Function encryption for quadratic functions

Abstract

The present invention relates to a system, method, network device, and machine-readable medium for improved construction of public-key function encryption schemes for quadratic functions. In particular, the present disclosure relates to a new function encryption scheme for computing quadratic functions to generate a decryption key that allows a data owner to control what can be computed but not involved in the computation, and to learn the quadratic function evaluation of some encrypted data.

Description

Technical Field

[0001] This disclosure relates to an improved construction of a functional encryption (FE) scheme for quadratic functions.

[0002] Cross - reference to related applications This application claims priority to U.S. Provisional Application No. 63 / 104,787, filed October 23, 2020, the entire content of which is incorporated herein by reference.

Background Art

[0003] Functional encryption extends traditional public - key encryption in two different ways. That is, it supports fine - grained access control and enables learning functions of encrypted data. A decryption key in functional encryption allows a user to know a specific function of encrypted data and nothing else. There exists a trusted authority that holds a master secret key known only to this authority. When given the description of a function f as input, the authority uses its master secret key to generate a derived secret key sk[f] associated with f. Anyone who holds sk[f] can compute f(x) from the encryption of any x.

[0004] Linear functions have been well - studied. Consider an example where Alice holds data a = 3 and b = 5. Here, Bob wants to know the value of (a + b), but a and b are encrypted. So, Alice provides Bob with access to compute a function on the encrypted variables a and b. In this way, Bob will obtain the result of the function in decrypted form without even accessing the decrypted values of the variables. However, the use of quadratic functions has not been studied as well.

[0005] As used in functional cryptography systems, quadratic functions can have several practical applications. For example, quadratic polynomials can represent many statistical functions (e.g., (weighted) mean, variance, covariance, root mean square), the Euclidean distance between two vectors, and applications of linear or quadratic classifiers (e.g., linear or quadratic regression). However, existing systems can produce very large outputs. Therefore, there is a need for a functional cryptography system that can efficiently perform functional cryptography using quadratic functions in a size-constrained environment. [Overview of the Initiative]

[0006] Some embodiments of the present invention include systems, methods, network devices, and machine-readable media for protecting computations over quadratic polynomials by functional cryptography. The method includes the steps of: running a computerized setup algorithm that outputs a public key and a master private key; running a computerized key generation algorithm that receives the master private key, a quadratic polynomial f, and outputs a private key; running an encryption algorithm in a first computerized processor that receives the public key and an electronic message, the electronic message comprising two vectors z1 and z2, both of length n, and outputs a ciphertext; running a decryption algorithm in a second computerized processor located remotely from the first computerized processor that receives the ciphertext and the private key via an electronic communication network and outputs a decrypted value that is the same value as evaluating the polynomial specified by f in vectors z1 and z2 based on the ciphertext and the private key; and transmitting the decrypted value to the first computerized processor. Here, any computationally efficient process learns nothing about z1 and z2 beyond the polynomial evaluation.

[0007] In some further embodiments, the setup algorithm further includes the steps of: performing the setup algorithm for the ElGamal scheme twice to generate public keys w1 and w2 and private keys sk1 and sk2; performing the setup algorithm for the functional cryptographic scheme for a linear polynomial scheme to result in a public key w0 and a master private key msk0; and generating outputs w1, w2, and w0 as the public keys and generating msk0 as the master private key.

[0008] In some further embodiments, the encryption algorithm further includes the steps of: executing an encryption algorithm of an ElGamal scheme, wherein the input to the ElGamal scheme z1 includes a public key w1 and randomness s1, resulting in a ciphertext y1; executing an encryption algorithm of an ElGamal scheme, wherein the input to the ElGamal scheme includes a public key w2 and randomness s2, resulting in a ciphertext y2; executing an encryption algorithm of a linear polynomial scheme, wherein the input to the FE1 scheme includes a public key w0 and a vector, wherein the vector includes a concatenation of s1 × z2 and y1 × s2, resulting in a ciphertext y0; and generating outputs y1, y2, y0 as the ciphertexts.

[0009] In some further embodiments, the key generation algorithm performs the steps of: executing the key generation algorithm of a linear polynomial scheme, wherein the input to the linear polynomial scheme includes the master secret key msk0 and a linear polynomial derived from f, w1 and w2, resulting in a secret key sk, and generating an output sk as the secret key.

[0010] In some further embodiments, the decoding algorithm is further: The process includes the steps of: receiving the ciphertext; parsing the ciphertext into specified components y1, y2, and y0; receiving a secret key sk, the secret key sk being generated by a linear polynomial scheme; computing a quadratic polynomial f for components y1 and y2, resulting in a value v1; decrypting y0 using sk with the decryption algorithm of the linear polynomial scheme, resulting in a decrypted value v0; and generating an output v1-v0 as the decrypted value.

[0011] In some further embodiments, the quadratic polynomial f is a privacy-preserving machine learning function that is executed in a neural network using a quadratic activation function. In some further embodiments, the quadratic polynomial f is a quadratic function and is selected from one or more statistical functions or correlation functions. Some further embodiments include the step of applying the polynomial of the quadratic polynomial f to a projection vector.

