User-level homomorphic encryption management method and apparatus

Abstract

Provided in the present application are a user-level homomorphic encryption management method and apparatus. In the method, a terminal or a network apparatus can take homomorphic security capabilities of a terminal side and a network side into comprehensive consideration, so as to determine a homomorphic encryption algorithm, which facilitates the terminal in providing a user-level high privacy protection strength; and a user-level homomorphic key can be determined on the basis of the homomorphic encryption algorithm, thereby realizing user-level key management.

Description

User-level homomorphic encryption management method and device Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a user-level homomorphic encryption management method and device. Background Art

[0002] Homomorphic encryption (HE) is an encryption scheme that can directly operate on ciphertext. Homomorphic encryption is based on basic encryption and adds the function of homomorphic calculation under ciphertext. In addition, the calculation result obtained after decrypting the ciphertext calculation result is consistent with the calculation result based on the plaintext. For example, in a homomorphic encryption task, there can be one or more homomorphic encryptors to encrypt data from different sources based on the homomorphic encryption key, and there can also be one or more homomorphic calculators to perform homomorphic calculations based on the homomorphic calculation key. In a homomorphic encryption task, there can also be one or more homomorphic decryptors to decrypt the homomorphically calculated data based on the homomorphic decryption key, and the decrypted result can be provided to one or more data users, where the homomorphic decryptor and the data user can be the same or different entities. Therefore, for multiple homomorphic requesters / calculators / decryptors, how to manage the homomorphic keys of one or more parties becomes a problem to be solved.

[0003] Summary of the Invention

[0004] This application provides a user-level homomorphic encryption management method and device, which can provide high user-level privacy protection strength. In addition, the ciphertext data has good reusability, and the user-level homomorphically encrypted data can be circulated and homomorphically calculated in different homomorphic encryption tasks.

[0005] In the first aspect, the present application provides a user-level homomorphic encryption management method, which is executed by a terminal. The terminal can be a terminal device, or a component of a terminal device (such as a processor, chip, or chip system, etc.), and can also be a logic module that can implement all or part of the terminal device functions. The terminal receives the homomorphic security capability of the network side; based on the homomorphic security capability of the terminal and the homomorphic security capability of the network side, the homomorphic encryption algorithm is determined. The terminal sends a homomorphic encryption algorithm identifier.

[0006] In this method, the terminal can receive the homomorphic security capabilities of the network side, and thus comprehensively consider the homomorphic security capabilities of the terminal side and the network side to determine the homomorphic encryption algorithm, which is conducive to the terminal providing user-level high privacy protection strength.

[0007] In one possible implementation, the homomorphic security capability on the network side is carried in the security mode command, and the homomorphic encryption algorithm is carried in the security mode completion message.

[0008] In this method, the homomorphic security capabilities and homomorphic encryption algorithms on the network side can be carried in the corresponding security signaling, which is conducive to further determining the appropriate homomorphic encryption algorithm to improve the privacy protection strength.

[0009] In the second aspect, the present application provides a user-level homomorphic encryption management method, which is executed by a terminal. The terminal can be a terminal device, or a component of a terminal device (such as a processor, chip, or chip system, etc.), and can also be implemented by a logic module that can realize all or part of the terminal device functions. The terminal sends the homomorphic security capability of the terminal; receives a homomorphic encryption algorithm identifier, and the homomorphic encryption algorithm is determined by the network side based on the homomorphic security capability of the terminal and the homomorphic security capability of the network side.

[0010] In this method, the terminal can send its own homomorphic security capabilities to the network side. The network side will comprehensively consider the homomorphic security capabilities of the terminal side and the network side to determine the homomorphic encryption algorithm, and feedback the homomorphic encryption algorithm to the terminal, which is conducive to the terminal providing user-level high privacy protection strength.

[0011] In a possible implementation, the homomorphic security capability of the terminal is carried in a security mode completion message.

[0012] In this method, the homomorphic security capabilities of the terminal can be carried in the corresponding security signaling, which is beneficial for the terminal to further improve the privacy protection strength.

[0013] The method described in the first or second aspect above also includes the following possible implementations:

[0014] In one possible implementation, the terminal determines a homomorphic encryption key and / or a homomorphic decryption key based on a homomorphic encryption algorithm, wherein the homomorphic encryption key is used to encrypt a plaintext message into a first ciphertext, and the homomorphic decryption key is used to decrypt a second ciphertext into a plaintext message.

[0015] In this method, since the homomorphic encryption algorithm comprehensively considers the homomorphic security capabilities of the terminal side and the network side, the user-level homomorphic key determined based on the homomorphic encryption algorithm is independent of the homomorphic encryption task and is only related to the homomorphic enabling node (such as the homomorphic encryptor / homomorphic decryptor), which is conducive to improving the reusability of the homomorphic key. In addition, it is conducive to the circulation and homomorphic calculation of ciphertext data generated based on the homomorphic key in different homomorphic encryption tasks; for example, the same ciphertext data can be provided to different network elements, base stations, terminals, APP services, etc., for different types of ciphertext calculations.

[0016] In one possible implementation, after the homomorphic encryption task is created, the terminal receives a homomorphic computation key, which is used by one or more homomorphic computing parties in the homomorphic encryption task to perform homomorphic computation on the first ciphertext to output a second ciphertext.

[0017] In one possible implementation, the lifecycle of the homomorphic computing key is the duration of the homomorphic encryption task.

[0018] In the above method, the homomorphic computation key is associated with the homomorphic encryption task. For example, after the homomorphic encryption task is created, the homomorphic computation key is derived. The homomorphic computation key is valid for the duration of the homomorphic encryption task and becomes invalid when the homomorphic encryption task ends.

[0019] In one possible implementation, a terminal receives first indication information, the first indication information being used to instruct destruction of a homomorphic key, where the homomorphic key is a homomorphic encryption key, a homomorphic decryption key, or a homomorphic computation key. The terminal destroys the homomorphic key.

[0020] In this method, the terminal can destroy the homomorphic encryption key, the homomorphic decryption key, or the homomorphic computing key according to the first indication information.

[0021] In one possible implementation, the lifecycle of the homomorphic encryption key or the homomorphic decryption key is within the time between the success of the user's radio resource control RRC connection and the completion of the release; wherein the user is the homomorphic encryption party or the homomorphic decryption party. The first indication information is carried in the RRC release signaling.

[0022] In this method, the homomorphic encryption key or homomorphic decryption key is decoupled from the homomorphic encryption task, and the lifecycle of the homomorphic encryption key or homomorphic decryption key is within the time period between the successful establishment of the user's RRC connection and the destruction of the homomorphic key. Optionally, the terminal can receive RRC release signaling, which carries first indication information indicating the destruction of the homomorphic key.

[0023] In one possible implementation, the terminal receives second indication information, where the second indication information is used to instruct updating of a homomorphic key, wherein the homomorphic key is a homomorphic encryption key, a homomorphic decryption key, or a homomorphic computation key. The terminal updates the homomorphic key.

[0024] In this method, the terminal can update the homomorphic key according to the second indication information.

[0025] In one possible implementation, the terminal stores the first ciphertext and its corresponding key information, and / or the second ciphertext and its corresponding key information. The key information includes one or more of a homomorphic encryption key, a homomorphic decryption key, a homomorphic computation key, a key derivation parameter, and a security context.

[0026] In this method, the terminal can store ciphertext data and corresponding homomorphic encryption keys, homomorphic decryption keys, homomorphic computation keys, key derivation parameters, security context and other information, making the ciphertext data reusable and allowing user-level homomorphic encryption data to flow and perform homomorphic computations in different homomorphic encryption tasks.

[0027] In one possible implementation, the homomorphic security capability of the network side, or the homomorphic security capability of the terminal, or the homomorphic encryption algorithm, or the first indication information, or the second indication information is carried in signaling with encryption and integrity protection; wherein the signaling includes radio resource control RRC signaling and / or non-access stratum NAS signaling with integrity protection.

[0028] In this method, the homomorphic security capabilities of the network side or the terminal and the related first indication information or second indication information can be encrypted and integrity protected, which is beneficial to transmission security protection and prevents attackers from eavesdropping, counterfeiting, or tampering with this information.

[0029] In one possible implementation, the terminal determines a homomorphic encryption key or a homomorphic decryption key based on the superior key and the homomorphic encryption algorithm information; uses the homomorphic encryption key to encrypt the plaintext message into the first ciphertext, or uses the homomorphic decryption key to decrypt the second ciphertext into the plaintext message.

[0030] In this method, a user-level key architecture and management scheme for homomorphic encryption is designed to adapt to the key architecture and management of existing cellular networks. For example, the terminal can derive homomorphic keys based on the USIM symmetric key architecture or the KMC independent key architecture (the above symmetric key architecture or independent key architecture derives related keys based on the superior key) and homomorphic encryption algorithm information, thereby realizing the user-level key architecture and management of homomorphic encryption.

[0031] In one possible implementation, the terminal determines a homomorphic computation key based on a homomorphic encryption key or a homomorphic decryption key, wherein the homomorphic computation key is used by the homomorphic computing party to perform homomorphic computation on the first ciphertext to output the second ciphertext. The terminal sends the homomorphic computation key.

[0032] In this method, the terminal can derive homomorphic computing keys under the USIM symmetric key architecture or KMC independent key architecture, realizing the user-level key architecture and management of homomorphic encryption.

[0033] On the third aspect, the present application provides a user-level homomorphic encryption management method, which is performed by a first entity. The first entity can be an access network device or a network entity (such as a core network element or a functional network element), or a component of an access network device or a network entity (such as a processor, a chip, or a chip system, etc.), or a logical module that can implement all or part of the access network device or network entity. The first entity sends the homomorphic security capability of the network side; receives a homomorphic encryption algorithm identifier, and the homomorphic encryption algorithm is determined by the terminal based on the homomorphic security capability of the terminal and the homomorphic security capability of the network side.

[0034] In this method, the first entity can send its own homomorphic security capabilities to the terminal, and the terminal will comprehensively consider the homomorphic security capabilities of the terminal side and the network side to determine the homomorphic encryption algorithm, and feedback the homomorphic encryption algorithm to the first entity, which is conducive to providing user-level high privacy protection strength on the network side.

[0035] In one possible implementation, the homomorphic security capability on the network side is carried in the security mode command, and the homomorphic encryption algorithm is carried in the security mode completion message.

[0036] In this method, the homomorphic security capabilities and homomorphic encryption algorithms on the network side can be carried in the corresponding security signaling, which is beneficial for the first entity to provide user-level high privacy protection strength.

[0037] In a fourth aspect, the present application provides a user-level homomorphic encryption management method, which is performed by a first entity. The first entity may be an access network device or a network entity (such as a core network element or a functional network element), or a component of an access network device or a network entity (such as a processor, a chip, or a chip system, etc.), or a logical module that can implement all or part of an access network device or a network entity. The first entity receives the homomorphic security capability of the terminal and determines the homomorphic encryption algorithm based on the homomorphic security capability of the terminal and the homomorphic security capability of the network side. The first entity sends a homomorphic encryption algorithm identifier.

[0038] In this method, the first entity can receive the homomorphic security capabilities of the terminal, and thereby comprehensively consider the homomorphic security capabilities of the terminal side and the network side to determine the homomorphic encryption algorithm, which is beneficial for the first entity to provide user-level high privacy protection strength.

[0039] In a possible implementation, the homomorphic security capability of the terminal is carried in a security mode completion message.

[0040] In this method, the homomorphic security capability of the terminal can be carried in the corresponding security signaling, which is beneficial for the first entity to provide user-level high privacy protection strength.

[0041] The method described in the third or fourth aspect above also includes the following possible implementations:

[0042] In one possible implementation, the first entity determines a homomorphic encryption key and / or a homomorphic decryption key based on a homomorphic encryption algorithm, wherein the homomorphic encryption key is used to encrypt a plaintext message into a first ciphertext, and the homomorphic decryption key is used to decrypt a second ciphertext into a plaintext message.

[0043] In this method, because the homomorphic encryption algorithm comprehensively considers the homomorphic security capabilities of both the terminal and network sides, the user-level homomorphic key determined based on this homomorphic encryption algorithm is independent of the homomorphic encryption task and is only related to the homomorphic enabling node (such as the homomorphic encryptor / homomorphic decryptor), which helps improve the reusability of the homomorphic key. Furthermore, it facilitates the circulation of ciphertext data generated based on the homomorphic key in different homomorphic encryption tasks and the performance of homomorphic computations; for example, the same ciphertext data can be provided to different network elements, base stations, terminals, app services, etc., for different types of ciphertext computations.

[0044] In one possible implementation, after a homomorphic encryption task is created, the first entity determines a homomorphic computation key. The homomorphic computation key is used by one or more homomorphic computation parties in the homomorphic encryption task to perform homomorphic computation on the first ciphertext to output a second ciphertext. The first entity sends the homomorphic computation key.

[0045] In one possible implementation, the lifecycle of the homomorphic computing key is the duration of the homomorphic encryption task.

[0046] In the above method, the homomorphic computation key is associated with the homomorphic encryption task. For example, after the homomorphic encryption task is created, the homomorphic computation key is derived. The homomorphic computation key is valid for the duration of the homomorphic encryption task and becomes invalid when the homomorphic encryption task ends.

[0047] In one possible implementation, the first entity sends first indication information, where the first indication information is used to instruct destruction of a homomorphic key, where the homomorphic key is a homomorphic encryption key, a homomorphic decryption key, or a homomorphic computation key. The first entity destroys the homomorphic key.

[0048] In one possible implementation, the lifecycle of the homomorphic encryption key or the homomorphic decryption key is within the time between the success of the user's radio resource control RRC connection and the completion of the release. The user is the homomorphic encryption party or the homomorphic decryption party. The first indication information is carried in the RRC release signaling.

[0049] In the above method, the life cycle of the homomorphic key is coupled with the homomorphic encryption task. For example, the life cycle of the homomorphic encryption key is only within the time period of the homomorphic encryption task. After the homomorphic task is completed, the first entity can instruct other homomorphic participants to destroy the homomorphic key, which is beneficial to reduce the storage overhead of the key. In addition, the first entity itself will also destroy the homomorphic key of the homomorphic encryption task. Optionally, the first entity can send an RRC release signaling, which carries the first indication information instructing the homomorphic participants to destroy the homomorphic key.

[0050] In one possible implementation, the first entity sends a second indication message, where the second indication message is used to indicate an update of a homomorphic key. The homomorphic key is a homomorphic encryption key, a homomorphic decryption key, or a homomorphic computation key. The first entity updates the homomorphic key.

[0051] In this method, the first entity may instruct the terminal to update the homomorphic key; and the first entity itself also updates the homomorphic key.

[0052] In one possible implementation, the first entity stores the first ciphertext and its corresponding key information, and / or the second ciphertext and its corresponding key information. The key information includes one or more of a user-level homomorphic encryption key, a homomorphic decryption key, a homomorphic computation key, a key derivation parameter, and a security context.

[0053] In this method, the first entity can store ciphertext data and corresponding homomorphic encryption keys, homomorphic decryption keys, homomorphic computation keys, key derivation parameters, security context and other information, so that the ciphertext data is reusable and user-level homomorphically encrypted data can be circulated and homomorphically computed in different homomorphic encryption tasks.

[0054] In one possible implementation, the homomorphic security capability of the network side, or the homomorphic security capability of the terminal, or the homomorphic encryption algorithm, or the first indication information, or the second indication information is carried in signaling with encryption and integrity protection. The signaling includes radio resource control RRC signaling and / or non-access stratum NAS signaling with integrity protection.

[0055] In this method, the homomorphic security capabilities of the network side or the terminal and the related first indication information or second indication information can be encrypted and integrity protected, which is beneficial to transmission security protection and prevents attackers from eavesdropping, counterfeiting, or tampering with this information.

[0056] In one possible implementation, the first entity determines a homomorphic encryption key or a homomorphic decryption key based on the superior key and the homomorphic encryption algorithm information; uses the homomorphic encryption key to encrypt the plaintext message into the first ciphertext, or uses the homomorphic decryption key to decrypt the second ciphertext into the plaintext message.

[0057] In this method, the key architecture and management of the existing cellular network are adapted, and a user-level key architecture and management scheme for homomorphic encryption is designed. For example, the first entity can derive homomorphic keys based on the USIM symmetric key architecture or the KMC independent key architecture (the above-mentioned symmetric key architecture or independent key architecture derives related keys based on the superior key) and homomorphic encryption algorithm information, thereby realizing the user-level key architecture and management of homomorphic encryption.

[0058] In one possible implementation, the first entity determines a homomorphic computation key based on a homomorphic encryption key or a homomorphic decryption key, wherein the homomorphic computation key is used by the homomorphic computing party to perform homomorphic computation on the first ciphertext to output a second ciphertext. The terminal sends the homomorphic computation key.

[0059] In this method, the first entity can derive a homomorphic computing key under the USIM symmetric key architecture or the KMC independent key architecture, thereby realizing the user-level key architecture and management of homomorphic encryption.

