Privacy-preserving matrix multiplication calculation method and apparatus based on homomorphic encryption

Abstract

The present invention provides a privacy-preserving matrix multiplication calculation method and apparatus based on homomorphic encryption. [Solution] The present invention uses a special matrix encoding method and a corresponding high-performance ciphertext matrix transformation method to improve the efficiency of matrix multiplication while minimizing the waste of ciphertext space, and its comprehensive performance, including multiplication depth, ciphertext space utilization rate, and ciphertext rotation count, is significantly superior to conventional technical solutions. For practical security computing scenarios, the present invention proposes a privacy-protecting matrix multiplication framework involving two matrix providers and one matrix multiplication result recipient, which effectively protects all information, and in the case of a small number of dishonest semi-honest attackers, the attacker cannot obtain any private information of non-controllers.

Description

[Technical Field]

[0001] The present invention relates to the field of privacy protection technology, and in particular to a privacy protection matrix multiplication calculation method and apparatus based on homomorphic encryption. [Background technology]

[0002] With the advent of the big data era, cross-mechanism and multi-center data calculation modes are gradually becoming popular in order to achieve more persuasive analysis and research results, which also poses major challenges to security issues in the data usage process. In contrast, homomorphic encryption, as a special form of encryption, allows various basic calculation operations to be performed directly on encrypted information, and the results are basically identical to the corresponding calculations in plaintext, greatly improving the confidentiality and reliability of calculations. However, due to issues such as the expansion of the ciphertext size and the limited number of calculation types, the calculation efficiency of ciphertext in homomorphic encryption is still significantly lacking. In particular, in matrix multiplication in ciphertext, its original form requires repeated multiplication, addition, and rotation operations for each matrix element, which requires a large amount of storage space and calculation resources. Two multiplication matrices of size d × d are prepared, and for each matrix, d 2 The complexity of the number of rotations of the ciphertext is O(d 3 ), which makes it difficult to meet the requirements of actual applications and has a significant negative impact on the overall analytical efficiency of various machine learning and deep learning algorithms on ciphertext.

[0003] In response to this, data security experts have also proposed various optimized ciphertext matrix multiplication methods, and the two prior art proposals that are closest to the technical proposal proposed in this application are as follows: (1) According to the prior art proposal proposed by Jiang et al. in "Secure Outsourced Matrix Computation and Application to Neural Networks" published in 2018, in this technical proposal, each matrix only needs to be expressed by one ciphertext, and the number of ciphertext rotations is reduced to 3d+5√d-7. (2) According to the technical proposal applied to small matrix multiplication proposed by Rizomiliotis et al. in "On Matrix Multiplication with Homomorphic Encryption" published in 2022, in this technical proposal, each matrix also only needs to be expressed by one ciphertext, and the number of ciphertext rotations is reduced to 2d+3log2d-2.

[0004] The proposed technique requires the use of three multiplication layers, and compared to the original method (which uses only one layer), the encryption parameters often require the selection of larger polynomial degrees and polynomial coefficient modulo (which also means a larger expansion of the ciphertext size), resulting in poor computational performance and flexibility. Although the number of ciphertext rotations has been significantly reduced compared to the original method, there is still room for optimization.

[0005] Another technical proposal proposed by Rizomiliotis et al. improved the number of ciphertext rotations compared to the above proposal and reduced the consumption of multiplication depth from 3 to 2, but the ciphertext space utilization rate was very limited, only 1 / d (in contrast, the ciphertext space utilization rate of the technical proposal proposed by Jiang et al. was 100%), and it is only suitable for small-sized matrix multiplication scenarios.

[0006] Furthermore, in practical scenarios requiring security protection, there are often multiple participants, and the two matrices to be multiplied are often provided by different providers, and the recipient of the matrix multiplication result is likely to be a third party. In this case, the provider usually does not want their private matrix information to be revealed, while the recipient of the result often does not want their result to be revealed to other parties. Both of these technical solutions only use single-private key homomorphic encryption methods, so in the above scenario, the private key generator can decrypt and obtain all the information, posing a significant security risk. Summary of the Invention [Problem to be solved by the invention]

[0007] SUMMARY OF THE INVENTION In view of the shortcomings of the prior art, the present invention aims to provide a privacy-preserving matrix multiplication calculation method and apparatus based on homomorphic encryption. [Means for solving the problem]