[0012] In some further embodiments, the electronic message is configured and stored as a relational database, the database is logically configured in a data model compatible with an operation performed by a specified function, the secret key defines a subset of data in the relational database, and the decryption algorithm performs the specified function on the subset of data. [Brief explanation of the drawing]

[0013] The attached drawings are included to provide further understanding, are incorporated into and constitute part of this specification, illustrate the disclosed embodiments, and, together with the description, illustrate the principles of the disclosed embodiments. The drawings are as follows: [Figure 1]Figure 1 shows an exemplary system architecture for a functional cryptography system with respect to a quadratic function. [Figure 2] Figure 2 shows one example of a self-contained description of a quadratic function encryption scheme. [Figure 3] Figure 3 shows one exemplary computer system architecture for implementing the requested system and method. [Figure 4] Figure 4 shows further details of one exemplary computer system architecture for implementing the requested system and method. [Modes for carrying out the invention]

[0014] Disclosed herein are functional encryption (FE) schemes for quadratic functions that use a constant-size key and a shorter ciphertext than all conventional schemes based on static assumptions. Some embodiments include partially-hiding public-key FE that support NC1 computations on public attributes and quadratic computations on secret messages, using a ciphertext size independent of the length of public attributes. Both configurations achieve selective, simulation-based security against unrestricted collusion and rely on k-linear assumption (two-way) security in prime-order bilinear groups. At the core of these configurations is a new reduction from quadratic FE to linear FE.

[0015] Embodiments of the present invention provide functional encryption for quadratic functions. That is, we encrypt a message z to generate a ciphertext ct, and a secret key sk f I want to generate sk fDecrypting ct using returns f(z) without disclosing any additional information about z. In addition, we desire (i) short ciphertexts that increase linearly with length z, and (ii) simulation-based security against collusion, so that the ct held by an adversary, and the secret keys for different functions f1, f2, ... learn nothing about z beyond the outputs of these functions. Functional cryptography for quadratic functions has many applications, including traitor-tracing schemes where ciphertext size is quasi-linear with respect to the total number of users, obfuscation from simple assumptions, and privacy-preserving machine learning for neural networks using quadratic activation functions.

[0016] The embodiment includes a novel pairing-based public-key function cryptography scheme for quadratic functions, improving upon recent configurations. The embodiment includes: an FE scheme for quadratic functions with a constant-size key, the ciphertext size being shorter than the ciphertext size of all conventional public-key schemes based on static assumptions, and furthermore, when instantiated over the BLS12-381 curve, where,

number

[0017] Both configurations achieve simulation-based security that is at least selective against unrestricted collusion and rely on the bidirectional k-linear assumption in the prime-order bilinear group. At the core of these configurations is a new reduction from a quadratic public key FE to a linear public key FE. The reduction relies on the (bidirectional) k-linear assumption and expands up to k times. Note that the trivial reduction expands the input size up to |z| times. The reduction of the present invention is simpler and more direct than previous reductions, (i) does not require a function hiding FE for linear functions, and (ii) the reduction of the present invention works directly in public key setting. By (i), the embodiments disclosed herein can also reduce the private key size from linear to constant.

[0018] An overview of an exemplary configuration is disclosed. We have the asymmetric bilinear group of prime number order p.

number

number

number

number

number

number

[0019] The bidirectional k-linear assumption is an enhancement of the k-linearity, and,

number

[0020] Note that the bidirectional 1-linear (1-Lin) is false for the same reason that DDH is false in the symmetric bilinear group.

[0021] Function encryption for quadratic functions

number

number

number

number

number

number

[0022] We express the cross term as a linear function evaluated for an input of length 0 (kn). A key difference in this study is that the linear function can be derived from the master public key and f.

[0023] More precisely, we will describe it as follows:

number

number

number

number

number

number

[0024] Mf T The latter characteristic regarding the linear function MfT Since there is nothing "secret" about this, this allows us to significantly simplify previous reductions. In previous studies, linear functions leak information about the master private key beyond what can be calculated from the master public key.

[0025] In particular, to compute equation (3), we can use the public key FE of a linear function (abbreviated as linear FE). That is, we

number

number

number

[0026] Security Overview First, under the k-linear assumption, we observe that [y1]1 and [y2] do not leak information with respect to z1 and z2.

[0027] Next, we,

number

number

[0028] In reduction, to simulate the secret key of a linear FE, we,

number

number

[0029] Extension to Partially Secret Function Encryption (PHFE) The approach of the present invention is class

number

number

number

[0030] To compute the new boxed term, class

number

[0031] We can extend the configuration to take matrix M into account. Some care is needed as the decryption algorithm obtains only [M]2 and not M. In the subsequent scheme, the ciphertext size increases linearly with the message and is independent of x, which we then inherit into our partial-secrecy secondary FE.

[0032] Notation We have the fact that s is uniformly randomly selected from a finite set S.

number

number

Number

[0033] Matrix

Number

Number

[0034] The mixed-product property of the tensor product is

Number

[0035] <able> Arithmetic branching program A branching program is defined by a directed acyclic graph (V, E). Two special vertices are v0, v1 ∈ V and the labeling function is φ. In an arithmetic branching program (ABP), p is a prime number and the function

Number

number

number

number

[0036] We note that there exists a linear-time algorithm that converts any Boolean expression, Boolean branch program, or arithmetic expression into an arithmetic branch program with a constant blow-up in representation size. Therefore, ABP can be considered a more powerful computational model than all of the above. Also, recall that branch programs and Boolean expressions correspond to complexity classes LOGSPACE and NC1, respectively.