[0060] In a fifth aspect, the present application provides a user-level homomorphic encryption management method, which is performed by a first entity. The first entity may be an access network device or a network entity (such as a core network element or a functional network element), or a component of an access network device or a network entity (such as a processor, a chip, or a chip system, etc.), or a logical module that can implement all or part of an access network device or a network entity. The first entity determines a homomorphic encryption key or a homomorphic decryption key based on the superior key and the homomorphic encryption algorithm information. The first entity uses the homomorphic encryption key to encrypt a plaintext message into a first ciphertext, or uses the homomorphic decryption key to decrypt the second ciphertext into a plaintext message.

[0061] This method adapts the key architecture and management of existing cellular networks to design a user-level key architecture and management solution for homomorphic encryption. For example, the first entity can derive homomorphic keys based on the USIM symmetric key architecture or KMC independent key architecture (the above symmetric key architecture or independent key architecture derives related keys based on the upper key) and homomorphic encryption algorithm information, thus implementing the user-level key architecture and management of homomorphic encryption.

[0062] In one possible implementation, the first entity determines a homomorphic computation key based on a homomorphic encryption key or a homomorphic decryption key, wherein the homomorphic computation key is used by the homomorphic computing party to perform homomorphic computation on the first ciphertext to output a second ciphertext. The first entity sends the homomorphic computation key.

[0063] In this method, the first entity can derive a homomorphic computing key under the USIM symmetric key architecture or the KMC independent key architecture, thereby realizing the user-level key architecture and management of homomorphic encryption.

[0064] In one possible implementation, the superior key is a first key, and the first key is an anchor key derived from a first network element (e.g., a network element or entity with an authentication function). The first entity determines the homomorphic encryption key or homomorphic decryption key of the network function NF network element based on the first key and the first homomorphic algorithm input parameter. The first homomorphic algorithm input parameter includes one or more of an algorithm type, an algorithm identifier, a network function type, a user identity identifier, a non-access layer count value NAS count, and an ABBA parameter.

[0065] In this method, the first entity can generate a homomorphic encryption key or a homomorphic decryption key for the corresponding functional network element based on the anchor key in the symmetric key architecture and the first homomorphic algorithm input parameters. That is, the first entity can reuse the existing symmetric key architecture to generate a homomorphic encryption key or a homomorphic decryption key, making the implementation process simpler and faster. The homomorphic encryption key or homomorphic decryption key generated by this method can be used to homomorphically encrypt or decrypt user-related core network data.

[0066] In one possible implementation, the superior key is a second key, the second key is a key derived by the second network element from the anchor key, and the second network element is a network element or entity having access and mobility management functions. The first entity determines the homomorphic encryption key or homomorphic decryption key of the second network element based on the second key and the second homomorphic algorithm input parameters. The second homomorphic algorithm input parameters include one or more of the algorithm type, algorithm identifier, and non-access layer count value NAS count.

[0067] In this method, the first entity can generate a homomorphic encryption key or homomorphic decryption key for the corresponding functional network element based on the second key derived from the anchor key in the symmetric key architecture and the second homomorphic algorithm input parameter. That is, the first entity can reuse the existing symmetric key architecture to generate a homomorphic encryption key or homomorphic decryption key, making the implementation process simpler and faster. The homomorphic encryption key or homomorphic decryption key generated by this method can be used to homomorphically encrypt or decrypt user-related core network data.

[0068] In one possible implementation, the superior key is a third key, and the third key is a key derived by the second network element from the second key. The first entity determines the homomorphic encryption key or homomorphic decryption key of the access network device based on the third key and third homomorphic algorithm input parameters. The third homomorphic algorithm input parameters include an algorithm type and / or an algorithm identifier.

[0069] In this method, the first entity can generate a homomorphic encryption key or homomorphic decryption key for the access network device based on a third key derived from the second key in the symmetric key architecture and the third homomorphic algorithm input parameters. In other words, the first entity can reuse the existing symmetric key architecture to generate a homomorphic encryption key or homomorphic decryption key, making the implementation process simpler and faster. The homomorphic encryption key or homomorphic decryption key generated by this method is mainly used to homomorphically encrypt or decrypt user-related access network data.

[0070] In one possible implementation, the superior key is a working key of an independent key architecture. The first entity determines a homomorphic encryption key or a homomorphic decryption key of a core network element based on the working key of the independent key architecture and fourth homomorphic algorithm input parameters. The fourth homomorphic algorithm input parameters include one or more of a random number RAND, a service network name, a network function type, an algorithm type, an algorithm identifier, a user identity identifier, and an ABBA parameter.

[0071] In this method, the first entity can generate a homomorphic encryption key or homomorphic decryption key for the corresponding core network element based on the working key in the independent key architecture and the fourth homomorphic algorithm input parameters. That is, the first entity can design a new independent key architecture that is conducive to centralized management of the homomorphic encryption key or homomorphic decryption key of the core network element through a management device. The homomorphic encryption key or homomorphic decryption key generated by this method can be used to homomorphically encrypt or decrypt data within the core network.

[0072] In one possible implementation, the superior key is a working key of an independent key architecture. The first entity determines the homomorphic encryption key and the homomorphic decryption key of the access network device based on the working key of the independent key architecture and the fifth homomorphic algorithm input parameters. The fifth homomorphic algorithm input parameters include one or more of a random number RAND, a service network name, a network function type, an algorithm type, an algorithm identifier, a user identity identifier, an ABBA parameter, a non-access stratum count value NAS count, and an access type.

[0073] In this method, the first entity can generate a homomorphic encryption key or a homomorphic decryption key for the access network device based on the working key in the independent key architecture and the fifth homomorphic algorithm input parameters. In other words, the first entity can design a new independent key architecture that facilitates centralized management of the homomorphic encryption keys or homomorphic decryption keys of the access network device through a management device. The homomorphic encryption key or homomorphic decryption key generated by this method can be used to homomorphically encrypt or decrypt data within the access network.

[0074] In a sixth aspect, the present application provides a communication device, which may be a terminal or a device of a terminal. In one possible implementation, the communication device may include a functional module, which may be a hardware circuit, software, or a combination of hardware circuit and software. The functional module is used to implement the method described in the first aspect and its various possible implementations.

[0075] In one possible implementation, the communication device includes a communication unit and a processing unit. The communication unit is configured to receive homomorphic security capabilities from the network. The processing unit is configured to determine a homomorphic encryption algorithm based on the homomorphic security capabilities of the terminal and the homomorphic security capabilities of the network. The communication unit is further configured to send a homomorphic encryption algorithm identifier.

[0076] In one possible implementation, the homomorphic security capability on the network side is carried in the security mode command, and the homomorphic encryption algorithm is carried in the security mode completion message.

[0077] In a seventh aspect, the present application provides a communication device, which may be a terminal or a device for a terminal. In one possible implementation, the communication device may include a functional module, which may be implemented as a hardware circuit, software, or a combination of hardware circuits and software. The functional module is used to implement the method described in the second aspect and its various possible implementations.

[0078] In one possible implementation, the communication device includes a communication unit and a processing unit. The communication unit is configured to transmit the homomorphic security capabilities of the terminal. The communication unit is further configured to receive a homomorphic encryption algorithm identifier, where the homomorphic encryption algorithm is determined by the network based on the homomorphic security capabilities of the terminal and the network.

[0079] In a possible implementation, the homomorphic security capability of the terminal is carried in a security mode completion message.

[0080] The device described in the sixth or seventh aspect above also includes the following possible implementations:

[0081] In one possible implementation, the processing unit is configured to determine a homomorphic encryption key and / or a homomorphic decryption key based on a homomorphic encryption algorithm, wherein the homomorphic encryption key is used to encrypt a plaintext message into a first ciphertext, and the homomorphic decryption key is used to decrypt a second ciphertext into a plaintext message.

[0082] In one possible implementation, after the homomorphic encryption task is created, the communication unit is used to receive a homomorphic computing key, which is used by one or more homomorphic computing parties in the homomorphic encryption task to perform homomorphic computing on the first ciphertext to output a second ciphertext.

[0083] In one possible implementation, the lifecycle of the homomorphic computing key is the duration of the homomorphic encryption task.

[0084] In one possible implementation, the communication unit is configured to receive first indication information, the first indication information being configured to instruct the destruction of a homomorphic key, wherein the homomorphic key is a homomorphic encryption key, a homomorphic decryption key, or a homomorphic computation key, and the processing unit is configured to destroy the homomorphic key.

[0085] In one possible implementation, the lifecycle of the homomorphic encryption key or the homomorphic decryption key is within the time between the success of the user's radio resource control RRC connection and the completion of the release; wherein the user is the homomorphic encryption party or the homomorphic decryption party. The first indication information is carried in the RRC release signaling.

[0086] In one possible implementation, the communication unit is configured to receive second indication information, the second indication information being configured to indicate updating a homomorphic key, wherein the homomorphic key is a homomorphic encryption key, a homomorphic decryption key, or a homomorphic computation key, and the processing unit is configured to update the homomorphic key.

[0087] In one possible implementation, the processing unit is configured to store the first ciphertext and its corresponding key information, and / or the second ciphertext and its corresponding key information. The key information includes one or more of a homomorphic encryption key, a homomorphic decryption key, a homomorphic computation key, a key derivation parameter, and a security context.

[0088] In one possible implementation, the homomorphic security capability of the network side, or the homomorphic security capability of the terminal, or the homomorphic encryption algorithm, or the first indication information, or the second indication information is carried in signaling with encryption and integrity protection; wherein the signaling includes radio resource control RRC signaling and / or non-access stratum NAS signaling with integrity protection.

[0089] In one possible implementation, the processing unit is used to determine a homomorphic encryption key or a homomorphic decryption key based on the superior key and homomorphic encryption algorithm information; use the homomorphic encryption key to encrypt the plaintext message into a first ciphertext, or use the homomorphic decryption key to decrypt the second ciphertext into a plaintext message.

[0090] In one possible implementation, the processing unit is configured to determine a homomorphic computation key based on a homomorphic encryption key or a homomorphic decryption key. The homomorphic computation key is used by the homomorphic computing party to perform homomorphic computation on the first ciphertext to output a second ciphertext. The communication unit is configured to transmit the homomorphic computation key.

[0091] In an eighth aspect, the present application provides a communication device, which may be an access network device or a network entity, or a device of an access network device or a network entity. In one possible implementation, the communication device may include a functional module, which may be implemented as a hardware circuit, software, or a combination of hardware circuits and software. The functional module is configured to implement the method described in the third aspect and various possible implementations thereof.

[0092] In one possible implementation, the communication device includes a communication unit and a processing unit. The communication unit is configured to transmit the homomorphic security capabilities of the network. The communication unit is further configured to receive a homomorphic encryption algorithm identifier, where the homomorphic encryption algorithm is determined by the terminal based on the homomorphic security capabilities of the terminal and the homomorphic security capabilities of the network.

[0093] In one possible implementation, the homomorphic security capability on the network side is carried in the security mode command, and the homomorphic encryption algorithm is carried in the security mode completion message.

[0094] In a ninth aspect, the present application provides a communication device, which may be an access network device or a network entity, or a device of an access network device or a network entity. In one possible implementation, the communication device may include a functional module, which may be implemented as a hardware circuit, software, or a combination of a hardware circuit and software. The functional module is configured to implement the method described in the fourth aspect and various possible implementations thereof.

[0095] In one possible implementation, the communication device includes a communication unit and a processing unit. The communication unit is configured to receive the homomorphic security capabilities of the terminal. The processing unit is configured to determine a homomorphic encryption algorithm based on the homomorphic security capabilities of the terminal and the homomorphic security capabilities of the network. The communication unit is further configured to send a homomorphic encryption algorithm identifier.

[0096] In a possible implementation, the homomorphic security capability of the terminal is carried in a security mode completion message.

[0097] The device described in the eighth or ninth aspect above may further include the following possible implementations:

[0098] In one possible implementation, the processing unit is configured to determine a homomorphic encryption key and / or a homomorphic decryption key based on a homomorphic encryption algorithm, wherein the homomorphic encryption key is used to encrypt a plaintext message into a first ciphertext, and the homomorphic decryption key is used to decrypt a second ciphertext into a plaintext message.

[0099] In one possible implementation, after a homomorphic encryption task is created, the processing unit is configured to determine a homomorphic computation key. The homomorphic computation key is used by one or more homomorphic computation parties in the homomorphic encryption task to perform homomorphic computation on the first ciphertext to output the second ciphertext. The communication unit is configured to transmit the homomorphic computation key.

[0100] In one possible implementation, the lifecycle of the homomorphic computing key is the duration of the homomorphic encryption task.

[0101] In one possible implementation, the communication unit is configured to send a first indication message, wherein the first indication message is configured to instruct the destruction of a homomorphic key, where the homomorphic key is a homomorphic encryption key, a homomorphic decryption key, or a homomorphic computation key. The processing unit is configured to destroy the homomorphic key.

[0102] In one possible implementation, the lifecycle of the homomorphic encryption key or the homomorphic decryption key is within the time between the success of the user's radio resource control RRC connection and the completion of the release. The user is the homomorphic encryption party or the homomorphic decryption party. The first indication information is carried in the RRC release signaling.

[0103] In one possible implementation, the communication unit is configured to send a second indication message, where the second indication message is configured to indicate an update of a homomorphic key, wherein the homomorphic key is a homomorphic encryption key, a homomorphic decryption key, or a homomorphic computation key. The first entity updates the homomorphic key.

[0104] In one possible implementation, the processing unit is configured to store the first ciphertext and its corresponding key information, and / or the second ciphertext and its corresponding key information. The key information includes one or more of a user-level homomorphic encryption key, a homomorphic decryption key, a homomorphic computation key, a key derivation parameter, and a security context.

[0105] In one possible implementation, the homomorphic security capability of the network side, or the homomorphic security capability of the terminal, or the homomorphic encryption algorithm, or the first indication information, or the second indication information is carried in signaling with encryption and integrity protection. The signaling includes radio resource control RRC signaling and / or non-access stratum NAS signaling with integrity protection.

[0106] In one possible implementation, the processing unit is used to determine a homomorphic encryption key or a homomorphic decryption key based on the superior key and homomorphic encryption algorithm information; use the homomorphic encryption key to encrypt the plaintext message into a first ciphertext, or use the homomorphic decryption key to decrypt the second ciphertext into a plaintext message.

[0107] In one possible implementation, the processing unit is configured to determine a homomorphic computation key based on a homomorphic encryption key or a homomorphic decryption key, wherein the homomorphic computation key is used by the homomorphic computing party to perform homomorphic computation on the first ciphertext to output the second ciphertext. The communication unit is configured to transmit the homomorphic computation key.

[0108] In a tenth aspect, the present application provides a communication device, which may be an access network device or a network entity, or a device of an access network device or a network entity. In one possible implementation, the communication device may include a functional module, which may be implemented as a hardware circuit, software, or a combination of a hardware circuit and software. The functional module is used to implement the method described in the fifth aspect and its various possible implementations.

[0109] In one possible implementation, the communication device includes a communication unit and a processing unit. The processing unit is configured to determine a homomorphic encryption key or a homomorphic decryption key based on a superior key and homomorphic encryption algorithm information. The processing unit is further configured to encrypt a plaintext message into a first ciphertext using the homomorphic encryption key, or decrypt a second ciphertext into a plaintext message using the homomorphic decryption key.

[0110] In one possible implementation, the processing unit is configured to determine a homomorphic computation key based on a homomorphic encryption key or a homomorphic decryption key, wherein the homomorphic computation key is used by the homomorphic computing party to perform homomorphic computation on the first ciphertext to output the second ciphertext. The first entity sends the homomorphic computation key.

[0111] In one possible implementation, the superior key is a first key, and the first key is an anchor key derived from a first network element (e.g., a network element or entity with an authentication function). The processing unit is configured to determine a homomorphic encryption key or a homomorphic decryption key of a network function NF network element based on the first key and a first homomorphic algorithm input parameter. The first homomorphic algorithm input parameter includes one or more of an algorithm type, an algorithm identifier, a network function type, a user identity identifier, a non-access layer count value NAS count, and an ABBA parameter.

[0112] In one possible implementation, the superior key is a second key, the second key is a key derived by the second network element from the anchor key, and the second network element is a network element or entity with access and mobility management functions. The processing unit is used to determine the homomorphic encryption key or homomorphic decryption key of the second network element (e.g., a network element with access and management functions) based on the second key and the second homomorphic algorithm input parameter. The second homomorphic algorithm input parameter includes one or more of the algorithm type, algorithm identifier, and non-access layer count value NAS count.

[0113] In one possible implementation, the superior key is a third key, and the third key is a key derived by the second network element from the second key. The processing unit is configured to determine a homomorphic encryption key or a homomorphic decryption key of the access network device based on the third key and third homomorphic algorithm input parameters. The third homomorphic algorithm input parameters include an algorithm type and / or an algorithm identifier.

[0114] In one possible implementation, the superior key is a working key of an independent key architecture. The processing unit is configured to determine a homomorphic encryption key or a homomorphic decryption key of a core network element based on the working key of the independent key architecture and input parameters of a fourth homomorphic algorithm. The fourth homomorphic algorithm input parameters include one or more of a random number RAND, a service network name, a network function type, an algorithm type, an algorithm identifier, a user identity identifier, and an ABBA parameter.

[0115] In one possible implementation, the superior key is a working key of an independent key architecture. The processing unit is configured to determine a homomorphic encryption key and a homomorphic decryption key of the access network device based on the working key of the independent key architecture and input parameters of a fifth homomorphic algorithm. The input parameters of the fifth homomorphic algorithm include one or more of a random number RAND, a serving network name, a network function type, an algorithm type, an algorithm identifier, a user identity identifier, an ABBA parameter, a non-access stratum count value NAS count, and an access type.

