decomposition form of the target permutation; The permutation matrix of the target permutation The depth-1 ideal decomposition search algorithm is used to find all factor pairs that satisfy the depth-1 ideal decomposition form. Among them, factor pairs Is with Same dimension, satisfying The permutation matrix of the ideal decomposition form of depth 1 has , The left factor in the factor pair. It is a right factor; Iterate through all factor indices, and for each factor indice reached in the iteration, then... Replace with the left factor in the factor pair corresponding to that index. ; The next round of depth-ideal decomposition search is performed iteratively, using a depth-first search strategy to determine the optimal decomposition. Maximum depth decomposition scheme; when The maximum decomposition depth is At that time, the corresponding scheme is a clause containing A chain of permutation matrices for each factor: The factors satisfy the equation ; The permutation matrices in the permutation matrix chain obtained from the decomposition are iteratively applied to the dense-state data vector to achieve homomorphic permutation.

2. The privacy-preserving homomorphic permutation method based on permutation factor decomposition as described in claim 1, characterized in that, The ideal permutation decomposition form of the defined target permutation includes: Obtain the permutation matrix Distribution information of all non-zero diagonals in the data, including tolerances. and distribution interval Get Decomposition Function The decomposition function is valid when the following conditions are met. Permutation matrix A depth is The ideal decomposition, The matrices are decomposition permutation matrices. The resulting permutation matrix chain; when Permutation matrix A depth is In the ideal decomposition, the decomposition function Permutation matrix A full-depth ideal decomposition; wherein the decomposition function satisfies the following conditions: （1） ； (2) For any , Only the index belongs The non-zero diagonal of the set; where the index ; (3) The index of the non-zero diagonal only belongs to the interval ,in .

3. The privacy-preserving homomorphic permutation method based on permutation factor decomposition as described in claim 1, characterized in that, For the target permutation matrix The depth-1 ideal decomposition search algorithm is used to find all permutation matrix factor pairs that satisfy the depth-1 ideal decomposition form, including: Determine the index based on the non-zero diagonal distribution of the permutation matrix. ,in In the definition of ideal decomposition ; Initialization matrix For the target permutation matrix Same size, full value Array; For the permutation matrix For each non-zero element in the array, keep the column index unchanged and decompose it into... The diagonal, the diagonal and the Diagonal, to obtain the matrix Several lines of conflict; Call the sub-function CheckRow to transform the matrix All lines conflict on the first Move the diagonal element to the first diagonal or the Diagonal, until there are no row conflicts; If the subfunction CheckRow does not terminate due to an unresolved row conflict, then for the current To perform record storage, specifically, to create A copy, and recorded as ,in express It is the first Second pair Created during the recording process; After the recording is completed, the sub-function continues to search for the set of permutation matrices obtained with the current record according to the above strategy. They are all different, and there is no line conflict. form; For the set of permutation matrices obtained from the records Generate the corresponding Make This is true, resulting in a set of decomposition factors consisting of several pairs of decomposition factors. .

4. The privacy-preserving homomorphic permutation method based on permutation factor decomposition as described in claim 3, characterized in that, For the permutation matrix For each non-zero element in the array, keep its column index unchanged and decompose it into... The diagonal, the diagonal and the Diagonal, including: Create key-value table ,in Used to represent The Middle One non-zero diagonal line; key-value pairs Join Add to Each key-value pair in They all represent a... Decomposed into Non-zero elements, whose keys Indicates that the element is in row index, value Indicates that the element is in The original diagonal index in; make Traversal Let the indices of all non-zero diagonals be denoted by . Traversal The Middle Row indexes with non-zero values ​​on the diagonal, for The Middle The first on the diagonal The elements of a row are denoted as Perform the following operations: (1) If and If empty, then the key-value pair Add to ; (2) If and If empty, then the key-value pair Add to ; (3) If Then Add to ; Otherwise, if there is an unresolvable conflict, the search will terminate.