[0037] prime order bilinear group (Prime-Order Bistandard Group) generator

number

number

number

number

number

number

number

number

[0038] Assumption 1 (MDDH d k,k’ (Assumption)

number

number

number

number

[0039] The MDDH assumption in G2 can be defined in a similar manner.

number

[0040] The bidirectional MDDH assumption is similarly defined using a favorable function.

number

[0041] Partially Secret Function Encryption (PHFE) We, function class

number

number

number

number

[0042] Syntax The Partially Secret Function Encryption Scheme (PHFE) consists of four algorithms.

[0043] Setup(1 λ ,1 n ,1 n’ ,h): The setup algorithm takes security parameter 1 as input. λ , and also, function parameter 1 n ,1 n , and,

number

[0044] Enc(mpk,x,z): The encryption algorithm takes mpk and message as input.

number

[0045] KeyGen(msk,f): The key generation algorithm takes msk and a function as inputs.

number

[0046] Dec((sk f ,f),(ct (x,z) ,x)): The decoding algorithm takes sk as input. f , and ct together with f (x,z) , and also obtain x. That is Z p Output the value in this case.

[0047] accuracy (Correctness) all

number

number

[0048] Relaxation of accuracy The disclosed scheme achieves accuracy relaxation. Here, the decoding algorithm has an additional boundary 1 B Take (and perform this with a time polynomial in B), and if the value is bounded by B, then h(z)f(x) T This outputs the following. This feature is also present in previous studies on DDH and (IP)FE from bilinear groups due to the reliance on brute-force discrete logs to recover the “from the exponent” answer. The relaxation refers only to functionality and does not affect security.

[0049] Security Definition We are considering semi-adaptive (enhanced selectivity), simulation-based security, which involves a randomized simulator (Setup * Enc * KeyGen *This stipulates that all efficient stateful adversaries exist.

number

number

number

[0050] Main configuration In this section, we will class

number

[0051] This scheme is SA-SIM secure under bidirectional k-linear and k'-linear assumptions in G1 and G2 (for the most efficient concrete instantiation, we set k=2 and k'-=1). In this scheme, decryption is actually performed.

number

number

[0052] As building blocks, we

number

number

[0053] scheme Setup(p,1 n ,1 n’1 ,1 n’2 ):

number

number

number

number

[0054] Enc(mpk,x,(z1,z2)):

number

number

[0055] KeyGen(msk,f):

number

[0056] Dec(sk f ,f,ct,x):

number

[0057] accuracy First, we,

number

number

[0058] Next, from the accuracy of the underlying scheme, we can see the following:

number

[0059] Simulator We will begin by explaining the simulator.

[0060]

number

number

number

[0061] Enc * (msk * 0, x * ):

number

number

[0062] KeyGen * (msk * ,x * ,f,[μ]2):

number

[0063] Partially Secure Function Encryption (PHFE) for Linear Functions Herein, what is disclosed is a class parameterized by matrix [M]2.

number

[0064] Partial Garbling Scheme

number

number

number

number

number

[0065] Lemma 1 (Partial Garbling) There are four efficient algorithms (lgen, pgb, rec, pgb*) that have the following characteristics.

[0066] (Syntax) Input [Number] For, lgen(f) outputs [Number] and [Number] is. Here, [Number] is, and [Number] consists of the last n' entries in t, and m, t are linear in the size of f.

[0067] (Reconstruction) rec(f, x) outputs [Number] and as a result, for all of f, x, z, t, [Number] is, where p f,x,z = pgb(f, x, z; t).

[0068] (Privacy) For all of f, x, z [Number] it holds that, where [Number] <00​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​Sample this, and then,

number

[0072] KeyGen(msk,(f,[M]2)):

number

number

number

number

number

[0073] Dec((sk f,M ,(f,[M]2)),(ct x,z ,x)): The input key is,

number

number

number

number

number

number

[0074] accuracy ct x,z and sk f,M Regarding this, we

number

number

number

[0075] Here, equation (11) is,

number

number

number

[0076] Simulator Setup(p,1 n ,1 n’1 ,1 n’2 ):

number

number

number

number

number

number

[0077] Enc * (msk * ,x * ):

number

[0078] KeyGen * (msk * ,x* ,(f,[M]2),[μ]2):

number

[0079]

number

number

number

number

[0080] Here,

number

number

[0081] A specific scheme for quadratic functions

number

number

[0082] This scheme is SA-SIM secure under bidirectional k-linear and k'-linear assumptions in G1 and G2. For the most efficient and concrete instantiation (see Figure 1), we set k=2 and k'=1.