[0116] For aspects 6 to 10, as examples, the processing unit may be a processor, and the communication unit may be a transceiver unit, a transceiver, or a communication interface. It is understood that when the communication device is a communication device (such as a terminal or a network device), the communication unit may be a transceiver in the communication device, for example, implemented by an antenna, a feeder, and a codec in the communication device, or, if the communication device is a chip provided in the device, the processing unit may be a processing circuit, a logic circuit, etc. of the chip, and the communication unit may be an input / output interface of the chip, such as an input / output circuit, a pin, etc.

[0117] In an eleventh aspect, the present application provides a communication device, comprising: a processor, configured to enable the communication device to implement the above-mentioned first and second aspects, as well as the method in any possible implementation of the first and second aspects, by executing instructions or through logic circuits.

[0118] Optionally, the communication device further comprises a memory for storing the instructions. Optionally, the memory and the processor are integrated together.

[0119] Optionally, the communication device further comprises a communication interface for inputting and / or outputting signals.

[0120] In the twelfth aspect, the present application provides another communication device, including: a processor, configured to enable the communication device to implement the above-mentioned third and fourth aspects, as well as the method in any possible implementation of the third and fourth aspects, by executing instructions or through logic circuits.

[0121] Optionally, the communication device further comprises a memory for storing the instructions. Optionally, the memory and the processor are integrated together.

[0122] Optionally, the communication device further comprises a communication interface for inputting and / or outputting signals.

[0123] In a thirteenth aspect, the present application provides another communication device, comprising: a processor, configured to enable the communication device to implement the method in the above-mentioned fifth aspect and any possible implementation manner of the fifth aspect by executing instructions or through a logic circuit.

[0124] Optionally, the communication device further comprises a memory for storing the instructions. Optionally, the memory and the processor are integrated together.

[0125] Optionally, the communication device further comprises a communication interface for inputting and / or outputting signals.

[0126] In the fourteenth aspect, the present application provides a communication system, which includes multiple devices or equipment in the above-mentioned aspects 6 to 13, so that the devices or equipment execute the methods in any possible implementation of aspects 1 to 5, and aspects 1 to 5.

[0127] In the fifteenth aspect, the present application provides a computer-readable storage medium storing instructions, which, when the instructions are executed on a computer, enable the computer to execute the method in any possible implementation of the first to fifth aspects, and any one of the first to fifth aspects.

[0128] In a sixteenth aspect, the present application provides a chip system, comprising a processor and an interface, and optionally, a memory, for implementing the method of any possible implementation of aspects 1 to 5 above. The chip system may be composed of a chip, or may include a chip and other discrete devices.

[0129] In the seventeenth aspect, the present application provides a computer program product comprising instructions, which, when executed on a computer, enable the computer to execute the method of any possible implementation of the first to fifth aspects, and any one of the first to fifth aspects. BRIEF DESCRIPTION OF THE DRAWINGS

[0130] FIG1 is a schematic diagram of a communication system provided by the present application;

[0131] FIG2 is a schematic diagram of a key architecture for key hierarchy generation in a 5G system;

[0132] Figures 3a-3e are schematic diagrams of a homomorphic encryption scheme;

[0133] FIG4 is a schematic diagram of a network scenario in which a homomorphic encryption task involves multiple participants;

[0134] FIG5 is a schematic diagram of a wireless network protocol layer;

[0135] Figures 6a and 6b are flowcharts of a user-level homomorphic encryption management method provided by this application;

[0136] FIG7 is a schematic diagram of a network scenario in which a homomorphic encryption task has multiple participants provided by the present application;

[0137] FIG8a is a schematic diagram of a process of determining a homomorphic encryption algorithm by a terminal in a security mode completion process provided by the present application;

[0138] FIG8 b is a schematic diagram of a process for determining a homomorphic encryption algorithm by a terminal after completing a process in a security mode, provided by the present application;

[0139] FIG9a is a schematic diagram of a process of determining a homomorphic encryption algorithm by a network device in a security mode completion process provided by the present application;

[0140] FIG9 b is a schematic diagram of a process of determining a homomorphic encryption algorithm by a network device after completing a process in a security mode provided by the present application;

[0141] FIG10 is a schematic diagram of a key derivation process for a homomorphic computing key provided by the present application;

[0142] FIG11 is a schematic diagram of a process for homomorphic key destruction provided by this application;

[0143] FIG12 is a schematic diagram of a process for homomorphic key update provided by the present application;

[0144] FIG13 is a flow chart of another method for managing user-level homomorphic encryption provided by the present application;

[0145] FIG14a is a schematic diagram of a homomorphic key derivation based on a USIM symmetric key architecture provided by the present application;

[0146] FIG14b is a schematic diagram of deriving a homomorphic key based on a KMC independent key architecture provided by the present application;

[0147] FIG15 is a schematic diagram of an interactive homomorphic key generation process provided by the present application;

[0148] FIG16 is a schematic diagram of a communication device provided by the present application;

[0149] FIG17 is a schematic diagram of another communication device provided in this application. DETAILED DESCRIPTION

[0150] In the embodiments of this application, " / " can indicate that the associated objects are in an "or" relationship. For example, A / B can mean A or B. "And / or" can be used to describe the existence of three relationships between associated objects. For example, "A and / or B" can mean: A exists alone, A and B exists simultaneously, or B exists alone. A and B can be singular or plural. To facilitate the description of the technical solutions of the embodiments of this application, the words "first" and "second" may be used in the embodiments of this application to distinguish between technical features with the same or similar functions. The words "first" and "second" do not limit the number or order of execution, and the words "first" and "second" do not necessarily mean different. In the embodiments of this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design described as "exemplary" or "for example" should not be construed as preferred or advantageous over other embodiments or designs. The use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner for easier understanding.

[0151] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0152] In order to solve the problem of how to manage the homomorphic keys of a single party or multiple parties for multiple homomorphic requesters / computing parties / decrypting parties, the present application provides a user-level homomorphic encryption management method and device, which can manage the keys of multiple homomorphic encrypting parties / computing parties / decrypting parties, providing high user-level privacy protection strength and high reusability of ciphertext.

[0153] Among them, the user-level homomorphic encryption management method provided by this application can be applied to the communication system shown in Figure 1. For example, the communication system includes terminal equipment, an access network and a core network. Among them, the access network includes access network equipment, and the core network includes core network functional entities (also called core network network elements). Optionally, the user-level homomorphic encryption management method provided by this application can be applied to any communication system (such as cellular networks, Internet of Things, private networks, etc.) to provide encryption services for communication systems and improve the security of communication systems. For example, the access network and core network in Figure 1 can be private networks.

[0154] Among them, the communication system of the present application may include but is not limited to communication systems of various radio access technologies (RAT), for example, it may be: a narrowband Internet of Things system (NB-IoT), an LTE communication system, or a 5G (or new radio, NR) communication system, or a transition system between an LTE communication system and a 5G communication system, which may also be called a 4.5G communication system. Of course, it may also be a communication system evolved after 5G, such as the sixth generation (6G) or even the seventh generation (7G) system. The network architecture and business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. It is known to those skilled in the art that with the evolution of the communication network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0155] Terminal equipment, also known as terminal, user equipment (UE), mobile station (MS), mobile terminal (MT), mobile equipment (ME), etc., refers to equipment that provides voice and / or data connectivity to users. For example, terminal equipment includes handheld devices with wireless connection capabilities and in-vehicle devices. Currently, terminal devices can include: mobile phones, tablet computers, laptop computers, PDAs, mobile internet devices (MIDs), wearable devices (such as smart watches, smart bracelets, pedometers, etc.), vehicle-mounted devices (such as cars, bicycles, electric vehicles, airplanes, ships, trains, high-speed trains, etc.), satellite terminals, virtual reality (VR) devices, augmented reality (AR) devices, smart point-of-sale (POS) machines, customer-premises equipment (CPE), wireless terminals in industrial control, smart home devices (such as refrigerators, televisions, air conditioners, electricity meters, etc.), intelligent robots, robotic arms, workshop equipment, wireless terminals in unmanned driving, wireless terminals in telemedicine, wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, and flying devices (such as intelligent robots, hot air balloons, drones, airplanes). Terminal devices can also be other devices with terminal functions, for example, terminal devices can also be devices that function as terminals in D2D communication.

[0156] The embodiments of this application do not limit the device form factor of the terminal. The device used to implement the functions of the terminal device can be the terminal device; it can also be a device that supports the terminal device to implement the functions, such as a chip system. The device can be installed in the terminal device or used in conjunction with the terminal device. In the embodiments of this application, the chip system can be composed of chips or include chips and other discrete devices.

[0157] The access network device refers to a radio access network (RAN) node (or device) that connects a terminal device to a wireless network, and may also be referred to as a base station. For example, some examples of RAN nodes include: a gNB, a transmission reception point (TRP), an evolved Node B (eNB), a radio network controller (RNC), a Node B (NB), a base station controller (BSC), a base transceiver station (BTS), a home base station (e.g., a home evolved NodeB, or a home Node B, HNB), a base band unit (BBU), or a wireless fidelity (Wifi) access point (AP), a satellite in a satellite communication system, a radio controller in a cloud radio access network (CRAN) scenario, a wearable device, a drone, or a device in an Internet of Vehicles (e.g., vehicle to everything (V2X)), or a communication device in device to device (D2D) communication. In addition, in a network structure, the network device may include a centralized unit (CU) node, a distributed unit (DU) node, or a RAN device including a CU node and a DU node. The RAN device including the CU node and the DU node splits the protocol layer of the eNB in ​​the long term evolution (LTE) system, places the functions of some protocol layers under central control in the CU, and distributes the functions of the remaining part or all of the protocol layers in the DU, which is centrally controlled by the CU. In some deployments of network devices, the CU can also be divided into a CU-control plane (CP) and a CU-user plane (UP), etc. In other deployments of network devices, the network device can also be an antenna unit (RU), etc. In some other deployments of network devices, the network device can also be an open radio access network (ORAN) architecture, etc. This application does not limit the specific type of network device.For example, when the network device is an ORAN architecture, the network device shown in the embodiment of the present application may be an access network device in the ORAN, or a module in the access network device. In the ORAN system, CU may also be referred to as open (O)-CU, DU may also be referred to as O-DU, CU-DU may also be referred to as O-CU-DU, CU-UP may also be referred to as O-CU-UP, and RU may also be referred to as O-RU.

[0158] The core network elements of this application can be divided into three categories based on their functions, namely security network elements, data network elements and management network elements.

[0159] For example, the security network elements described in this application may include but are not limited to unified data management (UDM) network elements, authentication credential repository and processing function (ARPF) network elements, authentication server function (AUSF) network elements, security anchor function (SEAF), access and mobility management function (AMF), etc. The above-mentioned security network elements can implement contract data management, user service registration management, generate authentication and key agreement (AKA) authentication parameters, access authorization based on contract data, store user root keys and authentication-related contract data, support unified authentication services and other functions. The security network elements described in this application may also include other network elements that can implement security-related functions, such as newly defined network elements in networks evolved after 5G. For example, homomorphic encryption control function network elements, etc.

[0160] For another example, the data-class network elements described in this application may include but are not limited to a unified data repository (UDR), an unstructured data storage function (UDSF) network element, a network data analytics function (NWDAF) network element, a data collection coordination function (DCCF) network element, an analytics data repository function (ADRF) network element, etc. The above-mentioned data-class network elements can realize functions such as storing and retrieving data, performing event subscription and data collection, performing information analysis, and performing information retrieval. Optionally, the data-class network elements described in this application may also include other network elements that can realize data-related functions, such as newly defined network elements in networks that evolve after 5G. For example, related to this application, homomorphic encryption parties / homomorphic computing parties / homomorphic decryption parties, ciphertext data storage management units, etc.

[0161] For another example, the management network elements described in this application may include but are not limited to session management function (SMF) network elements, user plane function (UPF) network elements, policy control function (PCF) network elements, network exposure function (NEF) network elements, network slice selection function (NSSF) network elements, network repository function (NRF) network elements, charging function (CHF) network elements, binding support function (BSF) network elements, signaling service processing system (SPS) network elements, etc. The above-mentioned management network elements can implement session management, charging and service quality policy control, message routing and forwarding, provide slice-based policies, provide session-related policies, maintain network function information, data service charging, protocol data aggregation and other functions. Optionally, the management network elements described in this application may also include other network elements that can implement management-related functions, such as newly defined network elements in networks evolved after 5G. For example, related to this application, the key management center, homomorphic encryption control function network element, etc.

[0162] It should be noted that:

[0163] "Sending" and "receiving" in the embodiments of the present application indicate the direction of signal transmission. For example, "sending configuration information to a terminal device" can be understood as the destination end of the configuration information being the terminal device, which can include direct sending through the air interface, and also includes indirect sending through the air interface by other units or modules. "Receiving configuration information from a network device" can be understood as the source end of the configuration information being the network device, which can include direct receiving from the network device through the air interface, and also includes indirect receiving from the network device through the air interface from other units or modules. "Sending" can also be understood as the "output" of the chip interface, and "receiving" can also be understood as the "input" of the chip interface.

[0164] In other words, sending and receiving can be performed between devices, for example, between a network device and a terminal device, or can be performed within a device, for example, sending or receiving between components, modules, chips, software modules or hardware modules within the device through a bus, wiring or interface.

[0165] It is understandable that information may be processed between the source and destination of information transmission, such as coding, modulation, etc., but the destination can understand the valid information from the source. Similar expressions in this application can be understood similarly and will not be repeated.

[0166] In the embodiments of the present application, "indication" may include direct indication and indirect indication, and may also include explicit indication and implicit indication. The information indicated by a certain information (such as the indication information described below) is called information to be indicated. In the specific implementation process, there are many ways to indicate the information to be indicated, such as but not limited to, the information to be indicated can be directly indicated, such as the information to be indicated itself or the index of the information to be indicated. The information to be indicated can also be indirectly indicated by indicating other information, wherein there is an association between the other information and the information to be indicated; it is also possible to indicate only a part of the information to be indicated, while the other parts of the information to be indicated are known or agreed in advance, for example, the indication of specific information can be achieved with the help of the arrangement order of each information agreed in advance (such as predefined by the protocol), thereby reducing the indication overhead to a certain extent. The present application does not limit the specific method of indication. It is understandable that, for the sender of the indication information, the indication information can be used to indicate the information to be indicated, and for the receiver of the indication information, the indication information can be used to determine the information to be indicated.

[0167] 1. To facilitate understanding, the definitions of relevant terms involved in this application are introduced in detail below.

[0168] 1. UMTS (universal mobile telecommunications system) subscriber identity module (USIM) symmetric key architecture:

[0169] For example, Figure 2 illustrates a key architecture for key hierarchy generation in a 5G system. Taking 5G Authentication Key Access (GAKA) as an example, authentication-related keys include, but are not limited to, the following: K (key), CK (cipher key), and IK (integrity key). The key hierarchy includes, but is not limited to, the following: K_AUSF, K_SEAF, K_AMF, K_NASint, K_NASenc, K_N3IWF, K_gNB, K_RRCint, K_RRCenc, K_UPint, and K_UPenc.

[0170] For example, for the AUSF keys in the home network, in the case of 5G AKA, K_AUSF is derived from CK and IK by the ME and ARPF, and K_AUSF is received from the ARPF as part of the 5G home environment authentication vector (5G HE AV). K_SEAF is the anchor key derived from K_AUSF by the ME and AUSF. K_SEAF is provided by the AUSF to the security anchor function (SEAF) in the serving network.

[0171] For example, for the AMF key in the service network, K_AMF is the key that the ME and SEAF derive from K_SEAF. K_AMF is further derived by the ME and source AMF when performing horizontal key derivation.

[0172] For example, NAS signaling keys include K_NASint and K_NASenc. K_NASint is a key derived by the ME and AMF from K_AMF and is only used to protect NAS signaling using a specific integrity algorithm. K_NASenc is a key derived by the ME and AMF from K_AMF and is only used to protect NAS signaling using a specific encryption algorithm.

[0173] For example, K_gNB (Access Network Key) is a key derived from K_AMF by the ME and AMF. K_gNB is further derived by the ME and source gNB when performing horizontal or vertical key derivation. The use of K_gNB is similar to that of K_eNB between the ME and ng-eNB. The next hop (NH) is used for vertical derivation of base station keys.

[0174] For example, the keys used for user plane (UP) transmission include K_UPenc and K_UPint. K_UPenc is a key derived from K_gNB by the ME and gNB and is used to protect UP transmission data using a specific encryption algorithm. K_UPint is a key derived from K_gNB by the ME and gNB and is only used to protect UP traffic between the ME and gNB using a specific integrity algorithm.

[0175] For example, RRC signaling keys include K_RRCint and K_RRCenc. K_RRCint is a key derived by the ME and gNB from K_gNB and is used to protect radio resource control (RRC) signaling using a specific integrity algorithm. K_RRCenc is a key derived by the ME and gNB from K_gNB and is used to protect RRC signaling using a specific encryption algorithm.