[0008] According to a first aspect of the present invention, there is provided a privacy-preserving matrix multiplication calculation method based on homomorphic encryption, in which a participant entity includes two data providing mechanisms and one data using mechanism, the two data providing mechanisms being matrix provider 1 and matrix provider 2 respectively, the size of the matrix provided by matrix provider 1 is d×d, the size of the matrix provided by matrix provider 2 is d×v, and v≧d, and the data using mechanism is a matrix multiplication result acquirer, the method comprising the following steps S1 to S4: In step S1, all participants generate an encryption environment, commonly determine encryption parameters, and commonly generate a public key, a private key, and a calculation key, the calculation key including a multiplication key and a rotation key; In step S2, each matrix provider encodes its own multiplication waiting matrix into a one-dimensional array, encodes the one-dimensional array into a plaintext polynomial, and then transmits it to the result acquirer; In step S3, the result acquirer performs ciphertext matrix multiplication and shifts each row to the left by multiple bits using the BSGS algorithm on the ciphertext matrix from the matrix provider 1. TIFF0007745331000002.tif44 conversion completed. TIFF0007745331000003.tif44 The ciphertext matrix obtained by the conversion is rotated left multiple times to obtain d ciphertext matrices. TIFF0007745331000004.tif78 conversion is completed, and the ciphertext matrix from matrix provider 2 is subjected to multiple bit shifts up each column using the BSGS method. TIFF0007745331000005.tif44 conversion completed. TIFF0007745331000006.tif44 The ciphertext matrix obtained by the conversion is rotated left multiple times to obtain d ciphertext matrices. TIFF0007745331000007.tif78 conversion completed TIFF0007745331000008.tif78 The ciphertext matrix obtained by conversion TIFF0007745331000009.tif78The ciphertext matrix obtained by the conversion is multiplied for each ciphertext and added for each ciphertext, and then the ciphertext matrix multiplication result is obtained. In step S4, all participants commonly participate in the decryption, and the result acquirer finally obtains the matrix multiplication result plaintext.

[0009] Furthermore, the encryption parameters include the ciphertext capacity n, the ciphertext polynomial coefficient range q, and the secret key distribution D s , noise distribution D e , and magnification TIFF0007745331000010.tif64, wherein the ciphertext polynomial coefficient range q is TIFF0007745331000011.tif931, where q is a product of k distinct prime numbers, i is the value of the i-th prime number.

[0010] Furthermore, the rotation key is used to rotate the ciphertext, and the generation process includes: Any one participant samples uniformly from 0 to q-1 to obtain a polynomial group; All participant entities generate their own rotation keys based on the polynomial group, their own private keys, and transformed private keys calculated from the rotation step size; This involves all participating entities publishing their rotation keys and generating a collective rotation key.

[0011] Furthermore, the multiplication key is used for ciphertext multiplication, and the generation process is The result acquirer uniformly samples from 0 to q-1 to obtain a polynomial group, and generates his / her own multiplication key based on the polynomial group and his / her own private key, and sends it to the matrix provider 1; All participants encrypt their private keys with the public key of the result acquirer, and the matrix provider 2 and the result acquirer send their private key ciphertexts to the matrix provider 1, and the matrix provider 1 generates ciphertexts by adding ciphertexts and multiplying ciphertexts; The result winner is the polynomial group a1 to a k The matrix provider 1 generates its own multiplication key ciphertext and sends it to the result acquirer, and the matrix provider 2 generates its own multiplication key and sends it to the result acquirer; The result acquirer decrypts the multiplication key ciphertext of the matrix provider 1, and then obtains the overall multiplication key through calculation.

[0012] Furthermore, the matrix provider 1 counts the columns and rows of the matrix β of size d×d from 0, and calculates n / d for each row. 2The matrix provider 2 counts the columns and rows of the matrix x of size d×v from 0, and for each row, one polynomial of size d×(n / d 2 -1), add one blank row after it, and encode it as the plaintext polynomial X.