[0083] Setup(p,1 n1 ,1 n2 ):

number

number

number

[0084] Enc(mpk,(z1,z2)):

number

number

[0085] KeyGen(msk,f):

number

number

[0086] System implementation Referring to Figure 1, one exemplary system architecture is shown. User (215) has token T F By issuing a command, the remote server (210) is enabled to perform a specific function F on the ciphertext. The server performs F on the available ciphertext C and the result R in encrypted form. F The system generates tokens T for the requested function. F This could include a trusted agency (TA)(220) responsible for establishing it.

[0087] As shown in the diagram, the data owner (205) uploads the ciphertext C to the remote server (210). The data user (215) requests a token for function (F) from TA (220). TA (220) provides the token T F Issue to the data user. The data user then T F The data is sent to the server. The server performs F on the encrypted data, and the result R F Transfer it to the data user.

[0088] Figure 2 shows,

number

number

[0089] This scheme is SA-SIM secure under bidirectional k-linear and k'-linear assumptions in G1 and G2. For the most efficient concrete instantiation (see Figure 1), we set k=2 and k'-=1.

[0090] Figures 3 and 4 show exemplary computer systems useful for implementing the various embodiments described herein. The various embodiments may be implemented using one or more computer systems, such as the computer system 500 shown in Figure 3. One or more computer systems 500 may be used, for example, to implement any of the embodiments described herein, as well as combinations and partial combinations thereof.

[0091] The computer system 500 may include one or more processors (also called central processing units, processors, or CPUs), such as a processor 504. The processor 504 may be connected to a communication infrastructure 506 (for example, a bus).

[0092] The computer system 500 may also include user input / output devices 503, such as a monitor, keyboard, and pointing device. These can communicate with a communication infrastructure 506 via a user input / output interface 502. One or more of the processors 504 may be graphics processing units (GPUs). In one embodiment, a GPU may be a processor that is a dedicated electronic circuit designed to process mathematically intensive applications. A GPU may have a parallel structure that is efficient for parallel processing of large blocks of data, such as mathematically aggregated data common to computer graphics applications, images, videos, etc.

[0093] The computer system 500 may also include main memory 508, such as random access memory (RAM). Main memory 508 may include one or more levels of cache. Main memory 508 may have control logic (i.e., computer software, instructions, etc.) and / or data stored therein. The computer system 500 may also include one or more secondary storage devices or secondary memory 510. Secondary memory 510 may include, for example, a hard disk drive 512 and / or a removable storage device, or a removable storage drive 514. The removable storage drive 514 may interact with a removable storage unit 518. The removable storage unit 518 may include a computer-usable or readable storage device having computer software (control logic) and / or data stored therein. The removable storage drive 514 can read from and / or write to the removable storage unit 518.

[0094] The secondary memory 510 may include other means, devices, components, mediators, or other techniques for enabling computer programs, and / or other instructions, and / or data to be accessed by the computer system 500. Such means, devices, components, mediators, or other approaches may include, for example, a removable storage unit 522 and interface 520. An exemplary removable storage unit 522 and interface 520 may include a program cartridge and cartridge interface, a removable memory chip (such as an EPROM or PROM) and associated socket, a memory stick and USB port, a memory card and associated memory card slot, and / or any other removable storage unit and associated interface.

[0095] The computer system 500 may further include a communication interface 524 (e.g., a network interface). The communication interface 524 can enable the computer system 500 to communicate and interact with any combination of external devices, external networks, external entities, etc. (individually and collectively referred to as remote devices, networks, entities 528). For example, the communication interface 524 can enable the computer system 500 to communicate with external or remote devices, networks, entities 528 via a communication path 526. These may be wired and / or wireless (or a combination thereof) and may include any combination of LAN, WAN, Internet, etc. Control logic and / or data may be transmitted to or from the computer system 500 via the communication path 526.

[0096] Computer system 500 may also be, to give some non-limiting examples, a personal digital assistant (PDA), a desktop workstation, a laptop or notebook computer, a netbook, a tablet, a smartphone, a smartwatch or other wearable device, an appliance, part of the Internet of Things, and / or an embedded system, or any combination thereof.

[0097] Computer system 500 may be a client or server computing device that accesses or hosts any application and / or data via any delivery paradigm. It may also include, but is not limited to, remote or distributed cloud computing solutions, local or on-premises software ("on-premise" cloud-based solutions), and "as a service" models. (For example, Content as a Service (CaaS), Digital Content as a Service (DCaaS), Software as a Service (SaaS), Managed Software as a Service (MSaaS), Platform as a Service (PaaS), Desktop as a Service (DaaS), Framework as a Service (FaaS), Backend as a Service (BaaS), Mobile Backend as a Service (MBaaS), Infrastructure as a Service (IaaS), etc.), and / or hybrid models that include the aforementioned examples or any combination of other service or delivery paradigms.

[0098] Figure 4 shows an exemplary machine of computer system 900, in which an instruction set can be executed to cause the machine to perform any one or more of the operations described herein. In alternative implementations, the machine may be connected to other machines on a LAN, intranet, extranet, and / or the Internet (e.g., network connection). The machine may operate as a peer machine in a peer-to-peer (or distributed) network environment, or as a server or client machine in a cloud computing infrastructure or environment, with the capabilities of a server or client machine in a client-server network environment.