[0176] For example, K_N3IWF (non-3GPP interworking function, N3IWF) key is the key used for non-3GPP access derived from K_AMF by ME and AMF. It should be noted that K_N3IWF is not forwarded between N3IWFs.

[0177] 2. Homomorphic Encryption (HE):

[0178] Homomorphic encryption aims to perform computations on ciphertext without exposing the plaintext data, focusing on privacy-preserving computation. Homomorphic encryption enables data value mining while maintaining privacy. Specifically, it is an encryption scheme that can directly operate on ciphertext. Homomorphic encryption builds on basic encryption by adding homomorphic computation capabilities over ciphertext. Furthermore, decrypting the ciphertext computation results ensures that the computation results are consistent with those based on the plaintext. For example, plaintext data is encrypted using a homomorphic encryption key to generate ciphertext data. The ciphertext data is then computed using a homomorphic computation key to generate a ciphertext computation result. This ciphertext computation result is then homomorphically decrypted using a homomorphic decryption key to obtain an output that is identical to the output obtained by computing the unencrypted plaintext data using the same method.

[0179] Homomorphic encryption algorithms have evolved over many generations, including multiplication homomorphic encryption, fully homomorphic encryption (which can perform any number of homomorphic addition and multiplication operations on ciphertext and proposes the important concept of bootstrapping. Bootstrapping is a special ciphertext processing technique that can convert high-noise ciphertext into low-noise new ciphertext), BFV (Brakerski, Fan, Vercauteren) homomorphic encryption and BGV (Brakerski, Gentry, Vaikuntanathan) homomorphic encryption (both use key exchange and modulus exchange techniques to reduce the dimension of the ciphertext and the size of the noise, thereby reducing the computational complexity of decryption), CKKS (Cheon, Andrey Kim, Miran Kim, Yongsoo Song) homomorphic encryption (based on the BGV scheme, performs approximate calculations, supports addition, subtraction, and multiplication of floating-point vectors in the ciphertext space while maintaining homomorphism), and fully homomorphic encryption scheme over the torus (TFHE). Among them, fully homomorphic encryption can be either asymmetric key encryption or symmetric key encryption, as long as the ciphertext has a certain algebraic structure.

[0180] For example, Figure 3a-Figure 3e are schematic diagrams of a homomorphic encryption scheme, which includes a four-part algorithm and is described using an asymmetric encryption scheme as an example.

[0181] Part 1: Homomorphic Key Generation. The homomorphic key generator can output the public key (PK) as the homomorphic encryption key K_enc=pk; the homomorphic evaluation key K_eval=evk (also known as the homomorphic computation key); and the secret key (SK) as the homomorphic decryption key K_dec=sk, as shown in Figure 3a.

[0182] Part 2: Homomorphic encryption. The homomorphic encryption method uses the homomorphic encryption key K_enc = pk to encrypt a single-bit plaintext message m∈{0,1} into a ciphertext c, as shown in Figure 3b.

[0183] Part 3: Homomorphic decryption. The homomorphic decryption party uses the homomorphic decryption key K_dec = sk to decrypt the ciphertext c and restore it to the plaintext message m∈{0,1}, as shown in Figure 3c.

[0184] Part 4: Homomorphic evaluation, also known as homomorphic evaluation. Based on the input ciphertext c_1, c_2, ... and the homomorphic evaluation key K_eval = evk, the homomorphic evaluation party performs homomorphic evaluation on the ciphertext function f: {0, 1} l →{0,1}, and obtain the output ciphertext c_f of the homomorphic computation, as shown in Figure 3d.

[0185] Therefore, the entire homomorphic encryption scheme HE = (HE_keygen, HE_enc, HE_dec, HE_eval) is shown in Figure 3e. Homomorphic key generator A generates the homomorphic encryption key K_enc, the homomorphic computation key K_eval, and the homomorphic decryption key K_dec, which need to be distributed to homomorphic encryptor B, homomorphic computation key C, and homomorphic decryptor D, respectively. Homomorphic encryptor B uses the homomorphic encryption key K_enc to encrypt the plaintext. Homomorphic computation key C uses the homomorphic computation key K_eval to compute the ciphertext to obtain the ciphertext calculation result. Homomorphic decryptor D uses the homomorphic decryption key K_dec to decrypt the ciphertext calculation result. The decrypted plaintext is equivalent to the plaintext calculation result.

[0186] 3. Symmetric encryption and asymmetric encryption:

[0187] (1) Symmetric cryptography, also known as private key encryption, is a technique where the sender and receiver of information use the same key to encrypt and decrypt data (i.e., the encryptor and decryptor use the same encryption / decryption key). Its advantage is fast encryption / decryption speed, making it suitable for encrypting large amounts of data. Symmetric encryption typically uses a relatively small key, typically less than 256 bits; it should be noted that the size of the symmetric encryption key must take into account both security and processing efficiency.

[0188] (2) Asymmetric cryptography, also known as public-key cryptography. Asymmetric cryptography uses a pair of keys: a public key and a private key. The private key can only be kept safe by one party, while the public key can be sent to any requesting party. Asymmetric cryptography uses one of the keys (the public key) for encryption, while decryption requires the other key (the private key). Unlike symmetric cryptography, the private key is never sent, which improves security.

[0189] 4. Scenario where there are multiple participants in a homomorphic encryption task:

[0190] Wireless networks are deployed into multiple cells, each with multiple terminals accessing the service cell. Smart cars, smartphones, VR / AR devices, smart cameras, and other terminals equipped with on-board units (OBUs) may have homomorphic security capabilities. When privacy protection is required, sensitive data generated is encrypted and then transmitted to other terminal nodes, roadside units (RSUs), base stations, core network elements, cloud providers, and other nodes in the communication network for homomorphic computation under ciphertext. The calculated ciphertext data is then transmitted to the data user for homomorphic decryption and use. Therefore, there may be multiple homomorphic encryption tasks within the entire network. Based on (fully) homomorphic encryption technology, the communication network can provide privacy protection and privacy computing services for high-security and high-sensitivity services.

[0191] For example, FIG4 is a schematic diagram of a network scenario in which a homomorphic encryption task has multiple participants. Assume that in a homomorphic encryption task, there are K homomorphic encryption parties to encrypt data from different sources, and N homomorphic computing parties to execute homomorphic computing circuits. The homomorphic key generator needs to distribute the derived homomorphic encryption key K_enc to the K homomorphic encryption parties, distribute the homomorphic computing key K_eval (such as the key switching key (KSK), the bootstrapping key (BSK), etc.) to the N homomorphic computing parties, and distribute the homomorphic decryption key K_dec to the homomorphic decryption party (only one homomorphic decryption party is shown in FIG4 , and a homomorphic encryption task can also include multiple homomorphic decryption parties).

[0192] The homomorphic network management in FIG4 is also referred to as a homomorphic encryption control function (HECF) network element, which may include but is not limited to the following management units:

[0193] (1) Homomorphic encryption task management (HETM) unit, which is used to implement the following functions:

[0194] ① Homomorphic Task Request Management: Manages all homomorphic task requests. For example, HETM can receive and parse homomorphic task requests, and respond to homomorphic tasks based on the results of homomorphic task scheduling management. Optionally, HETM can filter out duplicate or unreasonable homomorphic task requests.

[0195] ② Homomorphic task scheduling management: For example, HETM can schedule homomorphic tasks based on the parsing results of homomorphic task requests, the homomorphic security capability list of the homomorphic enabling node (HE Enabler), etc., and issue homomorphic task configurations to the homomorphic encryption party, homomorphic calculation party, and decryption party, and receive homomorphic task responses.

[0196] ③Homomorphic task profile management: For example, HETM can generate homomorphic task profiles (stored in HETM) based on homomorphic task requests, homomorphic task scheduling, etc., and manage profile forwarding, updating, storage, and destruction.

[0197] (2) Homomorphic encryption capability management (HECapM) unit, which is used to implement the following functions: Homomorphic enabled node profile management. For example, HECapM can receive homomorphic security capabilities reported by homomorphic participants such as homomorphic encryption parties, homomorphic decryption parties, and homomorphic computing parties, and generate, store, and update the homomorphic security capability profile registered by the node (stored in HECapM).

[0198] (3) Homomorphic encryption key management (HEKM) unit, which is used to implement the following functions: Key management for homomorphic tasks. For example, HEKM can generate data encryption / decryption keys (symmetric encryption / decryption keys that do not support homomorphic features, or asymmetric encryption / decryption keys, or homomorphic encryption / decryption keys), as well as homomorphic computing keys, and manage key distribution, use, update, storage, destruction, and key lifecycle.

[0199] (4) HECF interface management (HEinterM) unit, which is used to implement the following functions:

[0200] ①Support cross-domain, layered, and multi-node deployment of HECF.

[0201] ②Forwarding information such as the homomorphic security capability profile, homomorphic encryption task profile, and homomorphic key parameters of homomorphic-enabled nodes between HECFs.

[0202] (5) Ciphertext data storage management (CDSM) unit, which is used to implement the following functions:

[0203] ① Management of ciphertext reception and transmission: For example, CDSM can receive ciphertext from a homomorphic-enabled node or an encryption party; or send ciphertext to a homomorphic-enabled node or a decryption party.

[0204] ② Ciphertext lifecycle management: For example, CDSM can set a lifecycle for each ciphertext, starting from the time the ciphertext is received and deleting the ciphertext after the ciphertext lifecycle ends.

[0205] ③ Ciphertext storage management: For example, CDSM can divide different ciphertext storage areas. The division granularity can be different users, different keys, different security contexts, different network layers, or different service slices.

[0206] It should be noted that a homomorphic enabling node can be a terminal (UE), a base station (radio access network RAN), a core network element, an independent node (IN), an application function (AF), etc. A homomorphic enabling node can be a homomorphic encryption party, a homomorphic computing party, or a homomorphic decryption party.

[0207] 5. Security protection of the non-access (NAS) layer and the access (AS) layer:

[0208] Like 4G, the 5G system features two layers of security, with security mode command activation and security protection performed at the NAS layer and the AS layer, respectively. For example, Figure 5 is a schematic diagram of the wireless network protocol layer, primarily illustrating security protection at the NAS layer, the Packet Data Convergence Protocol (PDCP) layer, and the AS layer. After the UE and the network mutually authenticate each other, they need to negotiate the security algorithms and keys used for encryption and integrity protection of RRC / NAS signaling and user data during subsequent communications. For example, after the NAS security algorithm negotiation is complete, all NAS messages between the AMF and the UE are encrypted and integrity protected. During the AS security mode command exchange, the gNodeB and UE negotiate the cryptographic algorithms and keys for AS encryption and integrity protection, and activate encryption and integrity protection of RRC messages and user data at the AS layer. RRC signaling security is implemented at the PDCP layer. Existing 4G and 5G encryption and integrity protection use symmetric key algorithms. The 5G NR control plane protocol stack is identical to that of 4G LTE, as shown in Figure 5. All UE protocol stacks are located within the UE. On the network side, the NAS layer is not located on the base station gNB, but on the AMF entity in the core network. Optionally, the PDCP layer and the protocol sublayers below it do not have any security protection.

[0209] 6. Signaling interaction between the terminal side and the network side:

[0210] For example, the signaling interaction process between the terminal and the network side in the initial access phase may include several stages, namely cell selection, random access, RRC connection establishment, security authentication, and bearer establishment.

[0211] (1) Cell selection: During the initial access phase, the terminal first selects a cell. For example, the terminal receives information such as the primary synchronization signal (PSS) or secondary synchronization signal (PSS) or system information (such as the master information block (MIB) and system information block (SIB)) to obtain the cell configuration information so that it can operate normally after accessing the cell.

[0212] (2) Random Access: After selecting a cell, the terminal initiates random access to the corresponding cell. For example, the terminal sends a random access request message to the access network device, and the access network device feeds back a random access response message to the terminal.

[0213] (3) RRC connection establishment: After the terminal initiates random access, it can initiate RRC connection establishment. For example, the terminal sends an RRC connection establishment request message to the access network device, and the access network device feeds back an RRC connection establishment response message (for example, RRCSetupComplete signaling, indicating that the RRC connection is successfully established) to the terminal.

[0214] (4) Security Authentication: Bidirectional identity authentication is performed on the terminal side and the network side. After successful authentication, key derivation and negotiation at the NAS and AS layers are enabled. It should be noted that before NAS security and AS security are established, all air interface signaling is without any security protection, including RRC signaling and NAS signaling. After NAS security mode is complete (NAS SMC), NAS signaling is encrypted and has integrity protection enabled. After AS security mode is complete (AS SMC), RRC signaling is encrypted and has integrity protection enabled.

[0215] (5) Bearer establishment: For example, the terminal and the access network device establish a data resource bearer (DRB) bearer through the RRC reconfiguration process. The access network device and the terminal activate the corresponding user plane encryption and integrity protection. However, Layer 1 (L1) and Layer 2 (L2) signaling and other data are still not protected.

[0216] 2. This application provides a user-level homomorphic encryption management method:

[0217] For example, Figures 6a and 6b are flow charts of a user-level homomorphic encryption management method provided by the present application. The user-level homomorphic encryption management method can be applied to a communication system as shown in Figure 1. Optionally, the user-level homomorphic encryption management method can be applied to a network scenario in which a homomorphic encryption task has multiple participants as shown in Figure 7. Assume that there are K homomorphic encryption parties (such as homomorphic encryption parties 1 to K) in the network scenario shown in Figure 7 to encrypt data from different sources (such as encrypting plaintext messages of users 1 to K respectively), there are two homomorphic computing parties (such as homomorphic computing party 1 and homomorphic computing party 2) to execute homomorphic computing circuits, and there are K homomorphic decryption parties (such as homomorphic decryption parties 1 to K) to decrypt the ciphertext data. And assume that there are two homomorphic encryption tasks (such as homomorphic encryption task 1 and homomorphic encryption task 2) in the network scenario, wherein homomorphic decryption party 3 participates in both homomorphic encryption task 1 and homomorphic encryption task 2. Ciphertext data can flow between different homomorphic encryption tasks (for example, the homomorphic decryption key and ciphertext data of homomorphic decryption party 3 can be reused by homomorphic encryption tasks 1 and 2).

[0218] Example 1: The user-level homomorphic encryption management method can be implemented by interaction between a terminal and a network device, with the terminal determining the homomorphic encryption algorithm, as shown in Figure 6a. Optionally, the network device includes an access network device and / or a core network element. The user-level homomorphic encryption management method includes the following steps:

[0219] S101: A network device sends a homomorphic security capability of a network side, and correspondingly, a terminal receives the homomorphic security capability of the network side.

[0220] The network's homomorphic security capability refers to the network's ability to perform homomorphic encryption tasks. For example, when the network is the homomorphic encryption party, the network's homomorphic security capability includes the homomorphic encryption algorithms that the network can select.

[0221] Optionally, the network side is not necessarily the homomorphic encryption party. Taking the homomorphic enabling unit as an example, the homomorphic security capability of the homomorphic enabling unit may include but is not limited to one or more of the following parameters: homomorphic enabling unit type (such as base station, terminal, network element, independent node, etc.), identifier (such as base station, terminal, network element, independent node, etc. ID), homomorphic encryption capability level (such as single homomorphic encryption, quasi-homomorphic encryption, hierarchical homomorphic encryption, fully homomorphic encryption), homomorphic encryption security level (such as 128-bit, 256-bit security strength), homomorphic encryption enable identifier (such as True identifier enables homomorphic encryption function, false identifier disables homomorphic encryption function), homomorphic decryption enable identifier (such as True identifier enables homomorphic decryption function, false identifier disables homomorphic decryption function), homomorphic computing enable identifier (such as True identifier enables homomorphic computing function, false identifier disables homomorphic computing function), supported homomorphic encryption algorithm identifier (such as additive single homomorphic encryption algorithm Paillier, multiplicative single homomorphic encryption algorithm ElGamal or RSA, quasi-homomorphic encryption algorithm BGN 05, fully homomorphic encryption algorithms BGV, BFV, CKKS, TFHE, etc.), supported homomorphic computing algorithm identifiers (such as machine learning algorithms (including convolutional neural networks (CNN), recurrent neural networks (RNN), generative adversarial networks (GAN), support vector machines (SVM), etc.)), etc.

[0222] S102: The terminal determines a homomorphic encryption algorithm based on the homomorphic security capabilities of the terminal and the homomorphic security capabilities of the network side.

[0223] For example, the homomorphic encryption algorithms applicable to this application may include but are not limited to the additive single homomorphic encryption algorithm Paillier, the multiplicative single homomorphic encryption algorithm ElGamal or RSA, the quasi-homomorphic encryption algorithm BGN 05, the fully homomorphic encryption algorithms BGV, BFV, CKKS, TFHE, etc.

[0224] S103, the terminal sends a homomorphic encryption algorithm identifier, and correspondingly, the network device receives the homomorphic encryption algorithm identifier.

[0225] The terminal comprehensively considers the homomorphic security capabilities of both the terminal and network sides, and selects a homomorphic encryption algorithm that is applicable to both sides. For example, the terminal determines the homomorphic encryption algorithm based on its homomorphic capability information and the homomorphic security capabilities of the network side.

[0226] In one possible implementation, after the terminal determines the homomorphic encryption algorithm, the terminal can send the homomorphic encryption algorithm identifier to the access network device and / or core network element, so that the terminal and the network side use the same homomorphic encryption algorithm to derive the homomorphic key, which is conducive to the correct execution of the homomorphic task.