[0013] Furthermore, the result winner receives the ciphertext matrix c(B) from the matrix provider 1. TIFF0007745331000012.tif45 is converted and each row y of c(B) is shifted to the left using the BSGS method. TIFF0007745331000013.tif822 bit shifting is Calculate 2d-1 auxiliary matrices of the original matrix β, encode the auxiliary matrices into auxiliary plaintext, and then rotate the auxiliary plaintext to the right based on the giant step number i corresponding to each rotation step size. TIFF0007745331000014.tif923 Bit rotated, Obtaining a dedicated auxiliary plaintext for TIFF0007745331000015.tif45 conversion; The ciphertext matrix c(B) is TIFF0007745331000016.tif924 times rotated left by 1 bit, summed with the original matrix β TIFF0007745331000017.tif913 ciphertext matrices are obtained and kept as spares, Calculate the giant step number i and the baby step number j corresponding to each rotation step size, and TIFF0007745331000018.tif9 After element-wise multiplication of 12 ciphertext matrices, the optimized intermediate transformation result c(B i,j ) and for each giant step number i, obtain the ciphertext matrix c(B i,j ) and sum the ciphertext matrix to the left TIFF0007745331000019.tif922 Rotate the bits and add the sum of the ciphertext matrices after all rotations to get the final converted ciphertext matrix and acquiring TIFF0007745331000020.tif716.

[0014] Furthermore, the result winner receives the ciphertext matrix c(X) from the matrix provider 2. TIFF0007745331000021.tif55 and shift each column z of c(X) up by z × d bits using the BSGS method. Computing d submatrices of the ciphertext matrix c(X) and encoding the submatrices directly into subplaintext; The ciphertext matrix c(X) is TIFF0007745331000022.tif924 times left 2 Bit rotate and sum with the original matrix x TIFF0007745331000023.tif912 ciphertext matrices are obtained and kept as spares, Calculate the giant step number i and the baby step number j corresponding to each rotation step size, and TIFF0007745331000024.tif9 After element-wise multiplication of 12 ciphertext matrices, the optimized intermediate transformation result c(X i,j ) and for each giant step number i, obtain the ciphertext matrix c(X i,j ) and sum the ciphertext matrix to the left TIFF0007745331000025.tif936 After rotating the bits, add the sum of the ciphertext matrices after all rotations to get the final converted ciphertext matrix. and acquiring TIFF0007745331000026.tif816.

[0015] Furthermore, the result acquirer performs the ciphertext matrix multiplication calculation, TIFF0007745331000027.tif55Ciphertext matrix obtained by conversion TIFF0007745331000028.tif716 is rotated 1 bit to the left d-1 times, and together with the original matrix β, a total of d ciphertext matrices are created. Get TIFF0007745331000029.tif828 TIFF0007745331000030.tif78 conversion completed, Ciphertext matrix obtained by TIFF0007745331000031.tif44 conversion TIFF0007745331000032.tif715 d-1 times to the left 2 After bit rotation, a total of d ciphertext matrices are created along with the original matrix x. Get TIFF0007745331000033.tif828 TIFF0007745331000034.tif78 conversion completed, Ciphertext matrix multiplication result TIFF0007745331000035.tif2277 and sending the second polynomial in c(β·x) to the two matrix providers. Furthermore, decrypting the ciphertext matrix multiplication result includes: The matrix provider 1 decrypts the matrix according to the second polynomial of c(β·x) and its own private key, and then sends the decryption result PD1 to the result acquirer; the matrix provider 2 decrypts the matrix according to the second polynomial of c(β·x) and its own private key, and then sends the decryption result PD2 to the result acquirer; The result acquirer obtains the matrix multiplication result plaintext based on the decryption results of the two matrix providers and his / her own private key.

[0016] According to a second aspect of the present invention, there is provided a privacy-preserving matrix multiplication calculation device based on homomorphic encryption, the privacy-preserving matrix multiplication calculation device based on homomorphic encryption including: a memory; and one or more processors, wherein the memory stores executable code, and the processors, when executing the executable code, are used to perform the above-mentioned privacy-preserving matrix multiplication calculation method based on homomorphic encryption. [Effects of the Invention]

[0017] The beneficial effects of the present invention are as follows: The present invention proposes ciphertext matrix multiplication applied to batch or mini-batch gradient descent, and uses a special matrix encoding scheme and its corresponding high-performance ciphertext matrix transformation method to improve the efficiency of matrix multiplication while minimizing ciphertext space waste, and its overall performance (multiplication depth, ciphertext space utilization rate, and ciphertext rotation count) is significantly superior to previous similar domestic and foreign technical solutions. For practical security computing scenarios, the present invention proposes a privacy-preserving matrix multiplication framework including two matrix providers and one matrix multiplication result recipient, and an attacker model controlling either one cannot obtain the private information of the other two. [Brief explanation of the drawings]