[0099] A machine can be a personal computer (PC), tablet PC, set-top box (STB), personal digital assistant (PDA), mobile phone, web appliance, server, network router, switch or bridge, dedicated application or network security appliance or device, or any machine capable of executing a set of instructions (sequentially or otherwise) that specifies the actions to be performed by that machine. Furthermore, although a single machine is given as an example, the term “machine” is to be interpreted as also including any set of machines that individually or collectively execute a set of instructions (or sets of instructions) to perform any one or more of the methods described herein.

[0100] An exemplary computer system 900 includes a processing unit 902, main memory 904 (e.g., read-only memory (ROM), flash memory, dynamic random access memory (DRAM) such as synchronous DRAM (SDRAM), etc.), static memory 906 (e.g., flash memory, static random access memory (SRAM), etc.), and a data storage device 918, which communicate with each other via a bus 930.

[0101] The processing unit 902 represents one or more processing units, such as a microprocessor or a central processing unit. More specifically, the processing unit may be a composite instruction set computing (CISC) microprocessor, a reduced instruction set computing (RISC) microprocessor, a very long instruction word (VLIW) microprocessor, or a processor implementing another instruction set, or a processor implementing a combination of instruction sets. The processing unit 902 may also be one or more dedicated processing units, such as an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), a digital signal processor (DSP), or a network processor. The processing unit 902 is configured to execute instructions 926 for performing the operations and steps described herein.

[0102] The computer system 900 may further include a network interface device 908 for communication via a network 920. The computer system 900 may also include a video display unit 910, an alphanumeric input device 912 (e.g., a keyboard), a cursor control device 914 (e.g., a mouse), a graphics processing unit 922, a signal generation device 916 (e.g., a speaker), another graphics processing unit 922, a video processing unit 928, and an audio processing unit 932.

[0103] The data storage device 918 may include a machine-readable medium 924 (also known as a computer-readable storage medium) which stores one or more sets of instructions 926 (e.g., software instructions) that embody one or more of the operations described herein. The instructions 926 may also be present, in whole or at least in part, in the main memory 904 and / or the processing unit 902 during their execution by the computer system 900, where the main memory 904 and the processing unit 902 also constitute the machine-readable storage medium.

[0104] In one example, instruction 926 includes instructions for implementing operations and functions corresponding to the disclosed subject matter. Although the machine-readable storage medium 924 is shown as a single medium in the exemplary implementation, the term “machine-readable storage medium” should be interpreted to include a single medium or multiple mediums (e.g., a centralized or distributed database, and / or associated caches and servers) that store one or more sets of instructions 926. The term “machine-readable storage medium” should also be interpreted to include any medium capable of storing or encoding sets of instructions 926 for machine execution and causing a machine to perform any one or more of the operations of the Disclosed. Accordingly, the term “machine-readable storage medium” should be interpreted to include, but is not limited to, solid-state memory, optical media, and magnetic media.

[0105] Some parts of the detailed description are presented with respect to algorithms and symbolic representations of operations on data bits in computer memory. These descriptions and representations of algorithms are the methods used by those skilled in the field of data processing to most effectively communicate the substance of their work to others skilled in the field. An algorithm is considered here, or in general, to be a consistent set of actions that produce a desired result. Actions require the physical manipulation of physical quantities. Often, though not essential, these quantities take the form of electrical or magnetic signals that can be stored, combined, compared, and otherwise manipulated. It has sometimes proven convenient, primarily for common use, to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, etc.

[0106] However, it should be noted that all of these terms and similar terms should be associated with appropriate physical quantities and are merely convenient labels applied to those quantities. As is clear from the above explanation, unless otherwise specified, explanations using terms such as “identifying”, “determining”, “executing”, “performing”, “collecting”, “creating”, or “sending”, should be understood to refer to the operation and process of a computer system or similar electronic computing device that manipulates and converts data represented as physical (electronic) quantities in the registers and memory of a computer system into other data similarly represented as physical quantities in the memory or registers of a computer system, or other such information storage devices.

[0107] This disclosure also relates to apparatus for performing the operations described herein. Such apparatus may include a computer that is specifically constructed for the intended purpose or that is selectively operated or reconfigured by computer programs stored on the computer. Such computer programs may be stored on computer-readable storage media, each coupled to a computer system bus. These include, but are not limited to, any type of disk, including floppy disks, optical disks, CD-ROMs, and magneto-optical disks, read-only memory (ROM), random access memory (RAM), EPROM, EEPROM, magnetic or optical cards, or any type of medium suitable for storing electronic instructions.

[0108] The operations and descriptions presented herein are not inherently related to any particular computer or other device. Various types of systems may be used with the programs according to the teachings herein, or it may be advantageous to construct more specialized devices to perform the operations. The structures of various such systems will be revealed in the descriptions herein. In addition, this disclosure is not described with reference to any particular programming language. It will be understood that various programming languages ​​may be used to implement the teachings of this disclosure described herein.