[0227] Example 2: The user-level homomorphic encryption management method can be implemented by interaction between the terminal and the network device, and the network device determines the homomorphic encryption algorithm, as shown in Figure 6b. Optionally, the network device includes an access network device and / or a core network element. The user-level homomorphic encryption management method includes the following steps:

[0228] S201: A terminal sends its homomorphic security capability, and correspondingly, a network device receives the homomorphic security capability of the terminal.

[0229] The homomorphic security capability of a terminal refers to the terminal's ability to perform homomorphic encryption tasks. For example, the homomorphic security capability of a terminal includes the homomorphic encryption algorithms that the terminal can select.

[0230] S202: The network device determines a homomorphic encryption algorithm based on the homomorphic security capability of the terminal and the homomorphic security capability of the network side.

[0231] S203, the network device sends a homomorphic encryption algorithm identifier, and correspondingly, the terminal receives the homomorphic encryption algorithm identifier.

[0232] The network side comprehensively considers the homomorphic security capabilities of both the terminal side and the network side, and thus selects a homomorphic encryption algorithm that is applicable to both the terminal side and the network side. The specific implementation method can be referred to the description of the steps performed by the terminal in S102 and S103, which will not be repeated here.

[0233] In the above two examples, the terminal or network side can comprehensively consider the homomorphic security capabilities of the terminal side and the network side to determine the homomorphic encryption algorithm, which is conducive to the terminal providing high user-level privacy protection strength.

[0234] 3. The specific processes of Example 1 and Example 2 in Part 2 are described in detail below.

[0235] 1. Specific process of Example 1: As described in Example 1 above, the terminal determines the homomorphic encryption algorithm, and the network device then sends the network's homomorphic security capabilities to the terminal. The message exchange between the terminal and the network device is secure and integrity protected. In one possible implementation, the message exchange in Example 1 can be included in or after the NAS SMC or AS SMC process.

[0236] Implementation method 1: In the NAS SMC or AS SMC process, the terminal determines the homomorphic encryption algorithm.

[0237] For example, Figure 8a is a flow chart of a method provided by the present application for determining a homomorphic encryption algorithm by a terminal in a security mode completion process. The method is implemented by interaction between the terminal and the network device, and includes the following steps:

[0238] S301: The network device sends a NAS or AS security mode command, where the NAS or AS security mode command includes the homomorphic security capability of the network side. Correspondingly, the terminal receives the NAS or AS security mode command.

[0239] For example, a core network element or an access network device sends a NAS security mode command to the terminal, where the NAS security mode command carries the homomorphic security capability of the core network element or the homomorphic security capability of the access network device.

[0240] S302: The terminal determines the NAS or AS layer homomorphic encryption algorithm based on the homomorphic security capability of the network side and the homomorphic security capability of the terminal.

[0241] S303, the terminal sends a NAS or AS security mode completion message, which includes a NAS or AS layer homomorphic encryption algorithm. Correspondingly, the network device receives the NAS or AS security mode completion message.

[0242] For example, the terminal sends a NAS security mode complete message to the network device, which carries the NAS layer homomorphic encryption algorithm determined by the terminal based on the homomorphic security capabilities of the network and the terminal. Optionally, the message can also include the lifecycle of the homomorphic key.

[0243] S304a, the network device derives a corresponding NAS or AS layer homomorphic key according to the NAS or AS layer homomorphic encryption algorithm.

[0244] S304b, the terminal derives the corresponding NAS or AS layer homomorphic key according to the NAS or AS layer homomorphic encryption algorithm.

[0245] For example, the network device and the terminal can derive their respective corresponding NAS or AS layer homomorphic keys based on the NAS or AS layer homomorphic encryption algorithm. The execution order of S304a and S304b is not limited in this application. For example, S304a can be executed first and then S304b, or S304b can be executed first and then S304a, or S304a and S304b can be executed simultaneously.

[0246] Implementation method 2: After the NAS SMC or AS SMC process, the terminal determines the homomorphic encryption algorithm.

[0247] For example, Figure 8b is a flow chart of a method provided by the present application for determining a homomorphic encryption algorithm by a terminal after completing a process in a secure mode. The method is implemented by interaction between the terminal and the network device, and includes the following steps:

[0248] S401, after completing the signaling process in the security mode, the network device sends a first message, where the first message includes the homomorphic security capability of the network side, and correspondingly, the terminal receives the first message.

[0249] For example, the network device may send a first message (such as other NAS or RRC signaling with confidentiality and integrity protection) to the terminal after the NAS or AS security mode completion message, and the first message carries the homomorphic security capability of the core network network element or the homomorphic security capability of the access network device.

[0250] S402: The terminal determines the NAS or AS layer homomorphic encryption algorithm based on the homomorphic security capability of the network side and the homomorphic security capability of the terminal.

[0251] S403, the terminal sends a second message, which includes a NAS or AS layer homomorphic encryption algorithm, and accordingly, the network device receives the second message.

[0252] For example, after the NAS or AS security mode completion message, the terminal can send a second message (for example, other NAS or RRC signaling with confidentiality and integrity protection) to the network device. The second message carries the NAS or AS layer homomorphic encryption algorithm to inform the network side of the corresponding NAS or AS layer homomorphic encryption algorithm.

[0253] S404a, the network device derives a corresponding NAS or AS layer homomorphic key according to the NAS or AS layer homomorphic encryption algorithm.

[0254] S404b: The terminal derives the corresponding NAS or AS layer homomorphic key according to the NAS or AS layer homomorphic encryption algorithm.

[0255] For example, the network device and the terminal can derive their respective corresponding NAS or AS layer homomorphic keys according to the NAS or AS layer homomorphic encryption algorithm. The execution order of S404a and S404b is not limited in this application. For example, S404a can be executed first and then S404b, or S404b can be executed first and then S404b, or S404a and S404b can be executed simultaneously.

[0256] 2. Specific process of Example 2: As described in Example 2 above, the network device determines the homomorphic encryption algorithm, and the terminal then reports its homomorphic security capabilities to the network device. The message exchange between the terminal and the network device requires security and integrity protection. In one possible implementation, the message exchange in Example 2 can be included in or after the NAS SMC or AS SMC process.

[0257] Implementation method three: In the NAS SMC or AS SMC process, the network device determines the homomorphic encryption algorithm.

[0258] For example, Figure 9a is a flow chart of a method provided by the present application for determining a homomorphic encryption algorithm by a network device in a security mode completion process. The method is implemented by the interaction between the terminal and the network device, and includes the following steps:

[0259] S501: A network device sends a NAS or AS security mode command, where the NAS or AS security mode command includes third indication information. Correspondingly, a terminal receives the NAS or AS security mode command.

[0260] For example, the third indication information is used to instruct the acquisition of the homomorphic security capability of the terminal; that is, the network device needs to acquire the homomorphic security capability of the terminal.

[0261] S502 , the terminal sends a NAS or AS security mode completion message, where the NAS or AS security mode completion message includes the homomorphic security capability of the terminal. Correspondingly, the network device receives the NAS or AS security mode completion message.

[0262] For example, after receiving the third indication information, the terminal may feedback the homomorphic security capability of the terminal in the NAS or AS security mode completion message.

[0263] S503: The network device determines the NAS or AS layer homomorphic encryption algorithm based on the homomorphic security capability of the network side and the homomorphic security capability of the terminal.

[0264] S504, the network device sends a third message, which includes a NAS or AS layer homomorphic encryption algorithm. Correspondingly, the terminal receives the third message.

[0265] For example, after the NAS or AS security mode is completed, the network device can carry the NAS or AS layer homomorphic encryption algorithm in other NAS or RRC signaling with confidentiality and integrity protection to inform the terminal of the corresponding NAS or AS layer homomorphic encryption algorithm.

[0266] S505a, the network device derives the corresponding NAS or AS layer homomorphic key according to the NAS or AS layer homomorphic encryption algorithm.

[0267] S505b: The terminal derives the corresponding NAS or AS layer homomorphic key according to the NAS or AS layer homomorphic encryption algorithm.

[0268] For example, the network device and the terminal can derive their respective corresponding NAS or AS layer homomorphic keys according to the NAS or AS layer homomorphic encryption algorithm. The execution order of S505a and S505b is not limited in this application. For example, S505a can be executed first and then S505b, or S505b can be executed first and then S505a, or S505a and S505b can be executed simultaneously.

[0269] Implementation method 4: After the NAS SMC or AS SMC process, the network device determines the homomorphic encryption algorithm.

[0270] For example, Figure 9b is a flow chart of a method provided by the present application for determining a homomorphic encryption algorithm by a network device after completing a process in a secure mode. The method is implemented by interaction between a terminal and a network device, and includes the following steps:

[0271] S601: After completing the signaling process in the security mode, the network device sends a fourth message including third indication information. Correspondingly, the terminal receives the fourth message.

[0272] For example, the third indication information is used to instruct the acquisition of the homomorphic security capability of the terminal; that is, the network device needs to acquire the homomorphic security capability of the terminal.

[0273] S602: The terminal sends a fifth message, where the fifth message includes the homomorphic security capability of the terminal. Correspondingly, the network device receives the fifth message.

[0274] For example, after receiving the third indication information, the terminal can feedback the homomorphic security capability of the terminal through other NAS or RRC signaling with confidentiality and integrity protection.

[0275] S603: The network device determines the NAS or AS layer homomorphic encryption algorithm based on the homomorphic security capability of the network side and the homomorphic security capability of the terminal.

[0276] S604, the network device sends a sixth message to the terminal, where the sixth message includes a NAS or AS layer homomorphic encryption algorithm. Correspondingly, the terminal receives the sixth message.

[0277] For example, after the NAS or AS security mode is completed, the network device can carry the NAS or AS layer homomorphic encryption algorithm in other NAS or RRC signaling with confidentiality and integrity protection to inform the terminal of the corresponding NAS or AS layer homomorphic encryption algorithm.

[0278] S605a, the network device derives a corresponding NAS or AS layer homomorphic key according to the NAS or AS layer homomorphic encryption algorithm.

[0279] S605b: The terminal derives the corresponding NAS or AS layer homomorphic key according to the NAS or AS layer homomorphic encryption algorithm.

[0280] For example, the network device and the terminal can derive their respective corresponding NAS or AS layer homomorphic keys according to the NAS or AS layer homomorphic encryption algorithm. The execution order of S605a and S605b is not limited in this application. For example, S605a can be executed first and then S605b, or S604b can be executed first and then S605b, or S605a and S605b can be executed simultaneously.

[0281] Optionally, for the above-mentioned embodiments one to four, the network device and the terminal can derive their respective corresponding homomorphic keys according to the homomorphic encryption algorithm. For example, the terminal or the network device determines the homomorphic encryption key and / or the homomorphic decryption key according to the homomorphic encryption algorithm; wherein the homomorphic encryption key is used to encrypt the plaintext message into the first ciphertext, and the homomorphic decryption key is used to decrypt the second ciphertext after homomorphic calculation into the plaintext message. The user-level homomorphic encryption key and / or homomorphic decryption key in this application is decoupled from the homomorphic encryption task. For example, the life cycle of the user-level homomorphic encryption key and / or homomorphic decryption key has nothing to do with the duration of the homomorphic encryption task. The life cycle of the user-level homomorphic encryption key and / or homomorphic decryption key can be the time between the success and release of the user's radio resource control RRC connection; that is, the life cycle of the user-level homomorphic encryption key and / or homomorphic decryption key is within the time period between the successful derivation of the user-level homomorphic encryption / decryption key and the destruction of the homomorphic encryption / decryption key, wherein the user is the homomorphic encryption party or the homomorphic decryption party.

[0282] Optionally, for the above-mentioned embodiments one to four, after the network device and the terminal derive their respective corresponding homomorphic encryption keys and / or homomorphic decryption keys, they can also store the first ciphertext and its corresponding key information, and / or the second ciphertext and its corresponding key information. Among them, the key information includes one or more of the homomorphic encryption key, homomorphic decryption key, homomorphic computation key, key derivation parameter, and security context. For example, if the network device and the terminal are homomorphic encryption parties, they can encrypt the plaintext message according to their respective homomorphic encryption keys to obtain the first ciphertext. In order to be able to reuse ciphertext data (such as the first ciphertext and / or the second ciphertext) multiple times in the communication network, the ciphertext data needs to be stored in conjunction with the corresponding homomorphic key, or key derivation parameter, or homomorphic security context. It should be noted that the key information refers to the corresponding encryption / decryption key or key-related parameters when the stored ciphertext data is encrypted, and has nothing to do with the RRC state of the terminal.

[0283] Optionally, in addition to the steps in the above embodiments 1 to 4, the user-level homomorphic encryption management method provided in this application may also include the following process:

[0284] 3. Key derivation of homomorphic computation keys:

[0285] After the homomorphic encryption task is created, the terminal or network device can receive the homomorphic computing key, which is used for one or more homomorphic computing parties in the homomorphic encryption task to perform homomorphic computing under the first ciphertext to output the second ciphertext. Among them, the homomorphic computing key can be a homomorphic key derived from the USIM symmetric key architecture or the key management center (KMC) independent key architecture. It should be noted that the homomorphic computing key in this application is coupled with the homomorphic encryption task. For example, the life cycle of the homomorphic computing key is the duration of the homomorphic encryption task.

[0286] For example, Figure 10 is a schematic diagram of a key derivation process for a homomorphic computation key provided by this application. The process is implemented by the interaction between the participants of the homomorphic task (for example, including terminals and network devices) and the homomorphic key management entity (for example, homomorphic key management based on the USIM symmetric key architecture or the KMC independent key architecture), and includes the following steps:

[0287] S701: The terminal sends the homomorphic security capability of the terminal, and correspondingly, the network device receives the homomorphic security capability of the terminal.

[0288] Optionally, before S701 , authentication and key agreement (AKA) has been completed between the terminal and the network device.

[0289] S702, the homomorphic key management entity sends a homomorphic encryption task request. Correspondingly, the network device receives the homomorphic encryption task request and performs homomorphic task scheduling.

[0290] For example, a network device receives a homomorphic encryption task request message from a homomorphic task requester, where the homomorphic encryption task request message includes the type of homomorphic encryption task requested (e.g., artificial intelligence (AI) training / inference, data compression, etc.), or the type of homomorphic encryption task output result (e.g., AI model class parameters, perception class, control instructions), etc. The network device can perform homomorphic task orchestration (e.g., determine the homomorphic encryption party, homomorphic computation party, and homomorphic decryption party) based on the request message.

[0291] S703, the network device sends a homomorphic computing key derivation request message, and correspondingly, the homomorphic key management entity receives the homomorphic computing key derivation request message.

[0292] S704: The homomorphic key management entity determines the homomorphic computing key corresponding to the homomorphic encryption task.

[0293] For example, a homomorphic computing key derivation request message is used to request the homomorphic key management entity to derive the corresponding homomorphic computing key for the homomorphic encryption task. After receiving the homomorphic computing key derivation request message, the homomorphic key management entity can derive the homomorphic computing key corresponding to the homomorphic encryption task based on the requested homomorphic encryption task output result type, homomorphic encryption / decryption key, etc.

[0294] S705 , the homomorphic key management entity sends the homomorphic computing key, and correspondingly, the terminal and the network device receive the homomorphic computing key.

[0295] For example, assuming that in the homomorphic encryption task, the homomorphic computing parties include a terminal and an access network device, the homomorphic key management entity can send the homomorphic computing key to the terminal and the network device respectively.

[0296] 4. Destruction of homomorphic keys:

[0297] When the life cycle of the homomorphic key ends, both the terminal and the network device will destroy the homomorphic key. In one possible implementation, whether the life cycle ends is determined based on the RRC connection state of the terminal. For example, when the RRC connection state of the terminal changes, such as when the UE enters the idle state, it is determined that the life cycle of the homomorphic key ends, and the terminal and the network device destroy their respective homomorphic keys. In another possible implementation, if the RRC message (such as RRC release (RRCRelease) message, or other RRC signaling) or NAS message sent by the network device to the terminal carries a homomorphic key destruction-related indication, then both the terminal and the network device will destroy the corresponding AS layer or NAS layer homomorphic key. In another possible implementation, the terminal determines that the RRC connection has been disconnected based on its own RRC connection state, then the terminal can determine that the life cycle of the homomorphic key ends and destroy the homomorphic key of the terminal.

[0298] For example, FIG11 is a schematic diagram of a process of homomorphic key destruction provided by the present application. The process can be implemented by the interaction between the terminal and the network device, and the network device sends a homomorphic key destruction related instruction to the terminal, including the following steps:

[0299] S801, the network device sends first indication information, where the first indication information is used to instruct the destruction of the homomorphic key. Correspondingly, the terminal receives the first indication information.

[0300] Destroying the homomorphic key includes destroying the homomorphic encryption key, the homomorphic decryption key, or the homomorphic computation key. For example, the terminal receives NAS signaling from the network device, the NAS signaling carrying first indication information for instructing the terminal to destroy the NAS layer homomorphic key. Alternatively, the terminal receives an RRCRelease message from the network device, the RRCRelease message carrying first indication information for instructing the terminal to destroy the AS layer homomorphic key.