[0018] [Figure 1] 1 is an overall flowchart of a privacy-preserving matrix multiplication computation protocol provided by one exemplary embodiment. [Figure 2] 1 is an overall flowchart of ciphertext matrix multiplication provided by one exemplary embodiment. [Figure 3] 1 is a schematic diagram of matrix encoding and encryption, σ transform, τ transform, Φ1 transform, and Ψ1 transform provided by an exemplary embodiment. [Figure 4] 1 is a σ conversion flowchart provided by one exemplary embodiment; [Figure 5] 1 is a block diagram of a privacy-preserving matrix multiplication calculation device based on homomorphic encryption provided by an exemplary embodiment; DETAILED DESCRIPTION OF THE INVENTION

[0019] In order to make the above objects, features and advantages of the present invention more comprehensible, specific embodiments of the present invention will be described in detail below with reference to the drawings. In order to provide a thorough understanding of the present invention, numerous specific details are set forth in the following description. However, the present invention may be embodied in other forms different from those described herein, and those skilled in the art will be able to apply similar methods without departing from the spirit of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0020] This invention proposes a privacy-preserving matrix multiplication method and device based on homomorphic encryption, adopting a three-party secure matrix multiplication protocol, suitable for various machine learning and deep learning model training and usage scenarios. A three-party framework is adopted for the actual security computation scenario, where the participants include two data providers and one data user, where both data providers are two matrix providers, and one data user is the matrix multiplication result recipient, where the two matrix providers respectively have a large matrix (e.g., data) and a small matrix (e.g., model parameters), for example, the size of the multiplication matrix provided by one matrix provider is d×d, i.e., the width and length of the matrix are both d, and the size of the multiplication matrix provided by the other matrix provider is d×v, i.e., the matrix width is d, the matrix length is v, and v≧d; the ciphertext capacity is n, and if n is d, 2 It is divisible by.

[0021] As shown in Figure 1, the overall matrix multiplication calculation flow based on the three-party frame is as follows: (1) All participants create the encryption environment. (2) The matrix provider encrypts each matrix and transmits the matrix multiplication result to the acquirer; (3) As shown in Figure 2, the person who obtains the matrix multiplication result performs ciphertext matrix multiplication to generate a matrix multiplication result ciphertext; (4) All participants jointly participate in the decryption, and the person who acquires the matrix multiplication result ultimately acquires the matrix multiplication result plaintext.

[0022] I. Applicable encryption methods Encryption schemes to which the present invention can be applied include schemes based on the Ring-LWE problem, such as BFV (Brakerski-Fan-Vercauteren) and CKKS (Cheon-Kim-Kim-Song), which are homomorphic encryption schemes with the best overall performance at present, and have the following features: (1) The ciphertext domain is a polynomial ring, and the representation format of the ciphertext is a pair of polynomials. For ease of understanding, the present invention represents the two polynomials with the subscripts [0] and [1], respectively. The highest degree of each polynomial must not exceed the degree of the pre-selected polynomial, and is generally a positive integer power of 2. For the BFV homomorphic encryption scheme, the highest degree is n, and for the CKKS homomorphic encryption scheme, the highest degree is 2n. The coefficients of the polynomials are natural numbers and smaller than the pre-selected polynomial coefficient modulo, and are generally a large prime number or a product of multiple relatively prime small prime numbers. (2) A pair of polynomials, which is a ciphertext, includes a one-dimensional array, and the array length is proportional to the preselected polynomial degree, i.e., the array length is equal to the ciphertext capacity n. (3) The corresponding elementary ciphertext operations are element-wise addition "+" and element-wise multiplication " TIFF0007745331000036.tif77”, which has only an array rotation “ρ”, where the element-wise multiplication needs to be done with the multiplication key and the array rotation needs to be done with the rotation key.

[0023] 2. Creating an encryption environment At the beginning of the entire protocol, all participating entities jointly decide on encryption parameters and jointly generate public keys, private keys and computation keys, where the computation keys include a multiplication key and a rotation key. The encryption parameters mainly include the following (1) to (5). (1) Ciphertext capacity n, (2) Ciphertext polynomial coefficient range TIFF0007745331000037.tif932 is a product of k distinct prime numbers, where q i is the value of the i-th prime number, and the number of bits of q can be obtained by searching a table based on the security level, ciphertext capacity, and prime number distribution, as shown in Table 1. Table 1 shows the relationship between homomorphic encryption parameters based on the Ring-LWE problem and security levels. [Table 1] (4) Noise distribution D e is used to generate random noise, which is a discrete bounded Gaussian distribution with a standard deviation of 3.2. (5) Magnification TIFF0007745331000039.tif65 is used to encode a matrix into a plaintext polynomial. The flow for generating each type of key includes the following steps (1) to (6). (1) All participants share a private key distribution D s Generate each private key by i Let i=1, 2, 3, which respectively represent matrix provider 1, matrix provider 2, and matrix multiplication result winner, (2) One of the participant entities samples uniformly in the range from 0 to q-1, obtains polynomial a, and sends it to other participant entities. For example, matrix provider 1 can sample and obtain polynomial a, and then send it to matrix provider 2 and the result acquirer, or the result acquirer can sample and obtain polynomial a, and then send it to matrix provider 1 and matrix provider 2. (3) All participants generate their own public keys, and the generation formula is as follows:

number

number

number

number

number

number

number

number

number

number

[0024] 3. Matrix encoding and encryption After the encryption environment is generated, for matrices of size d×d and d×v (where v≧d), the present invention proposes a new ciphertext matrix multiplication method that reduces the multiplication depth and the number of rotations while maintaining the ciphertext space utilization as much as possible, as shown in Figure 3, in the example of Figure 3, d=4, v=12, n=64. At the beginning of the ciphertext matrix multiplication, the two matrix providers need to encode, encrypt and upload their respective matrices, and finally the result recipient finally obtains the ciphertext matrix. For ease of explanation, the present invention will hereinafter represent the one-dimensional arrays contained in the matrix ciphertext and plaintext as matrix forms. y is represented as the row index of the ciphertext matrix, starting from 0, and z is represented as the column index of the ciphertext matrix, starting from 0. The index of each element in the ciphertext matrix in the one-dimensional array is index=y×d+z. (1) The matrix provider first encodes each matrix into a one-dimensional array, and then encodes the one-dimensional array into a plaintext polynomial, and this step is mainly realized by the Chinese Remainder Theorem. For a square matrix β of size d×d, the matrix element β i_j Let i in be the column index and j be the row index, counting from 0. The present invention calculates the number of rows in a matrix, i.e., β 0_j From β d-1_j Until n / d 2 It is repeated times, and finally encoded into plaintext polynomial B, and the mapping relationship is TIFF0007745331000061.tif826,i=z, where: TIFF0007745331000062.tif77 shows truncation. For a rectangular matrix x of size d×v (v≦n / dd), the matrix element x i_jLet i in be the column index and j be the row index, also counting from 0. The present invention calculates the number of rows in a matrix, i.e., x 0_j From x v-1_j In order, one size is d × (n / d 2 -1), then add one blank row, and finally encode it into the plaintext polynomial X, and the mapping relationship is TIFF0007745331000063.tif849, z=i mod d, where: TIFF0007745331000064.tif76 shows truncation. (2) The matrix provider encrypts each plaintext polynomial and sends it to the result recipient, and the formula is as follows:

number

[0025] 4. The result winner Convert to TIFF0007745331000066.tif54. The specific effect of the TIFF0007745331000067.tif55 transformation is to move each row y of the ciphertext matrix c(B) to the left. TIFF0007745331000068.tif822 is a bit shift. Since the ciphertext rotation can only be performed on the entire one-dimensional array as a unit, the transformation effect must be implemented using the BSGS (baby step giant step) method, as shown below.

number

number

number

[0026] 5. The person who gets the results Convert to TIFF0007745331000088.tif44. The specific effect of the TIFF0007745331000089.tif44 transformation is to shift each column z of the ciphertext matrix c(X) upward by z × d bits, and the implementation of this transformation effect also uses the BSGS method, as shown below.