[0109] This disclosure may be provided as a computer program product or software, which may include a machine-readable medium on which instructions are stored. The instructions may be used to program a computer system (or other electronic device) to perform a process in accordance with this disclosure. The machine-readable medium includes any mechanism for storing information in a form readable by a machine (e.g., a computer). For example, machine-readable (e.g., computer-readable) medium includes machine (e.g., computer)-readable storage media such as read-only memory ("ROM"), random-access memory ("RAM"), magnetic disk storage media, optical storage media, and flash memory devices.

[0110] In some embodiments, a tangible, non-temporary device or product comprising a tangible, non-temporary computer-usable or readable medium on which control logic (software) is stored may also be referred to herein as a computer program product or program storage device. This includes, but is not limited to, a computer system 500, main memory 508, secondary memory 510, and removable storage units 518 and 522, as well as tangible products embodying any combination thereof. When such control logic is executed by one or more data processing devices (such as computer system 500), such data processing devices can be made to operate as described herein.

[0111] Based on the teachings contained herein, it will be apparent to those skilled in the art how embodiments of this disclosure may be created and used using data processing devices, computer systems, and / or computer architectures other than those shown in Figures 3 and 4. In particular, embodiments may operate using software, hardware, and / or operating system implementations other than those described herein.

[0112] It will be understood that the section of detailed description, and not the other sections, is intended to be used to interpret the claims. The other sections may reveal one or more, but not all, exemplary embodiments that the inventors may conceive, and are therefore not intended in any way to limit the claims of this disclosure or appendix.

[0113] This disclosure describes exemplary embodiments in exemplary fields and applications, but it should be understood that this disclosure is not limited thereto. Other embodiments and modifications thereof are possible and fall within the spirit and scope of this disclosure. For example, without limiting the generality of this paragraph, embodiments are not limited to the software, hardware, firmware, and / or entities described in the figures described herein. Furthermore, embodiments (whether expressly described herein or otherwise) have significant utility in fields and applications beyond the embodiments described herein.

[0114] Embodiments have been described herein using functional building blocks that describe the implementation of specified functions and their relationships. The boundaries of these functional building blocks have been arbitrarily defined herein for the sake of explanation. Alternative boundaries can be defined, as long as the specified functions and relationships (or their equivalents) are performed appropriately. Furthermore, alternative embodiments may execute the functional blocks, steps, operations, methods, etc., in a different order than that described herein.

[0115] The references herein to “one embodiment,” “an embodiment,” “an example embodiment,” or similar phrases indicate that the embodiments described may include certain features, structures, or characteristics, but not all embodiments necessarily include such features, structures, or characteristics. Furthermore, such phrases do not necessarily refer to the same embodiments. Moreover, if certain features, structures, or characteristics are described in relation to an embodiment, it would be within the knowledge of those skilled in the art to incorporate such features, structures, or characteristics into other embodiments, whether or not they are explicitly mentioned or described herein. In addition, some embodiments may be described using the expressions “coupled” and “connected,” along with their derivatives. These terms are not necessarily intended to be synonymous with each other. For example, some embodiments may be described using the terms “connected” and / or “coupled” to indicate that two or more elements are in direct physical or electrical contact with each other. However, the term "combined" can also mean that two or more elements do not directly touch each other, but still cooperate or interact with each other.

[0116] The breadth and scope of this disclosure should not be limited by any of the exemplary embodiments described above, but should be defined only in accordance with the subsequent claims and their equivalents. The above specification has described implementations of the disclosure with reference to specific exemplary implementations. It will be apparent that various modifications can be made thereto without departing from the broader spirit and scope of implementations of the disclosure as revealed in the subsequent claims. This specification and the drawings should therefore be considered illustrative, not restrictive.

Claims

1. A computerized method for protecting the calculation of quadratic polynomials by functional encryption, The steps include: running a computerized setup algorithm that outputs a public key and a master private key; The steps include: executing a computerized key generation algorithm that receives the master secret key and a quadratic polynomial f, and outputs a secret key, wherein the quadratic polynomial f is a quadratic function; and The first computerized processor executes an encryption algorithm that receives the public key and the electronic message. The electronic message includes two vectors z1 and z2, both of length n, and outputs a ciphertext. A second computerized processor located remotely from the first computerized processor receives the ciphertext and the secret key via an electronic communication network, and executes a decryption algorithm that outputs a decrypted value that is the same as the value obtained by evaluating the quadratic polynomial f in vectors z1 and z2 based on the ciphertext and the secret key. The steps include transmitting the decoded value to the first computerized processor, The encryption algorithm and the decryption algorithm are based on the bidirectional k-linear assumption that no computationally efficient process learns anything with respect to z1, z2 beyond the evaluation of the quadratic polynomial f. The aforementioned encryption algorithm further, Step 1 is to execute the ElGamal scheme's encryption algorithm, where the input z1 to the ElGamal scheme includes the public key w1 and randomness s1, resulting in the ciphertext y1. The step of executing the encryption algorithm of the ElGamal scheme, wherein the input to the ElGamal scheme includes a public key w2 and randomness s2, resulting in a ciphertext y2. A step of executing a linear polynomial scheme encryption algorithm, wherein the input to the linear polynomial scheme includes a public key w0 and a vector, the vector includes the concatenation of s1 × z2 and y1 × s2, and the result is a ciphertext y0. The steps include generating output y1, y2, and y0 as the ciphertext, including, method.