[0301] S802a: The network device destroys the homomorphic key.

[0302] S802b: The terminal destroys the homomorphic key.

[0303] For example, the network device destroys the NAS or AS layer homomorphic encryption key / homomorphic decryption key / homomorphic computation key, and the terminal destroys the NAS or AS layer homomorphic encryption key / homomorphic decryption key / homomorphic computation key. Optionally, when the homomorphic encryption task ends, even without the first indication information, the terminal and the network device will also destroy the homomorphic computation key.

[0304] In this application, user-level homomorphic keys (including homomorphic encryption keys and homomorphic decryption keys) are not related to homomorphic encryption tasks, but only to homomorphic enabling nodes (such as homomorphic encryptors or homomorphic decryptors). For example, when the user's radio resource control (RRC) connection is released, the homomorphic keys will be destroyed (that is, the homomorphic keys will be invalid).

[0305] 5. Update of homomorphic keys:

[0306] For example, FIG12 is a schematic diagram of a homomorphic key update process provided by the present application. The process can be implemented by interaction between a terminal and a network device, including the following steps:

[0307] S901, the network device sends second indication information, where the second indication information is used to indicate updating of the homomorphic key, and correspondingly, the terminal receives the second indication information.

[0308] Among them, updating the homomorphic key includes updating one or more of the homomorphic encryption key, the homomorphic decryption key, and the homomorphic computation key. For example, if the RRC signaling (such as RRCReconfiguration) received by the terminal indicates a homomorphic key update (such as HEKeyUpdate), the terminal and the network device will re-derive the AS layer homomorphic encryption key / homomorphic computation key / homomorphic decryption key. For another example, if the NAS signaling received by the terminal indicates a homomorphic key update, the terminal and the network device will re-derive the NAS layer homomorphic encryption key / homomorphic computation key / homomorphic decryption key.

[0309] S902a, the network device updates the homomorphic key.

[0310] S902b: The terminal updates the homomorphic key.

[0311] For example, the network device updates the NAS or AS layer homomorphic encryption key / homomorphic decryption key / homomorphic computing key, and the terminal updates the NAS or AS layer homomorphic encryption key / homomorphic decryption key / homomorphic computing key.

[0312] 4. Another user-level homomorphic encryption management method provided by this application:

[0313] For example, Figure 13 is a flow chart of another user-level homomorphic encryption management method provided by this application. The user-level homomorphic encryption management method can be applied to the communication system shown in Figure 1 or the network scenario shown in Figure 7. The user-level homomorphic encryption management method can be executed by a first entity. Optionally, the first entity can be a homomorphic encryption management entity (such as a HECF network element, or a HEKM unit, or a security network element as shown in Figure 1, or a terminal, or an access network device). The user-level homomorphic encryption management method includes the following steps:

[0314] S1001: The first entity determines a homomorphic encryption key or a homomorphic decryption key based on a superior key and homomorphic encryption algorithm information.

[0315] S1002, the first entity uses a homomorphic encryption key to encrypt a plaintext message into a first ciphertext, or uses a homomorphic decryption key to decrypt a second ciphertext after homomorphic calculation into a plaintext message.

[0316] In this embodiment, the first entity derives a homomorphic key based on the USIM symmetric key architecture or the KMC independent key architecture.

[0317] Among them, the superior key includes but is not limited to: the anchor key in the USIM symmetric key architecture, the key derived based on the anchor key, the working key in the KMC independent key architecture, or the key derived based on the working key. For example, if the first entity adopts the USIM symmetric key architecture to derive the homomorphic key, the superior key can be the anchor key derived by the first network element (for example, a network element or entity with an authentication function, such as SEAF, etc.) (such as K_SEAF derived from SEAF, etc.), or the second key derived from the anchor key by the second network element (for example, a network element or entity with access and mobility management, such as AMF, etc.) (such as K_AMF derived from AMF, etc.). For another example, if the first entity adopts the KMC independent key architecture to derive the homomorphic key, the superior key can be the working key (such as K_work) of the independent key architecture.

[0318] The homomorphic encryption algorithm information includes but is not limited to the algorithm identifier, algorithm type, service network name, network function type, identity identifier (such as subscription permanent identifier (SUPI)), non-access stratum count value (NAS count), ABBA parameters, random number RAND, etc. Optionally, when the first entity adopts the USIM symmetric key architecture or the KMC independent key architecture to derive the homomorphic key, the homomorphic encryption algorithm information may be different.

[0319] For example, when the first entity adopts the USIM symmetric key architecture, the upper key is K_SEAF, and the homomorphic encryption algorithm information is the first homomorphic algorithm input parameter (including algorithm type, algorithm identifier, network function type, identity identifier, NAS count, ABBA parameters, etc.), the first entity can determine the NF's homomorphic encryption key K_NF_HE based on K_SEAF and the first homomorphic algorithm input parameters. Then, the first entity uses the homomorphic encryption key to encrypt the plaintext message into the first ciphertext, or uses the homomorphic decryption key to decrypt the second ciphertext after homomorphic calculation into a plaintext message.

[0320] Optionally, the first entity may also derive a homomorphic computing key. For example, the first entity derives a homomorphic computing key based on a USIM symmetric key architecture or a KMC independent key architecture. After S1002, the following steps are also included:

[0321] The first entity determines a homomorphic computing key based on the homomorphic encryption key or the homomorphic decryption key, where the homomorphic computing key is used by the homomorphic computing party to perform homomorphic computing on the first ciphertext to output a second ciphertext;

[0322] The first entity sends a homomorphic computation key.

[0323] For example, assuming that the homomorphic encryption key derived by the first entity is the homomorphic encryption key K_NF_HE of NF, the first entity can derive the corresponding homomorphic computing keys K_BSK, K_KSK based on K_NF_HE, and send them to the homomorphic computing parties such as the terminal and / or access network equipment.

[0324] In this embodiment, the first entity can derive homomorphic keys based on the USIM symmetric key architecture or the KMC independent key architecture (the above-mentioned symmetric key architecture or independent key architecture derives related keys based on the superior key) and homomorphic encryption algorithm information, thereby realizing the user-level key architecture and management of homomorphic encryption.

[0325] 5. The following describes in detail the homomorphic key derived from the USIM symmetric key architecture, the KMC independent key architecture, and the homomorphic encryption algorithm information.

[0326] 1. Example 1: Deriving a homomorphic encryption key, homomorphic decryption key, or homomorphic computation key based on the USIM symmetric key architecture and homomorphic encryption algorithm information.

[0327] For example, Figure 14a is a schematic diagram of a homomorphic key derived from a USIM symmetric key architecture provided by this application. The difference between this USIM symmetric key architecture and Figure 2 is that this application adds a homomorphic key (such as the homomorphic key re-derived by the first entity such as K_AMF_HE, K_gNB_HE, K_N3IWF_HE in the shaded box in Figure 14a).

[0328] (1) The first entity (e.g., AMF or other NF) can derive a homomorphic key of the core network or terminal based on the symmetric key architecture shown in FIG14a , and use it to perform homomorphic encryption, homomorphic decryption, or homomorphic calculation on data generated in the core network or terminal.

[0329] In one possible implementation, the first entity determines the homomorphic encryption key or homomorphic decryption key of the network function NF network element based on the first key and the first homomorphic algorithm input parameter. The first key is an anchor key derived from the first network element (for example, a network element or entity with an authentication function), and the first homomorphic algorithm input parameter includes one or more of the algorithm type, algorithm identifier, network function type, user identity identifier, non-access layer count value NAS count, and ABBA parameters. For example, based on K_SEAF and the first homomorphic algorithm input parameter, the corresponding user-level homomorphic encryption / decryption key K_NF_HE is derived for each NF and stored locally in the NF. The NF then derives the homomorphic computing keys K_BSK and K_KSK from the homomorphic encryption / decryption key K_NF_HE according to the specific homomorphic encryption task, and sends them to homomorphic computing nodes such as gNB / NFs.

[0330] In another possible implementation, the first entity determines the homomorphic encryption key or homomorphic decryption key of the second network element (for example, a network element or entity with access and mobility management functions) based on the second key and the second homomorphic algorithm input parameters. The second key is a key derived by the second network element from the anchor key, and the second homomorphic algorithm input parameters include one or more of the algorithm type, algorithm identifier, and non-access layer count value NAS count. For example, based on K_AMF and the second homomorphic algorithm input parameters, the AMF derives the corresponding user-level homomorphic encryption / decryption key K_AMF_HE and stores it in the AMF. The AMF then derives the homomorphic computing keys K_BSK and K_KSK from the homomorphic encryption / decryption key K_AMF_HE according to the specific homomorphic encryption task, and sends them to homomorphic computing nodes such as gNB / NFs.

[0331] (2) The first entity (e.g., an access network device) can derive a homomorphic key of the access network based on the symmetric key architecture shown in FIG14a , and use it to perform homomorphic encryption, homomorphic decryption, or homomorphic calculation on data generated in the access network or terminal.

[0332] In one possible implementation, the first entity determines the homomorphic encryption key or homomorphic decryption key of the access network device based on the third key and the third homomorphic algorithm input parameters, where the third key is a key derived from the second key by the second network element, and the third homomorphic algorithm input parameters include the algorithm type and / or algorithm identifier.

[0333] For example, based on K_gNB and the third homomorphic algorithm input parameters, the gNB derives the corresponding user-level homomorphic encryption / decryption key K_gNB_HE and stores it within the gNB. Based on the specific homomorphic encryption task, the gNB then derives the homomorphic computation keys K_BSK and K_KSK from the homomorphic encryption / decryption key K_gNB_HE and sends them to homomorphic computation nodes such as the gNB / UEs. For another example, based on K_N3IWF_HE and the third homomorphic algorithm input parameters, the N3IWF derives the corresponding user-level homomorphic encryption / decryption key K_N3IWF_HE and stores it within the N3IWF. Based on the specific homomorphic encryption task, the N3IWF then derives the homomorphic computation keys K_BSK and K_KSK from the homomorphic encryption / decryption key K_N3IWF_HE and sends them to homomorphic computation nodes such as the gNB / UEs.

[0334] (3) List of homomorphic keys and homomorphic encryption algorithms based on the USIM symmetric key architecture:

[0335] For example, Table 1 lists homomorphic keys and homomorphic encryption algorithm information based on the USIM symmetric key architecture. Table 1 uses K_AMF_HE, K_NF_HE, K_gNB_HE, and K_N3IWF_HE as examples for description. Other homomorphic keys not shown are similar.

[0336] Table 1: List of homomorphic keys and homomorphic encryption algorithms based on the USIM symmetric key architecture

[0337] The algorithm type may include, but is not limited to, N-NAS-enc-alg, N-NAS-int-alg, N-RRC-enc-alg, N-RRC-int-alg, N-UP-enc-alg, N-UP-int-alg, and N-HE-enc-alg. In one possible implementation, the algorithm type may be represented by an index / value. For example, Table 2 shows an algorithm type and its corresponding value.

[0338] Table 2: Algorithm types and their corresponding values

[0339] Among them, the algorithm identifier may include but is not limited to: null ciphering algorithm, SNOW 3G based algorithm, advanced encryption standard (AES) based algorithm (AES based algorithm), Zu Chongzhi based algorithm (ZUC based algorithm), single homomorphic encryption algorithm (such as Paillier, ElGamal, etc.), arithmetic type fully homomorphic encryption algorithm (such as BGV, BFV, CKKS, etc.), logical type fully homomorphic encryption algorithm (such as TFHE, etc.), etc. In one possible implementation, the algorithm identifier can be represented by an index / value. For example, Table 3 is an algorithm identifier and its corresponding value table.

[0340] Table 3: Algorithm identifiers and their corresponding values

[0341] 2. Example 2: Deriving homomorphic encryption keys / homomorphic decryption keys / homomorphic computation keys based on the KMC independent key architecture and homomorphic encryption algorithm information.

[0342] For example, Figure 14b is a schematic diagram of a homomorphic key derived from a KMC independent key architecture provided by this application. The difference between this KMC independent key architecture and the USIM symmetric key architecture is that a unified key management entity (such as KMC) generates homomorphic keys, which are then distributed by KMC to each homomorphic participant.

[0343] (1) KMC can derive the core network's homomorphic key based on the independent key architecture shown in Figure 14b, which is used to perform homomorphic encryption, homomorphic decryption, or homomorphic calculation on data generated in the core network or terminal.

[0344] In one possible implementation, the superior key is the working key K_work of the independent key architecture. The first entity determines the homomorphic encryption key or homomorphic decryption key of the core network element based on the working key of the independent key architecture and the fourth homomorphic algorithm input parameters. The fourth homomorphic algorithm input parameters include one or more of the following: a random number RAND, a service network name, a network function type, an algorithm type, an algorithm identifier, a user identity identifier, and an ABBA parameter.

[0345] For example, the KMC derives the user-level homomorphic encryption / decryption key K_NF_HE for the NF based on K_work and the input parameters of the fourth homomorphic algorithm. The KMC distributes K_NF_HE, which the NF receives and stores locally. Based on the specific homomorphic encryption task, the KMC derives the homomorphic computation keys K_BSK and K_KSK from the homomorphic encryption / decryption key K_NF_HE and sends them to homomorphic computation nodes such as the gNB / NFs. For another example, based on K_work and the input parameters of the fourth homomorphic algorithm, the KMC derives the user-level homomorphic encryption / decryption key K_AMF_HE for the AMF. The KMC distributes K_AMF_HE, which the AMF receives and stores locally. Based on the specific homomorphic encryption task, the KMC derives the homomorphic computation keys K_BSK and K_KSK from the homomorphic encryption / decryption key K_AMF_HE and sends them to homomorphic computation nodes such as the gNB / NFs.

[0346] (2) KMC can derive the homomorphic key of the access network based on the independent key architecture shown in Figure 14b, which is used to perform homomorphic encryption, homomorphic decryption, or homomorphic calculation on data generated in the access network or terminal.

[0347] In one possible implementation, the superior key is the working key K_work of the independent key architecture. The first entity determines the homomorphic encryption key and the homomorphic decryption key of the access network device based on the working key of the independent key architecture and the fifth homomorphic algorithm input parameters. The fifth homomorphic algorithm input parameters include one or more of the following: a random number RAND, a service network name, a network function type, an algorithm type, an algorithm identifier, a user identity identifier, an ABBA parameter, a non-access stratum count value NAS count, and an access type.

[0348] For example, the KMC derives the corresponding user-level homomorphic encryption / decryption key K_gNB_HE for the gNB based on K_work and the fifth homomorphic algorithm input parameters and stores it in the gNB. The gNB then derives the homomorphic computation keys K_BSK and K_KSK from the homomorphic encryption / decryption key K_gNB_HE based on the specific homomorphic encryption task and sends them to homomorphic computation nodes such as the gNB / UEs. For another example, the N3IWF derives the corresponding user-level homomorphic encryption / decryption key K_N3IWF_HE based on K_work and the fifth homomorphic algorithm input parameters. The KMC distributes K_N3IWF_HE, and the AMF receives K_N3IWF_HE and stores it in the N3IWF. The KMC then derives the homomorphic computation keys K_BSK and K_KSK from the homomorphic encryption / decryption key K_N3IWF_HE based on the specific homomorphic encryption task and sends them to homomorphic computation nodes such as the gNB / UEs.

[0349] (3) List of homomorphic keys and homomorphic encryption algorithms based on the KMC independent key architecture:

[0350] For example, Table 4 lists homomorphic keys and homomorphic encryption algorithm information based on the KMC independent key architecture. Table 4 uses K_AMF_HE, K_NF_HE, K_gNB_HE, and K_N3IWF_HE as examples for description. Other homomorphic keys not shown are similar.

[0351] Table 4: List of homomorphic keys and homomorphic encryption algorithms based on the KMC independent key architecture

[0352] For examples of algorithm types and algorithm identifiers, please refer to the corresponding description in Example 1 and will not be repeated here.

[0353] 3. Based on the USIM symmetric key architecture and KMC independent key architecture, it supports the derivation of symmetric or asymmetric user-level homomorphic encryption / decryption keys.

[0354] Taking the USIM symmetric key architecture as an example, assuming that the AMF uses the USIM symmetric key architecture to derive symmetric homomorphic encryption / decryption keys, the AMF derives the homomorphic key K_AMF_HE based on K_AMF and uses K_AMF_HE as the symmetric homomorphic encryption key and homomorphic decryption key. Optionally, the AMF derives the homomorphic computing keys K_BSK and K_KSK based on K_AMF_HE according to the specific homomorphic encryption task. For another example, assuming that the AMF uses the USIM symmetric key architecture to derive asymmetric homomorphic encryption / decryption keys, the AMF derives the homomorphic key K_AMF_HE based on K_AMF and uses K_AMF_HE as the asymmetric private key, and the private key is used as the homomorphic decryption key. Then, based on the homomorphic decryption key, the AMF continues to derive the public key K_AMF_HE_EN, and the public key is used as the homomorphic encryption key. Optionally, AMF derives homomorphic computing keys K_BSK and K_KSK based on the asymmetric homomorphic encryption key K_AMF_HE_EN and homomorphic decryption key K_AMF_HE according to the specific homomorphic encryption task.

[0355] It is understandable that the KMC independent key architecture supports the processing method of deriving symmetric or asymmetric user-level homomorphic encryption / decryption keys, which is similar to the above example and will not be repeated here.