number

number

number

[0027] 6. Ciphertext matrix multiplication calculation and result decryption Ciphertext Matrix TIFF0007745331000107.tif716 and After obtaining TIFF0007745331000108.tif815, the result winner will first TIFF0007745331000109.tif78 conversion and ciphertext matrix Rotate TIFF0007745331000110.tif716 left by 1 bit d-1 times, and create a total of d ciphertext matrices along with the original matrix. Get TIFF0007745331000111.tif828, moreover TIFF0007745331000112.tif78 conversion and ciphertext matrix TIFF0007745331000113.tif715 d-1 times to the left 2After bit rotation, a total of d ciphertext matrices are generated together with the original matrix. Get TIFF0007745331000114.tif828, Then the final ciphertext matrix multiplication result is TIFF0007745331000115.tif2278 can be calculated. This step requires one multiplication depth, so the total multiplication depth consumption for the entire ciphertext matrix multiplication is 1 + 1 = 2. Finally, the result recipient sends c(β·x)[1], the second-order polynomial of c(β·x), to the two matrix providers. The two matrix providers then perform partial decryption. Matrix provider 1's decryption formula is PD1 = c(β·x)[1] × s1 + e1, and matrix provider 2's decryption formula is PD2 = c(β·x)[1] × s2 + e2, where e1 and e2 are randomly generated using a 26-74 bit Gaussian distribution and are used for the following steps (1) and (2): (1) protect s1 and s2; (2) in the case of the CKKS technology proposal, achieve the Q-IND-CPAD security level. The specific number of noise bits and security level are shown in Table 2 in the paper "Securing Approximate Homomorphic Encryption Using Differential Privacy." Matrix provider 1 then sends PD1 to the result recipient, and matrix provider 2 then sends PD2 to the result recipient. Table 2 shows the amount of differential noise (in bits) that needs to be added separately during decryption under different conditions to achieve Q-IND-CPAD security levels with different statistical security, where Q is the maximum number of possible decryption queries, and the corresponding ciphertext capacity is 32769 (BFV) or 16384 (CKKS). [Table 2] The result obtainer performs the final decryption and obtains the plaintext result, and the formula is as follows:

number

[0028] Compared with the technical proposal proposed by Jiang et al., the advantages of this invention are a smaller multiplication depth and a smaller number of ciphertext rotations. TIFF0007745331000118.tif738 times TIFF0007745331000119.tif738 times, and the consumed multiplication depth has been reduced from 3 layers to 2 layers. Compared with the technical solution proposed by Rizomiliotis et al., the advantage of this invention is that it significantly improves the ciphertext space utilization rate, reducing the ciphertext space utilization rate from 1 / d to (nd 2 ) / n. Because n is typically very large (greater than 4096), the actual ciphertext space utilization of the present invention is typically only slightly lower than that of the technical solution proposed by Jiang et al., significantly improving the computational efficiency of the overall technical solution. Furthermore, by utilizing threshold homomorphic encryption, the present invention effectively protects all information, and in the model of a small number of dishonest semi-honest attackers, the attacker cannot obtain any private information of non-controllers, something that the two prior art solutions cannot achieve.

[0029] A comparison of overall performance is shown in Table 3, where the ciphertext capacity n and matrix width d are both selected from common real-world applications. When n = 65536 and d = 64, the maximum value of a single ciphertext v in the Rizomiliotis solution is only 16. This means that under these conditions, only four ciphertexts can represent a 64x64 matrix, which means that the number of ciphertext selections increases dramatically.

[0030] Table 3 is a comprehensive performance comparison table between the technical solution of the present invention, the Jiang technical solution, and the Rizomiliotis technical solution. [Table 3]

[0031] Corresponding to the embodiment of the privacy-preserving matrix multiplication calculation method based on homomorphic encryption, the present invention further provides an embodiment of a privacy-preserving matrix multiplication calculation device based on homomorphic encryption.

[0032] Referring to FIG. 5, a privacy-preserving matrix multiplication calculation device based on homomorphic encryption provided by an embodiment of the present invention includes a memory and one or more processors, wherein the memory stores executable code, and when the processor executes the executable code, it is used to realize the privacy-preserving matrix multiplication calculation method based on homomorphic encryption in the above embodiment.

[0033] The embodiment of the privacy-preserving matrix multiplication calculation device based on homomorphic encryption of the present invention can be applied to any device with data processing capabilities, such as a computer. The embodiment of the device can be implemented in software, hardware, or a combination of software and hardware. Taking the software implementation as an example, as a logical device, it is formed by a processor of the device with data processing capabilities in which the device is located, reading corresponding computer program instructions from a non-volatile memory into an internal memory and executing them. From a hardware perspective, FIG. 5 shows a hardware structure diagram of a device with data processing capabilities in which the privacy-preserving matrix multiplication calculation device based on homomorphic encryption of the present invention is located. In addition to the processor, memory, network interface, and non-volatile memory shown in FIG. 5, the device with data processing capabilities in which the device in the embodiment is located may generally include other hardware depending on the actual functions of the device with data processing capabilities, and the description thereof will be omitted.

[0034] The process of performing the functions and actions of each unit of the above device specifically refers to the process of performing the corresponding steps in the above method, and the description thereof is omitted here.