2. A computerized method for protecting the calculation of a quadratic polynomial by functional encryption, The steps include: running a computerized setup algorithm that outputs a public key and a master private key; The steps include: executing a computerized key generation algorithm that receives the master secret key and a quadratic polynomial f, and outputs a secret key, wherein the quadratic polynomial f is a quadratic function; and The first computerized processor executes an encryption algorithm that receives the public key and the electronic message. The electronic message includes two vectors z1 and z2, both of length n, and outputs a ciphertext. A second computerized processor located remotely from the first computerized processor receives the ciphertext and the secret key via an electronic communication network, and executes a decryption algorithm that outputs a decrypted value that is the same as the value obtained by evaluating the quadratic polynomial f in vectors z1 and z2 based on the ciphertext and the secret key. The steps include transmitting the decoded value to the first computerized processor, The encryption algorithm and the decryption algorithm are based on the bidirectional k-linear assumption that no computationally efficient process learns anything with respect to z1, z2 beyond the evaluation of the quadratic polynomial f. The aforementioned decoding algorithm further includes, The step of receiving the ciphertext, The steps include parsing the aforementioned ciphertext into specified components y1, y2, and y0, The steps include receiving a private key sk, where the private key sk is generated by a linear polynomial scheme, and The first step is to compute a quadratic polynomial f for components y1 and y2, resulting in the value v1. The first step is to decode y0 using sk with the aforementioned linear polynomial scheme decoding algorithm, thereby producing the decoded value v0. The steps include generating outputs v1-v0 as the decoded values, including, method.

3. The aforementioned computerized setup algorithm further includes: This step involves executing the ElGamal scheme setup algorithm twice to generate public keys w1 and w2, and private keys sk1 and sk2. The first step is to execute the setup algorithm for a functional cryptographic scheme for a linear polynomial scheme, resulting in a public key w0 and a master private key msk0. The steps include generating output w1, w2, and w0 as the public keys, and generating msk0 as the master private key, The method according to claim 1 or 2, including the method according to claim 1 or 2.

4. The aforementioned computerized key generation algorithm is: Execute a key generation algorithm with a linear polynomial scheme, The input to the aforementioned linear polynomial scheme includes the master secret key msk0 and a linear polynomial derived from f, w1, and w2, which in turn produce the secret key sk. The step of generating output sk as the aforementioned secret key is performed. The method according to claim 1 or 2.

5. The aforementioned quadratic polynomial f is a privacy-preserving machine learning function executed in a neural network using a quadratic activation function, or, The quadratic polynomial f is a quadratic function and is selected from one or more statistical functions or correlation functions. The method according to claim 1 or 2.

6. The method further includes the step of applying the polynomial of the quadratic polynomial f to the projection vector, The method according to claim 1 or 2.

7. The aforementioned electronic messages are configured and stored as a relational database. The relational database is logically structured in a data model compatible with the operations performed by the specified function. The aforementioned secret key defines a subset of data in the relational database, The decoding algorithm executes the specified function on a subset of the data. The method according to claim 1 or 2.

8. A computerized system for protecting the computation of quadratic polynomials by functional encryption, wherein this system One or more computerized processors, A setup algorithm that outputs a public key and a master private key, and A key generation algorithm that receives the master secret key and a quadratic polynomial f, and outputs a secret key. A computerized processor is configured to perform the following, where the quadratic polynomial f is a quadratic function, It is a computerized cryptographic processor, It is configured to execute an encryption algorithm that receives the aforementioned public key and electronic message, The electronic message includes two vectors z1 and z2, both of length n, and outputs a ciphertext. Cryptographic processor, It is a computerized decoding processor, Located remotely from the aforementioned computerized cryptographic processor, The ciphertext and the secret key are received via an electronic communication network. A decryption algorithm is executed that outputs a decrypted value that is the same as the value obtained by evaluating the quadratic polynomial f in vectors z1 and z2, based on the ciphertext and the secret key, and The decoded value is transmitted to the first computerized processor. A computerized decoding processor configured as follows, The encryption algorithm and the decryption algorithm are based on the bidirectional k-linear assumption that no computationally efficient process learns anything with respect to z1, z2 beyond the evaluation of the quadratic polynomial f. The aforementioned setup algorithm further, This step involves executing the ElGamal scheme setup algorithm twice to generate public keys w1 and w2, and private keys sk1 and sk2. The first step is to execute the setup algorithm for a functional cryptographic scheme for a linear polynomial scheme, resulting in a public key w0 and a master private key msk0. The steps include generating output w1, w2, and w0 as the public keys, and generating msk0 as the master private key, including, system.