5. A privacy-preserving homomorphic permutation method based on permutation factor decomposition as described in claim 3 or 4, characterized in that, Call the sub-function CheckRow to transform the matrix All lines conflict on the first Move the diagonal element to the first diagonal or the Diagonal, until there are no line conflicts, including: Create to save the first The set of indices of rows with conflicting information on the diagonal ; for Each key-value pair in If in or There is another key-value pair. This indicates that in The There is a conflict in the lines, Add to collection ; Wait for all conflicting row indexes to be added Then, using Functions solve matrices The diagonal and the If there are row conflicts between diagonals, output all rows that satisfy the condition that there are no row conflicts. , recorded as ; When there is no condition that satisfies this condition When the time is right, output an empty set.

6. The privacy-preserving homomorphic permutation method based on permutation factor decomposition as described in claim 1, characterized in that, Iterate through all factor indices, and for each iteration to a factor indice, denote it as... , then Replace with the left factor in the factor pair corresponding to that index. The next round of depth-ideal decomposition search is performed iteratively, using a depth-first search strategy to determine the optimal decomposition. The maximum depth decomposition scheme; include: Create a collection A copy, denoted as ,in In Used to indicate the depth of decomposition; For each Perform a depth-1 ideal decomposition search to obtain the set of decomposition factor pairs. The set of factor pairs is used as a permutation. All depth-2 ideal decomposition forms; where, for ,have When the maximum decomposition depth is When the above recursive application of the depth-1 ideal decomposition search algorithm returns the following result: Create a copy of the result, denoted as , thus obtaining the permutation matrix Maximum decomposition depth The permutation matrix chain.

7. The privacy-preserving homomorphic permutation method based on permutation factor decomposition as described in claim 1, characterized in that, The process of iteratively applying the permutation matrices in the decomposed permutation matrix chain to the dense-state data vector to achieve homomorphic permutation includes: For the target dense-state data vector to be replaced Using the permutation matrix chain obtained by decomposition calculate Specifically: Initialize an empty ciphertext and use it iteratively. The function will Acting sequentially on the previous one The output results, where The first received parameter is and The output ciphertext can be obtained after decryption. Record the ciphertext as Receive in each subsequent round sequentially And the previous round The output is used as input; When the last permutation matrix in the matrix chain When the number of non-zero diagonal vectors in the matrix is ​​inconsistent with the previous permutation matrix, the LinTrans function, accelerated by the BSGS algorithm, is used to calculate the last homomorphic permutation and obtain the result of the homomorphic permutation.

8. A privacy-preserving homomorphic permutation system based on permutation factor decomposition, characterized in that: include: The initialization module is configured to: obtain the permutation matrix representation of the target permutation, denoted as... And define the ideal permutation decomposition form of the target permutation; The decomposition parameter calculation module is configured to: calculate the permutation matrix of the target permutation. The depth-1 ideal decomposition search algorithm is used to find all factor pairs that satisfy the depth-1 ideal decomposition form. ,in, Is with Same dimension, satisfying The permutation matrix of the ideal decomposition form of depth 1 has , The left factor in the factor pair. It is a right factor; The maximum depth decomposition module is configured to: traverse all factor indices, and upon each iteration to a factor indices, [process / decompose ... Replace with the left factor in the factor pair corresponding to that index. The next round of depth-ideal decomposition search is performed iteratively, using a depth-first search strategy to determine the optimal decomposition. Maximum depth decomposition scheme; when The maximum decomposition depth is At that time, the corresponding scheme is a clause containing A chain of permutation matrices for each factor: The factors satisfy the equation ; The homomorphic permutation module is configured to iteratively apply the permutation matrix in the decomposed permutation matrix chain to the dense data vector to achieve homomorphic permutation.

9. A computer-readable storage medium having a program stored thereon, characterized in that, When executed by a processor, the program implements the steps of a privacy-preserving homomorphic permutation method based on permutation factor decomposition as described in any one of claims 1-7.

10. An electronic device comprising a memory, a processor, and a program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps in the privacy-preserving homomorphic permutation method based on permutation factor decomposition as described in any one of claims 1-7.

Images