[0035] The device embodiments basically correspond to the method embodiments, so please refer to the relevant sections in the description of the method embodiments. The device embodiments described above are merely schematic, and the units described herein as independent components may or may not be physically separated, and the components displayed as units may or may not be physical units, i.e., they may be located in one place or distributed across multiple network units. Depending on actual needs, some or all of the modules may be selected to achieve the objectives of the proposed invention. Those skilled in the art can understand and implement this without any creative effort.

[0036] An embodiment of the present invention further provides a computer-readable storage medium, which stores a program that, when executed by a processor, performs the privacy-preserving matrix multiplication calculation method based on homomorphic encryption in the above embodiment.

[0037] The computer-readable storage medium may be an internal storage unit, such as a hard disk or internal memory, of any device with data processing capabilities described in any of the above embodiments. The computer-readable storage medium may also be an external storage device of any device with data processing capabilities, such as an insertable hard disk installed in the device, a Smart Media Card (SMC), an SD card, or a flash card. Furthermore, the computer-readable storage medium may include an internal storage unit of any device with data processing capabilities, as well as an external storage device. The computer-readable storage medium may be used to store the computer program and other programs and data required by the device with data processing capabilities, and may also be used to temporarily store output data or data to be output.

[0038] The above description is merely a preferred embodiment of one or more embodiments of the present specification, and is not intended to limit the one or more embodiments of the present specification. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of one or more embodiments of the present specification should be included within the protection scope of one or more embodiments of the present specification.

Claims

1. A privacy-preserving matrix multiplication calculation method based on homomorphic encryption, the privacy-preserving matrix multiplication calculation method based on homomorphic encryption being executed by a privacy-preserving matrix multiplication calculation device based on homomorphic encryption, wherein participant entities include two data providing mechanisms and one data using mechanism, the two data providing mechanisms being matrix provider 1 and matrix provider 2 respectively, the size of the matrix provided by matrix provider 1 is d×d, the size of the matrix provided by matrix provider 2 is d×v, and v≧d, and the data using mechanism is an acquirer of the result of matrix multiplication; The privacy-preserving matrix multiplication calculation method based on homomorphic encryption includes the following steps S1 to S4: In step S1, the privacy-preserving matrix multiplication calculation device based on homomorphic encryption generates an encryption environment, determines encryption parameters in common, and causes all the participant entities to generate public keys, private keys, and calculation keys in common, where the calculation keys include a multiplication key and a rotation key, and the encryption parameters include a ciphertext capacity n, a ciphertext polynomial coefficient range q, and a private key distribution D ｓ , noise distribution D ｅ , and magnification wherein the ciphertext polynomial coefficient range q is is a product of k distinct prime numbers, and q ｉ is the value of the i-th prime number, In step S2, the privacy-preserving matrix multiplication calculation device based on homomorphic encryption makes each matrix provider encode its own multiplication-waiting matrix into a one-dimensional array, then encode the one-dimensional array into a plaintext polynomial, encrypt, and transmit it to the result acquirer. The matrix provider 1 counts the columns and rows of a matrix β of size d×d from 0, and calculates n / d for each row. ２ The matrix provider 2 counts the columns and rows of the matrix x of size d×v from 0, and for each row, one polynomial of size d×(n / d ２ −1), followed by one blank row, and then encode it into the plaintext polynomial X, In step S3, the privacy-preserving matrix multiplication calculation device based on homomorphic encryption performs ciphertext matrix multiplication, shifting each row of the ciphertext matrix from the matrix provider 1 to the left by multiple bits using the BSGS algorithm. Complete the conversion, The ciphertext matrix obtained by the conversion is rotated left multiple times to obtain d ciphertext matrices. To complete the transformation, the ciphertext matrix from matrix provider 2 is shifted up by multiple bits in each column using the BSGS method. Complete the conversion, The ciphertext matrix obtained by the conversion is rotated left multiple times to obtain d ciphertext matrices. Complete the conversion, The ciphertext matrix obtained by the conversion is The result acquirer executes multiplication and addition for each ciphertext on the ciphertext matrix obtained by the conversion, and then acquires the ciphertext matrix multiplication result; The privacy-preserving matrix multiplication calculation device based on the homomorphic encryption converts the ciphertext matrix c(B) from the matrix provider 1 into Transform each row y of c(B) to the left using the BSGS method. causing the result obtainer to perform bit shifting, Calculate 2d-1 auxiliary matrices of the original matrix β, encode the auxiliary matrices into auxiliary plaintext, and then rotate the auxiliary plaintext to the right based on the giant step number i corresponding to each rotation step size. Bit rotation, obtaining a private auxiliary plaintext of the transformation; The ciphertext matrix c(B) Rotate the matrix β to the left by one bit and sum it with the original matrix β. obtaining and preserving ciphertext matrices; Calculate the giant step number i and the baby step number j corresponding to each rotation step size, and After performing element-wise multiplication on the ciphertext matrices, the optimized intermediate transformation result c(B ｉ，ｊ ) and for each giant step number i, obtain the ciphertext matrix c(B ｉ，ｊ ) and sum the ciphertext matrix to the left After bit rotation, add the sum of all the ciphertext matrices after rotation again to get the final ciphertext matrix and obtaining The privacy-preserving matrix multiplication calculation device based on the homomorphic encryption converts the ciphertext matrix c(X) from the matrix provider 2 into and causing the resultant obtainer to perform a z×d bit shift on each column z of c(X) using the BSGS method. Computing d submatrices of the ciphertext matrix c(X) and encoding the submatrices directly into subplaintext; The ciphertext matrix c(X) Turn left ２ Bit rotate and sum with the original matrix x obtaining and preserving ciphertext matrices; Calculate the giant step number i and the baby step number j corresponding to each rotation step size, and After performing element-wise multiplication on the ciphertext matrices, the optimized intermediate transformation result c(X ｉ，ｊ ) and for each giant step number i, obtain the ciphertext matrix c(X ｉ，ｊ ) and sum the ciphertext matrix to the left After bit rotation, add the sum of all the ciphertext matrices after rotation again to get the final ciphertext matrix and obtaining In the step S4, the privacy-preserving matrix multiplication calculation device based on homomorphic encryption commonly participates in the decryption, and the result acquirer finally obtains the matrix multiplication result plaintext. This is a privacy-preserving matrix multiplication calculation method based on homomorphic encryption, characterized in that:

2. The rotation key is used to rotate the ciphertext, and the generation process is Any one participant entity uniformly samples from 0 to q-1 to obtain a polynomial group; All participant entities generate their own rotation keys based on the polynomial group, their own private keys, and transformed private keys calculated from the rotation step size; 2. The privacy-preserving matrix multiplication computation method based on homomorphic encryption according to claim 1, characterized in that it comprises all participant entities publishing their rotation keys and generating a collective rotation key.

3. The multiplication key is used for ciphertext multiplication, and the generation process is as follows: The result acquirer uniformly samples from 0 to q-1 to obtain a polynomial group, generates his / her own multiplication key based on the polynomial group and his / her own secret key, and sends it to the matrix provider 1; All participants encrypt their private keys with the public key of the result acquirer, and the matrix provider 2 and the result acquirer send their private key ciphertexts to the matrix provider 1, and the matrix provider 1 generates a ciphertext by adding ciphertexts and multiplying ciphertexts; The result acquirer publishes the polynomial group, the matrix provider 1 generates its own multiplication key ciphertext and sends it to the result acquirer, and the matrix provider 2 generates its own multiplication key and sends it to the result acquirer; and the result acquirer decrypts the multiplication key ciphertext of the matrix provider 1, and then obtains the overall multiplication key through calculation.

4. The result acquirer performs ciphertext matrix multiplication calculations, The ciphertext matrix obtained by the transformation is rotated d-1 times to the left by 1 bit, and together with the original matrix β, a total of d ciphertext matrices are obtained. Get Completing the conversion; The ciphertext matrix obtained by the transformation d-1 times to the left ２ After bit rotation, a total of d ciphertext matrices are generated together with the original matrix x. Get Completing the conversion; Ciphertext matrix multiplication result and transmitting the second polynomial of c(β·x) to the two matrix providers.

5. Decrypting the ciphertext matrix multiplication result includes: The matrix provider 1 decrypts the data based on the second polynomial of c(β x) and his / her private key, and then the decryption result PD １ The matrix provider 2 decrypts the result PD based on the second polynomial of c(β x) and his / her private key. ２ to the result winner; The privacy-preserving matrix multiplication calculation method based on homomorphic encryption according to claim 4, further comprising: the result acquirer obtaining the matrix multiplication result plaintext based on the decryption results of the two matrix providers and his / her own private key.

6. 6. A privacy-preserving matrix multiplication calculation device based on homomorphic encryption, comprising: a memory in which executable code is stored; and one or more processors, wherein the processors, when executing the executable code, are used to perform the privacy-preserving matrix multiplication calculation method based on homomorphic encryption according to any one of claims 1 to 5.

Images