9. A computerized system for protecting the computation of quadratic polynomials by functional encryption, wherein the system: One or more computerized processors, A setup algorithm that outputs a public key and a master private key, and A key generation algorithm that receives the master secret key and a quadratic polynomial f, and outputs a secret key. A computerized processor is configured to perform the following, where the quadratic polynomial f is a quadratic function, It is a computerized cryptographic processor, It is configured to execute an encryption algorithm that receives the aforementioned public key and electronic message, The electronic message includes two vectors z1 and z2, both of length n, and outputs a ciphertext. Cryptographic processor, It is a computerized decoding processor, Located remotely from the aforementioned computerized cryptographic processor, The ciphertext and the secret key are received via an electronic communication network. A decryption algorithm is executed that outputs a decrypted value that is the same as the value obtained by evaluating the quadratic polynomial f in vectors z1 and z2, based on the ciphertext and the secret key, and The decoded value is transmitted to the first computerized processor. A computerized decoding processor configured as follows, The encryption algorithm and the decryption algorithm are based on the bidirectional k-linear assumption that no computationally efficient process learns anything with respect to z1, z2 beyond the evaluation of the quadratic polynomial f. The aforementioned encryption algorithm further, Step 1 is to execute the ElGamal scheme's encryption algorithm, where the input z1 to the ElGamal scheme includes the public key w1 and randomness s1, resulting in the ciphertext y1. The step of executing the encryption algorithm of the ElGamal scheme, wherein the input to the ElGamal scheme includes a public key w2 and randomness s2, resulting in a ciphertext y2. A step of executing a linear polynomial scheme encryption algorithm, wherein the input to the linear polynomial scheme includes a public key w0 and a vector, the vector includes the concatenation of s1 × z2 and y1 × s2, and the result is a ciphertext y0. The steps include generating output y1, y2, and y0 as the ciphertext, including, system.

10. A computerized system for protecting the computation of quadratic polynomials by functional encryption, wherein the system: One or more computerized processors, A setup algorithm that outputs a public key and a master private key, and A key generation algorithm that receives the master secret key and a quadratic polynomial f, and outputs a secret key. A computerized processor is configured to perform the following, where the quadratic polynomial f is a quadratic function, It is a computerized cryptographic processor, It is configured to execute an encryption algorithm that receives the aforementioned public key and electronic message, The electronic message includes two vectors z1 and z2, both of length n, and outputs a ciphertext. Cryptographic processor, It is a computerized decoding processor, Located remotely from the aforementioned computerized cryptographic processor, The ciphertext and the secret key are received via an electronic communication network. A decryption algorithm is executed that outputs a decrypted value that is the same as the value obtained by evaluating the quadratic polynomial f in vectors z1 and z2, based on the ciphertext and the secret key, and The decoded value is transmitted to the first computerized processor. A computerized decoding processor configured as follows, The encryption algorithm and the decryption algorithm are based on the bidirectional k-linear assumption that no computationally efficient process learns anything with respect to z1, z2 beyond the evaluation of the quadratic polynomial f. The key generation algorithm is, The key generation algorithm of the linear polynomial scheme is executed, The input to the aforementioned linear polynomial scheme includes the master secret key msk0 and a linear polynomial derived from f, w1, and w2, which in turn produce the secret key sk. The step of generating output sk as the aforementioned secret key is performed. system.

11. A computerized system for protecting the computation of a quadratic polynomial by functional encryption, wherein the system: One or more computerized processors, A setup algorithm that outputs a public key and a master private key, and A key generation algorithm that receives the master secret key and a quadratic polynomial f, and outputs a secret key. A computerized processor is configured to perform the following, where the quadratic polynomial f is a quadratic function, It is a computerized cryptographic processor, It is configured to execute an encryption algorithm that receives the aforementioned public key and electronic message, The electronic message includes two vectors z1 and z2, both of length n, and outputs a ciphertext. Cryptographic processor, It is a computerized decoding processor, Located remotely from the aforementioned computerized cryptographic processor, The ciphertext and the secret key are received via an electronic communication network. A decryption algorithm is executed that outputs a decrypted value that is the same as the value obtained by evaluating the quadratic polynomial f in vectors z1 and z2, based on the ciphertext and the secret key, and The decoded value is transmitted to the first computerized processor. A computerized decoding processor configured as follows, The encryption algorithm and the decryption algorithm are based on the bidirectional k-linear assumption that no computationally efficient process learns anything with respect to z1, z2 beyond the evaluation of the quadratic polynomial f. The aforementioned decoding algorithm further includes, The step of receiving the ciphertext, The steps include parsing the aforementioned ciphertext into specified components y1, y2, and y0, The steps include receiving a private key sk, where the private key sk is generated by a linear polynomial scheme, and The first step is to compute a quadratic polynomial f for components y1 and y2, resulting in the value v1. The first step is to decode y0 using sk with the aforementioned linear polynomial scheme decoding algorithm, thereby producing the decoded value v0. The steps include generating outputs v1-v0 as the decoded values, including, system.

12. The aforementioned quadratic polynomial f is a privacy-preserving machine learning function executed in a neural network using a quadratic activation function, or, The quadratic polynomial f is a quadratic function and is selected from one or more statistical functions or correlation functions. The system according to any one of claims 8 to 11.

13. The system further includes applying the polynomial of the quadratic polynomial f to the projection vector, The system according to any one of claims 8 to 11.

14. The aforementioned electronic messages are configured and stored as a relational database. The relational database is logically structured in a data model compatible with the operations performed by the specified function. The aforementioned secret key defines a subset of data in the relational database, The decoding algorithm executes the specified function on a subset of the data. The system according to any one of claims 8 to 11.

Images