[0356] 6. In a homomorphic encryption network scenario, multiple homomorphic encryption parties use different homomorphic encryption keys, multiple homomorphic computing parties use different homomorphic computing keys, and multiple homomorphic decryption parties use different homomorphic decryption keys.

[0357] For example, for a homomorphic encryption task, the scenario assumptions of this embodiment are as follows: the homomorphic encryption party is on the terminal side (for example, including multiple terminals, UE_1, UE_2, ..., UE_K), and the homomorphic encryption keys of the multiple homomorphic encryption parties are different. The homomorphic decryption party is on the network side (for example, including K homomorphic decryption parties, which can be CN / APP, etc.), and the homomorphic decryption keys of the K homomorphic decryption parties are different (assuming that they are K temporary homomorphic decryption keys respectively), that is, no single network element / entity holds all homomorphic decryption keys. The homomorphic computing party is on the network side (for example, including multiple devices or entities, which can be base stations gNB, roadside stations RSU, network elements NF, etc.).

[0358] Among them, since no single network element / entity holds all homomorphic decryption keys, this embodiment is an interactive homomorphic key generation process. For example, Figure 15 is a schematic diagram of an interactive homomorphic key generation process provided by this application. The process is implemented by the interaction between a homomorphic key generator (such as HEKM), multiple homomorphic encryption parties (such as homomorphic encryption party 1 to homomorphic encryption party K), multiple homomorphic decryption parties (such as homomorphic decryption party 1 to homomorphic decryption party K), and multiple homomorphic computing parties (such as homomorphic computing party 1 and homomorphic computing party 2), and includes the following steps:

[0359] In step S1101, a homomorphic key generator sends a public reference quantity for a homomorphic encryption task, and K homomorphic encryption parties receive the public reference quantity for the homomorphic encryption task. The public reference quantity is used to derive a homomorphic decryption key / homomorphic computation key.

[0360] The set of integers is represented by Represents a set of integers with ciphertext modulus q and dimension n. For convenience of description, the superscript or subscript of the set of integers can be omitted. For example, the set of integers can be expressed as represents a polynomial ring with ciphertext modulus q and dimension 2, where the subscript indicates the ciphertext modulus is q and the superscript indicates the dimension is 2. Z represents the set of positive integers.

[0361] For example, the homomorphic key generator derives multiple homomorphic decryption keys based on the key generation parameters of the homomorphic encryption task. For example, any homomorphic decryption key K dec Expressed as in, is the randomly generated homomorphic decryption key component in the fully homomorphic encryption algorithm, 1≤i≤N.

[0362] The homomorphic key generator selects a public reference quantity. For example, the first random polynomial vector is selected And the gadget decomposition vector g∈Z dAs a common reference quantity, d represents the gadget dimension.

[0363] Optionally, before S1101, a secure channel has been established between the homomorphic key generator, multiple homomorphic encryption parties, multiple homomorphic decryption parties and multiple homomorphic computing parties.

[0364] S1102, multiple homomorphic decryption parties determine and feedback their respective public keys and temporary homomorphic computation keys based on the common reference quantity and their respective homomorphic decryption keys.

[0365] Optionally, the homomorphic key generation direction sends corresponding homomorphic decryption keys to multiple homomorphic decryption parties respectively.

[0366] Optionally, the K homomorphic decryption parties derive multiple homomorphic decryption keys on their own and store them securely locally.

[0367] For example, any homomorphic decryption party i based on the public reference and its own homomorphic decryption key s i , generate the corresponding public key b i , and send the public key b to the homomorphic key generator i .in, e i Indicates noise.

[0368] For example, any homomorphic decryption party i uses the public reference and its own homomorphic decryption key s i , generate the corresponding temporary homomorphic computation key D i , and sends the temporary homomorphic calculation key D to the homomorphic key generator i For example, D i It can be composed of three parts, expressed as Among them, d i,1 is based on Certainly, it can be expressed as The arrow represents sampling a number from the set U(), where U() is a polynomial ring. The set that satisfies the uniform distribution. i,0 is based on the homomorphic decryption key component s i , public reference quantity g, random distribution polynomial ring sampling r i and random noise e i1 Certainly, it can be expressed as d i,2 is a polynomial ring sampled from a random distribution r i , the first random polynomial vector a, the homomorphic decryption key component s i , common reference quantity g and random noise e i2 Certainly, it can be expressed as

[0369] S1103, the homomorphic key generator sends the homomorphic encryption keys corresponding to the K homomorphic encryption parties, and correspondingly, the K homomorphic encryption parties receive the corresponding homomorphic encryption keys.

[0370] For example, the homomorphic key generator will derive the public key b i As the homomorphic encryption key of each homomorphic encryption party, and send the corresponding homomorphic encryption key to each homomorphic encryption party.

[0371] Optionally, multiple homomorphic encryption parties can homomorphically encrypt the plaintext message based on their respective homomorphic encryption keys.

[0372] S1104: The homomorphic key generator determines a common homomorphic computation key based on multiple public keys and a temporary homomorphic computation key.

[0373] For example, taking the KSK algorithm as an example, the public homomorphic computation key derived by the homomorphic key generator consists of a matrix with K rows and columns, where K is the number of homomorphic encryption keys. Each element K of the public homomorphic computation key is i,j By [k i,j, 0|k i,j,1 |k i,j,2 ] consists of three parts, the first two parts of the public homomorphic calculation key element [k i,j,0 |k i,j,1 ] is based on the first two components of the temporary homomorphic calculation key [d i,0 |d i,1 ] and public key b j The gadget components are multiplied to obtain the third part k of the public homomorphic calculation key element i,j,2 Equal to the third component d of the aforementioned temporary homomorphic calculation key i,2 The public homomorphic computation key can be expressed as in,

[0374] S1105, the homomorphic key generator sends a public homomorphic computing key, and correspondingly, multiple homomorphic computing parties receive the public homomorphic computing key.

[0375] For example, HEKM sends the public homomorphic computing key to homomorphic computing party 1 and homomorphic computing party 2 respectively.

[0376] Optionally, after receiving the public homomorphic computing key, the homomorphic computing party may use the public homomorphic computing key to perform homomorphic computing.

[0377] In this embodiment, in the same homomorphic encryption task, although no single network element / entity holds all homomorphic decryption keys, the reuse of ciphertext data can be achieved through the interaction between the homomorphic key generator, homomorphic encryptor, homomorphic calculator and homomorphic decryptor, so that user-level homomorphic encrypted data can flow and be homomorphically calculated in different homomorphic encryption tasks.

[0378] In order to realize the various functions in the method provided by the present application, the device or equipment provided by the present application may include a hardware structure and / or a software module, and realize the above-mentioned various functions in the form of a hardware structure, a software module, or a hardware structure plus a software module. Whether a certain function among the above-mentioned functions is executed in the form of a hardware structure, a software module, or a hardware structure plus a software module depends on the specific application and design constraints of the technical solution. The division of modules in the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, the various functional modules in the various embodiments of the present application can be integrated into a processor, or they can exist physically separately, or two or more modules can be integrated into one module. The above-mentioned integrated modules can be implemented in the form of hardware or in the form of software functional modules.

[0379] Figure 16 is a schematic diagram of a communication device provided by the present application. The device may include a module corresponding to each of the methods / operations / steps / actions described in any of the embodiments shown in Figures 6a to 15 . The module may be implemented as a hardware circuit, software, or a combination of hardware circuits and software.

[0380] The apparatus 1600 includes a communication unit 1601 and a processing unit 1602, and is configured to implement the methods executed by the various devices in the aforementioned embodiments.

[0381] In one possible implementation, the device is a terminal or is located in a terminal. Specifically, the communication unit 1601 is used to receive the homomorphic security capability of the network side. The processing unit 1602 is used to determine the homomorphic encryption algorithm based on the homomorphic security capability of the terminal and the homomorphic security capability of the network side. The communication unit 1601 is also used to send a homomorphic encryption algorithm identifier.

[0382] The specific execution process of the communication unit 1601 and the processing unit 1602 in this embodiment can refer to the description of the steps executed by the terminal in the previous method embodiment, as well as the corresponding description in the content of the invention, which will not be repeated here. In the communication method implemented by the device, the terminal can receive the homomorphic security capability of the network side, thereby comprehensively considering the homomorphic security capabilities of the terminal side and the network side to determine the homomorphic encryption algorithm, which is beneficial for the terminal to provide user-level high privacy protection strength. Moreover, since the homomorphic encryption algorithm comprehensively considers the homomorphic security capabilities of the terminal side and the network side, it is beneficial to improve the reusability of the homomorphic key. Moreover, it is beneficial for the ciphertext data generated based on the homomorphic key to circulate and perform homomorphic calculations in different homomorphic encryption tasks.

[0383] In one possible implementation, the device is a terminal or is located in a terminal. Specifically, the communication unit 1601 is used to send the homomorphic security capabilities of the terminal. The communication unit 1601 is also used to receive a homomorphic encryption algorithm identifier, where the homomorphic encryption algorithm is determined by the network device based on the homomorphic security capabilities of the terminal and the homomorphic security capabilities of the network side.

[0384] The specific execution process of the communication unit 1601 and the processing unit 1602 in this embodiment can refer to the description of the steps executed by the terminal in the previous method embodiment, as well as the corresponding description in the content of the invention, which will not be repeated here. In the communication method implemented by the device, the terminal can send its own homomorphic security capabilities to the network device, and the network device comprehensively considers the homomorphic security capabilities of the terminal side and the network side to determine the homomorphic encryption algorithm, and feeds back the homomorphic encryption algorithm to the terminal, which is beneficial for the terminal to provide user-level high privacy protection strength. Moreover, since the homomorphic encryption algorithm comprehensively considers the homomorphic security capabilities of the terminal side and the network side, it is beneficial to improve the reusability of the homomorphic key. Moreover, it is beneficial for the ciphertext data generated based on the homomorphic key to circulate and perform homomorphic calculations in different homomorphic encryption tasks.

[0385] In one possible implementation, the device is a first entity (access network device or network entity (such as a core network element or a functional network element)), or is located in the first entity. Specifically, the communication unit 1601 is used to send the homomorphic security capability of the network side. The communication unit 1601 is also used to receive a homomorphic encryption algorithm identifier, which is determined by the terminal based on the homomorphic security capability of the terminal and the homomorphic security capability of the network side.

[0386] The specific execution process of the communication unit 1601 and the processing unit 1602 in this embodiment can refer to the description of the steps performed by the first entity in the previous method embodiment, as well as the corresponding description in the content of the invention, which will not be repeated here. In the communication method implemented by the device, the first entity can send its own homomorphic security capabilities to the terminal, and the terminal comprehensively considers the homomorphic security capabilities of the terminal side and the network side to determine the homomorphic encryption algorithm, and feeds back the homomorphic encryption algorithm to the first entity, which is beneficial to providing user-level high privacy protection strength on the network side. Moreover, since the homomorphic encryption algorithm comprehensively considers the homomorphic security capabilities of the terminal side and the network side, it is beneficial to improve the reusability of homomorphic keys. Moreover, it is beneficial for the ciphertext data generated based on the homomorphic key to circulate and perform homomorphic calculations in different homomorphic encryption tasks.

[0387] In one possible implementation, the device is a first entity (access network device or network entity (such as a core network element or a functional network element)), or is located in the first entity. Specifically, the communication unit 1601 is used to receive the homomorphic security capability of the terminal. The processing unit 1602 is used to determine the homomorphic encryption algorithm based on the homomorphic security capability of the terminal and the homomorphic security capability of the network side. The communication unit 1601 is also used to send a homomorphic encryption algorithm identifier.

[0388] The specific execution process of the communication unit 1601 and the processing unit 1602 in this embodiment can refer to the description of the steps performed by the first entity in the previous method embodiment, as well as the corresponding description in the content of the invention, which will not be repeated here. In the communication method implemented by the device, the first entity can receive the homomorphic security capability of the terminal, thereby comprehensively considering the homomorphic security capabilities of the terminal side and the network side to determine the homomorphic encryption algorithm, which is beneficial for the first entity to provide user-level high privacy protection strength. Moreover, since the homomorphic encryption algorithm comprehensively considers the homomorphic security capabilities of the terminal side and the network side, it is beneficial to improve the reusability of the homomorphic key. Moreover, it is beneficial for the ciphertext data generated based on the homomorphic key to circulate and perform homomorphic calculations in different homomorphic encryption tasks.

[0389] In one possible implementation, the device is a first entity (an access network device or a network entity (such as a core network element or a functional network element)), or is located in the first entity. Specifically, the processing unit 1602 is used to determine a homomorphic encryption key or a homomorphic decryption key based on the superior key and the homomorphic encryption algorithm information. The processing unit 1602 is also used to encrypt a plaintext message into a first ciphertext using the homomorphic encryption key, or to decrypt a second ciphertext into a plaintext message using the homomorphic decryption key.

[0390] The specific execution process of the communication unit 1601 and the processing unit 1602 in this embodiment can refer to the description of the steps executed by the first entity in the previous method embodiment, as well as the corresponding description in the content of the invention, which will not be repeated here. In the communication method implemented by the device, the key architecture and management of the existing cellular network are adapted, and a user-level key architecture and management scheme for homomorphic encryption is designed. For example, the first entity can derive a homomorphic key based on the USIM symmetric key architecture or the KMC independent key architecture (the above-mentioned symmetric key architecture or independent key architecture derives related keys based on the upper key) and homomorphic encryption algorithm information, thereby realizing the user-level key architecture and management of homomorphic encryption.

[0391] Figure 17 is a schematic diagram of another communication device provided by the present application, which is used to implement the communication methods in the above-mentioned method embodiments. It can be understood that the communication device 1700 includes necessary forms such as modules, units, elements, circuits, or interfaces, which are appropriately configured together to perform the methods in the present application. For example, the communication device 1700 can be a functional entity such as an enabling server, an enabling client, a transmission server, an application server, etc., or it can be a component (such as a chip) in a functional entity to implement the method described in the above method embodiments. The communication device 1700 includes one or more processors 1701. The processor 1701 can be a general-purpose processor or a dedicated processor. For example, it can be a baseband processor or a central processing unit. The baseband processor can be used to process the communication protocol and communication data, and the central processing unit can be used to control the communication device, execute the software program, and process the data of the software program.

[0392] Optionally, the processor 1701 may include a program 1702 (sometimes also referred to as code or instructions), which may be executed on the processor 1701 to enable the communication device 1700 to perform the method described in the above embodiments. In another possible design, the communication device 1700 includes a circuit (not shown in FIG. 17 ) that is used to implement the functions of the enabling server, enabling client, transmission server, application server, and other functional entities in the above embodiments.

[0393] Optionally, the communication device 1700 may include one or more memories 1703 storing programs 1704 (sometimes also referred to as codes or instructions). The programs 1704 may be executed on the processor 1701 to enable the communication device 1700 to perform the methods described in the above method embodiments.

[0394] Optionally, processor 1701 and / or memory 1703 may include AI modules 1705 and 1706, which are used to implement AI-related functions. The AI ​​module may be implemented using software, hardware, or a combination of software and hardware. For example, the AI ​​module may include a real-time information processing (RIC) module. For example, the AI ​​module may be a near-real-time RIC or a non-real-time RIC.

[0395] Optionally, the communication device 1700 further includes a transceiver 1707 and an antenna 1708. The transceiver 1707 and the antenna 1708 can implement transceiver functions, such as communicating with other devices via a transmission medium, so that the communication device 1700 can communicate with other devices.

[0396] In one possible implementation, the device is a terminal or is located in a terminal. Specifically, transceiver 1707 and antenna 1708 are used to receive homomorphic security capabilities from the network. Processor 1701 is used to determine a homomorphic encryption algorithm based on the homomorphic security capabilities of the terminal and the network. Transceiver 1707 and antenna 1708 are used to send a homomorphic encryption algorithm identifier.

[0397] The specific execution process of the communication device 1700 in this embodiment can refer to the description of the steps executed by the terminal in the previous method embodiment, as well as the corresponding description in the content of the invention, which will not be repeated here. In the communication method implemented by this device, the terminal can receive the homomorphic security capability of the network side, thereby comprehensively considering the homomorphic security capabilities of the terminal side and the network side to determine the homomorphic encryption algorithm, which is beneficial for the terminal to provide user-level high privacy protection strength. Moreover, since the homomorphic encryption algorithm comprehensively considers the homomorphic security capabilities of the terminal side and the network side, it is beneficial to improve the reusability of homomorphic keys. Moreover, it is beneficial for the ciphertext data generated based on the homomorphic key to circulate and perform homomorphic calculations in different homomorphic encryption tasks.

[0398] In one possible implementation, the device is a terminal or is located in a terminal. Specifically, transceiver 1707 and antenna 1708 are used to transmit the homomorphic security capabilities of the terminal. Transceiver 1707 and antenna 1708 are also used to receive a homomorphic encryption algorithm identifier, which is determined by the network device based on the homomorphic security capabilities of the terminal and the homomorphic security capabilities of the network.

[0399] The specific execution process of the communication device 1700 in this embodiment can refer to the description of the steps executed by the terminal in the previous method embodiment, as well as the corresponding description in the content of the invention, which will not be repeated here. In the communication method implemented by this device, the terminal can send its own homomorphic security capabilities to the network device, and the network device comprehensively considers the homomorphic security capabilities of the terminal side and the network side to determine the homomorphic encryption algorithm, and feeds back the homomorphic encryption algorithm to the terminal, which is beneficial for the terminal to provide user-level high privacy protection strength. Moreover, since the homomorphic encryption algorithm comprehensively considers the homomorphic security capabilities of the terminal side and the network side, it is beneficial to improve the reusability of homomorphic keys. Moreover, it is beneficial for the ciphertext data generated based on the homomorphic key to circulate and perform homomorphic calculations in different homomorphic encryption tasks.

[0400] In one possible implementation, the device is a first entity (an access network device or a network entity (such as a core network element or a functional network element)), or is located in the first entity. Specifically, the transceiver 1707 and the antenna 1708 are used to send the homomorphic security capabilities of the network side. The transceiver 1707 and the antenna 1708 are also used to receive a homomorphic encryption algorithm identifier, which is determined by the terminal based on the homomorphic security capabilities of the terminal and the homomorphic security capabilities of the network side.

[0401] The specific execution process of the communication device 1700 in this embodiment can refer to the description of the steps performed by the first entity in the previous method embodiment, as well as the corresponding description in the content of the invention, which will not be repeated here. In the communication method implemented by this device, the first entity can send its own homomorphic security capabilities to the terminal, and the terminal comprehensively considers the homomorphic security capabilities of the terminal side and the network side to determine the homomorphic encryption algorithm, and feeds back the homomorphic encryption algorithm to the first entity, which is beneficial to providing user-level high privacy protection strength on the network side. Moreover, since the homomorphic encryption algorithm comprehensively considers the homomorphic security capabilities of the terminal side and the network side, it is beneficial to improve the reusability of homomorphic keys. Moreover, it is beneficial for the ciphertext data generated based on the homomorphic key to circulate and perform homomorphic calculations in different homomorphic encryption tasks.

[0402] In one possible implementation, the device is a first entity (access network device or network entity (such as a core network element or a functional network element)), or is located in the first entity. Specifically, the transceiver 1707 and the antenna 1708 are used to receive the homomorphic security capabilities of the terminal. The processor 1701 is used to determine the homomorphic encryption algorithm based on the homomorphic security capabilities of the terminal and the homomorphic security capabilities of the network side. The transceiver 1707 and the antenna 1708 are also used to send a homomorphic encryption algorithm identifier.

[0403] The specific execution process of the communication device 1700 in this embodiment can refer to the description of the steps performed by the first entity in the previous method embodiment, as well as the corresponding description in the content of the invention, which will not be repeated here. In the communication method implemented by this device, the first entity can receive the homomorphic security capability of the terminal, thereby comprehensively considering the homomorphic security capabilities of the terminal side and the network side to determine the homomorphic encryption algorithm, which is beneficial for the first entity to provide user-level high privacy protection strength. Moreover, since the homomorphic encryption algorithm comprehensively considers the homomorphic security capabilities of the terminal side and the network side, it is beneficial to improve the reusability of homomorphic keys. Moreover, it is beneficial for the ciphertext data generated based on the homomorphic key to circulate and perform homomorphic calculations in different homomorphic encryption tasks.

[0404] In one possible implementation, the device is a first entity (an access network device or a network entity (such as a core network element or a functional network element)), or is located in the first entity. Specifically, the processor 1701 is used to determine a homomorphic encryption key or a homomorphic decryption key based on the superior key and the homomorphic encryption algorithm information. The processor 1701 is also used to encrypt a plaintext message into a first ciphertext using the homomorphic encryption key, or to decrypt a second ciphertext into a plaintext message using the homomorphic decryption key.

[0405] The specific execution process of the communication device 1700 in this embodiment can refer to the description of the steps performed by the first entity in the method embodiment above, as well as the corresponding description in the content of the invention, which will not be repeated here. In the communication method implemented by the device, the key architecture and management of the existing cellular network are adapted, and a user-level key architecture and management scheme for homomorphic encryption is designed. For example, the first entity can derive a homomorphic key based on the USIM symmetric key architecture or the KMC independent key architecture (the above-mentioned symmetric key architecture or independent key architecture is based on the upper key to derive the related key) and the homomorphic encryption algorithm information, thereby realizing the user-level key architecture and management of homomorphic encryption.

[0406] In this application, a processor may be a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field-programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement or execute the methods, steps, and logic block diagrams disclosed in this application. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in this application may be directly executed by a hardware processor, or by a combination of hardware and software modules within the processor.

[0407] In the present application, the memory may be a non-volatile memory, such as a hard disk drive (HDD) or a solid-state drive (SSD), or a volatile memory, such as a random-access memory (RAM). The memory is any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory in the present application may also be a circuit or any other device that can implement a storage function, for storing program instructions and / or data.

[0408] The present application provides another communication device, which includes a processor and an interface. Optionally, it also includes a memory, the processor is coupled to the memory, and the processor is configured to read and execute computer instructions stored in the memory to implement the communication method in the embodiments shown in Figures 6a to 15.

[0409] The present application provides a communication system, which includes one or more entities or devices in the embodiments shown in Figures 6a to 15.

[0410] The present application provides a computer-readable storage medium. The computer-readable storage medium stores a program or instruction. When the program or instruction is executed on a computer, the computer executes the communication method in the embodiments shown in Figures 6a to 15.

[0411] The present application provides a computer program product, which includes instructions. When the instructions are executed on a computer, the computer executes the communication method in the embodiments shown in FIG6 a to FIG15 .

[0412] The present application provides a chip or chip system, which includes at least one processor and an interface, the interface and the at least one processor are interconnected by lines, and the at least one processor is used to run computer programs or instructions to execute the communication method in the embodiments shown in Figures 6a to 15.

[0413] The interface in the chip may be an input / output interface, a pin, or a circuit.

[0414] The chip system may be a system on chip (SOC) or a baseband chip, wherein the baseband chip may include a processor, a channel encoder, a digital signal processor, a modem, an interface module, and the like.

[0415] In one implementation, the chip or chip system described above in this application further includes at least one memory, in which instructions are stored. The memory may be a storage unit within the chip, such as a register, a cache, etc., or a storage unit of the chip (e.g., a read-only memory, a random access memory, etc.).

[0416] The technical solutions provided in this application can be implemented in whole or in part through software, hardware, firmware, or any combination thereof. When implemented using software, they can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions described in this application are generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, a network device, a terminal, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a digital video disc (DVD)), or a semiconductor medium.

[0417] In this application, under the premise that there is no logical contradiction, the various embodiments may reference each other, for example, the methods and / or terms between method embodiments may reference each other, for example, the functions and / or terms between device embodiments may reference each other, for example, the functions and / or terms between device embodiments and method embodiments may reference each other.

[0418] Obviously, those skilled in the art may make various changes and modifications to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is intended to include these modifications and variations.

Claims

1. A user-level homomorphic encryption management method, characterized in that: include: Receive homomorphic security capabilities on the network side; Determining a homomorphic encryption algorithm according to the homomorphic security capability of the terminal and the homomorphic security capability of the network side; Send the homomorphic encryption algorithm identifier.

2. The method according to claim 1, characterized in that The homomorphic security capability of the network side is carried in the security mode command, and the homomorphic encryption algorithm is carried in the security mode completion message.

3. A user-level homomorphic encryption management method, characterized in that: include: Homomorphic security capabilities of the sending terminal; Receive a homomorphic encryption algorithm identifier, where the homomorphic encryption algorithm is determined by the network side based on the homomorphic security capability of the terminal and the homomorphic security capability of the network side.

4. The method according to claim 3, characterized in that The homomorphic security capability of the terminal is carried in the security mode completion message.

5. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: According to the homomorphic encryption algorithm, a homomorphic encryption key and / or a homomorphic decryption key is determined; the homomorphic encryption key is used to encrypt a plaintext message into a first ciphertext, and the homomorphic decryption key is used to decrypt a second ciphertext into a plaintext message.

6. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: After the homomorphic encryption task is created, a homomorphic computing key is received, where the homomorphic computing key is used by one or more homomorphic computing parties in the homomorphic encryption task to perform homomorphic computing on the first ciphertext to output a second ciphertext.

7. The method according to claim 6, characterized in that The life cycle of the homomorphic computing key is the duration of the homomorphic encryption task.

8. The method according to any one of claims 1 to 7, characterized in that: The method further comprises: Receive first indication information, where the first indication information is used to instruct the destruction of a homomorphic key, where the homomorphic key is a homomorphic encryption key, a homomorphic decryption key, or a homomorphic computing key; Destroying the homomorphic key.

9. The method according to claim 8, characterized in that The life cycle of the homomorphic encryption key or the homomorphic decryption key is within the time between the success and release of the user's radio resource control RRC connection; the user is the homomorphic encryption party or the homomorphic decryption party; The first indication information is carried in the RRC release signaling.

10. The method according to any one of claims 1 to 7, characterized in that: The method further comprises: Receive second indication information, where the second indication information is used to indicate updating of a homomorphic key, where the homomorphic key is a homomorphic encryption key, a homomorphic decryption key, or a homomorphic computing key; The homomorphic key is updated.

11. The method according to any one of claims 1 to 7, characterized in that: The method further comprises: The first ciphertext and its corresponding key information, and / or the second ciphertext and its corresponding key information are stored, wherein the key information includes one or more of a homomorphic encryption key, a homomorphic decryption key, a homomorphic computation key, a key derivation parameter, and a security context.

12. The method according to any one of claims 1 to 7, characterized in that: The homomorphic security capability of the network side, or the homomorphic security capability of the terminal, or the homomorphic encryption algorithm, or the first indication information, or the second indication information is carried in signaling with encryption and integrity protection, and the signaling includes radio resource control RRC signaling and / or non-access layer NAS signaling with integrity protection.

13. A user-level homomorphic encryption management method, characterized in that: include: Sending network-side homomorphic security capabilities; Receive a homomorphic encryption algorithm identifier, where the homomorphic encryption algorithm is determined by the terminal based on the homomorphic security capability of the terminal and the homomorphic security capability of the network side.

14. The method according to claim 13, characterized in that The homomorphic security capability of the network side is carried in the security mode command, and the homomorphic encryption algorithm is carried in the security mode completion message.

15. A user-level homomorphic encryption management method, characterized in that: include: Homomorphic security capabilities of the receiving terminal; Determining a homomorphic encryption algorithm according to the homomorphic security capability of the terminal and the homomorphic security capability of the network side; Send the homomorphic encryption algorithm identifier.

16. The method according to claim 15, characterized in that The homomorphic security capability of the terminal is carried in the security mode completion message.

17. The method according to any one of claims 13 to 16, characterized in that: The method further comprises: According to the homomorphic encryption algorithm, a homomorphic encryption key and / or a homomorphic decryption key is determined; the homomorphic encryption key is used to encrypt a plaintext message into a first ciphertext, and the homomorphic decryption key is used to decrypt a second ciphertext into a plaintext message.

18. The method according to any one of claims 13 to 17, characterized in that The method further comprises: After the homomorphic encryption task is created, a homomorphic computing key is determined, where the homomorphic computing key is used for one or more homomorphic computing parties in the homomorphic encryption task to perform homomorphic computing under the first ciphertext to output a second ciphertext; The homomorphic computation key is sent.

19. The method according to claim 18, characterized in that The life cycle of the homomorphic computing key is the duration of the homomorphic encryption task.

20. The method according to any one of claims 13 to 19, characterized in that The method further comprises: Sending first indication information, where the first indication information is used to instruct the destruction of a homomorphic key, where the homomorphic key is a homomorphic encryption key, a homomorphic decryption key, or a homomorphic computing key; Destroying the homomorphic key.

21. The method according to claim 20, characterized in that The life cycle of the homomorphic encryption key or the homomorphic decryption key is less than the time between the success and release of the user's wireless resource control RRC connection; the user is a homomorphic encryption party or a homomorphic decryption party; the first indication information is carried in the RRC release signaling.

22. The method according to any one of claims 13 to 19, characterized in that The method further comprises: Sending second indication information, where the second indication information is used to instruct updating of a homomorphic key, where the homomorphic key is a homomorphic encryption key, a homomorphic decryption key, or a homomorphic computing key; The homomorphic key is updated.

23. The method according to any one of claims 13 to 19, characterized in that The method further comprises: Store the first ciphertext and its corresponding key information, and / or the second ciphertext and its corresponding key information, wherein the key information includes one or more of a user-level homomorphic encryption key, a homomorphic decryption key, a homomorphic computing key, a key derivation parameter, and a security context.

24. The method according to any one of claims 13 to 19, characterized in that The homomorphic security capability of the network side, or the homomorphic security capability of the terminal, or the homomorphic encryption algorithm, or the first indication information, or the second indication information is carried in signaling with encryption and integrity protection, and the signaling includes radio resource control RRC signaling and / or non-access layer NAS signaling.

25. A user-level homomorphic encryption management method, characterized in that: include: Determine a homomorphic encryption key or a homomorphic decryption key according to the superior key and homomorphic encryption algorithm information; The homomorphic encryption key is used to encrypt the plaintext message into the first ciphertext, or the homomorphic decryption key is used to decrypt the second ciphertext into the plaintext message.

26. The method according to claim 25, characterized in that The method further comprises: Determine a homomorphic computing key according to the homomorphic encryption key or the homomorphic decryption key; the homomorphic computing key is used by the homomorphic computing party to perform homomorphic computing on the first ciphertext to output a second ciphertext; The homomorphic computation key is sent.

27. The method according to claim 25 or 26, characterized in that The superior key is a first key, the first key is an anchor key derived from a first network element, and the first network element is a network element or entity with an authentication function; and determining a homomorphic encryption key or a homomorphic decryption key according to the superior key and homomorphic encryption algorithm information includes: According to the first key and the first homomorphic algorithm input parameter, the homomorphic encryption key or homomorphic decryption key of the network function NF network element is determined. The first homomorphic algorithm input parameter includes one or more of the algorithm type, algorithm identifier, network function type, user identity identifier, non-access layer count value, and anti-network degradation attack ABBA parameters.

28. The method according to claim 25 or 26, characterized in that The upper key is a second key, the second key is a key derived by a second network element from an anchor key, and the second network element is a network element or entity having access and mobility management functions; The determining of the homomorphic encryption key or the homomorphic decryption key according to the superior key and the homomorphic encryption algorithm information includes: According to the second key and the second homomorphic algorithm input parameter, the homomorphic encryption key or homomorphic decryption key of the second network element is determined, and the second homomorphic algorithm input parameter includes one or more of the algorithm type, the algorithm identifier, and the non-access layer count value.

29. The method according to claim 25 or 26, characterized in that The upper-level key is a third key, and the third key is a key derived by the second network element from the second key; and determining the homomorphic encryption key or the homomorphic decryption key according to the upper-level key and the homomorphic encryption algorithm information includes: According to the third key and the third homomorphic algorithm input parameters, a homomorphic encryption key or a homomorphic decryption key of the access network device is determined, and the third homomorphic algorithm input parameters include an algorithm type and / or an algorithm identifier.

30. The method according to claim 25 or 26, characterized in that The superior key is a working key of an independent key architecture; the determining of a homomorphic encryption key or a homomorphic decryption key according to the superior key and homomorphic encryption algorithm information includes: According to the working key of the independent key architecture and the fourth homomorphic algorithm input parameters, the homomorphic encryption key or homomorphic decryption key of the core network network element is determined. The fourth homomorphic algorithm input parameters include one or more of the random number RAND, service network name, network function type, algorithm type, algorithm identifier, user identity identifier, and ABBA parameters.

31. The method according to claim 25 or 26, characterized in that The superior key is a working key of an independent key architecture; the determining of a homomorphic encryption key or a homomorphic decryption key according to the superior key and homomorphic encryption algorithm information includes: According to the working key of the independent key architecture and the fifth homomorphic algorithm input parameters, the homomorphic encryption key and the homomorphic decryption key of the access network device are determined. The fifth homomorphic algorithm input parameters include one or more of the random number RAND, the service network name, the network function type, the algorithm type, the algorithm identifier, the user identity identifier, the ABBA parameter, the non-access layer count value, and the access type.

32. A communication device, characterized in that: The method comprises a communication unit and a processing unit, wherein the communication unit and the processing unit are used to execute the method according to any one of claims 1 to 31.

33. A communication device, characterized in that: include: A processor, configured to enable the communication device to perform the method according to any one of claims 1 to 31 through logic circuits and / or execution instructions.

34. The device according to claim 33, characterized in that Also included is a memory for storing the instructions.

35. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed on a computer, the computer is caused to perform the method according to any one of claims 1 to 31.

36. A chip system, characterized in that: The chip system includes a processor and an interface, and the processor is used to execute a computer program so that the chip system implements the method as described in any one of claims 1 to 31.

37. A computer program product, characterized in that The method comprises instructions which, when executed on a computer, cause the computer to perform the method according to any one of claims 1 to 31.

38. A communication system, characterized in that: The communication system comprises an apparatus for executing the method according to any one of claims 1-2 and 4-12, and an apparatus for executing the method according to any one of claims 3-12; or, The communication system comprises an apparatus for executing the method of any one of claims 15-16, 20-24, and an apparatus for executing the method of any one of claims 17-24.

Images