Data processing method and system for protecting privacy, and device

Abstract

A data processing method and system for protecting privacy, and a device. The method comprises: a device of a first party performing the following operations: acquiring first ciphertext and second ciphertext; determining a first parameter value and a second parameter value on the basis of a first number of first coefficients in each of a first plaintext polynomial and a second plaintext polynomial corresponding to the first ciphertext and the second ciphertext; performing homomorphic calculation on the basis of the first parameter value, the second parameter value, the first ciphertext and the second ciphertext, so as to obtain third ciphertext, wherein a third plaintext polynomial corresponding to the third ciphertext comprises the first number of first coefficients; sending the third ciphertext to a device of a second party; and the device of the second party decrypting the third ciphertext, so as to obtain the third plaintext polynomial, and acquiring the first number of first coefficients from the third plaintext polynomial.

Description

A data processing method, device and system for protecting privacy

[0001] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office of China on September 28, 2023, with application number 202311282679.3 and application name “A privacy-protecting data processing method, device and system”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The embodiments of this specification belong to the field of data processing technology, and in particular, relate to a data processing method, device, and system for protecting privacy. Background Art

[0003] In some multi-party data processing scenarios, which usually include matrix holders and vector holders, the matrix holders and vector holders need to complete the calculation of the inner product of the matrix and vector while protecting the privacy data of each party. In related technologies, based on the Ring-Related Learning to Resilience (RLWE) homomorphic encryption algorithm, multiple row vectors in the matrix can be converted into multiple first plaintext polynomials, the target vector can be converted into a second plaintext polynomial, the second plaintext polynomial is encrypted to obtain a first ciphertext, and each first plaintext polynomial is multiplied by the first ciphertext to obtain multiple second ciphertexts. The plaintext polynomials corresponding to the multiple second ciphertexts include the inner product values ​​of each row vector in the matrix and the target vector.

[0004] Summary of the Invention

[0005] The present invention aims to provide a data processing solution, which can save computing resources and storage resources and reduce communication traffic.

[0006] A first aspect of this specification provides a privacy-preserving data processing method, the method being performed by a device of a first party and a device of a second party, wherein the second party possesses a public key for homomorphic encryption and a private key corresponding to the public key, the method comprising:

[0007] The first party's device performs the following operations:

[0008] Obtaining a first ciphertext and a second ciphertext, where the first ciphertext and the second ciphertext are homomorphic ciphertexts of a first plaintext polynomial and a second plaintext polynomial, respectively, the first ciphertext and the second ciphertext correspond to the public key, and the first plaintext polynomial and the second plaintext polynomial are polynomials in the same polynomial space;

[0009] Determining a first parameter value and a second parameter value based on a first number of first coefficients serving as target coefficients in the first plaintext polynomial and the second plaintext polynomial, the first parameter value being used in a homomorphic computation of homomorphic replacement of the homomorphic ciphertext, and the second parameter value being used in a homomorphic computation of homomorphic multiplication of the homomorphic ciphertext; performing a homomorphic computation based on the first parameter value, the second parameter value, the first ciphertext, and the second ciphertext to obtain a third ciphertext, wherein a third plaintext polynomial corresponding to the third ciphertext includes the first number of first coefficients;

[0010] sending the third ciphertext to a device of the second party;

[0011] The device of the second party decrypts the third ciphertext based on the private key to obtain the third plaintext polynomial, and obtains the first coefficient of the first number from the third plaintext polynomial.

[0012] A second aspect of this specification provides a data processing method for protecting privacy, comprising:

[0013] Obtaining a first ciphertext and a second ciphertext, where the first ciphertext and the second ciphertext are homomorphic ciphertexts of a first plaintext polynomial and a second plaintext polynomial, respectively, and the first plaintext polynomial and the second plaintext polynomial are polynomials in the same polynomial space;

[0014] determining, based on a first number of first coefficients serving as target coefficients in the first plaintext polynomial and the second plaintext polynomial, a first parameter value and a second parameter value, the first parameter value being used in a homomorphic computation of homomorphic replacement on the homomorphic ciphertext, and the second parameter value being used in a homomorphic computation of homomorphic multiplication on the homomorphic ciphertext;

[0015] A homomorphic calculation is performed based on the first parameter value, the second parameter value, the first ciphertext, and the second ciphertext to obtain a third ciphertext, where a third plaintext polynomial corresponding to the third ciphertext includes the first coefficient of the first number.

[0016] A third aspect of this specification provides a computing device, including:

[0017] an acquiring unit, configured to acquire a first ciphertext and a second ciphertext, wherein the first ciphertext and the second ciphertext are homomorphic ciphertexts of a first plaintext polynomial and a second plaintext polynomial, respectively, and the first plaintext polynomial and the second plaintext polynomial are polynomials in the same polynomial space;

[0018] a determining unit, configured to determine a first parameter value and a second parameter value based on a first number of first coefficients serving as target coefficients in the first plaintext polynomial and the second plaintext polynomial, the first parameter value being used in a homomorphic computation of homomorphic replacement on a homomorphic ciphertext, and the second parameter value being used in a homomorphic computation of homomorphic multiplication on the homomorphic ciphertext;

[0019] A computing unit is configured to perform homomorphic computing based on the first parameter value, the second parameter value, the first ciphertext, and the second ciphertext to obtain a third ciphertext, wherein a third plaintext polynomial corresponding to the third ciphertext includes the first coefficient of the first number.

[0020] A fourth aspect of the present specification provides a privacy-preserving data processing system, the system comprising a device of a first party and a device of a second party, wherein the second party possesses a public key for homomorphic encryption and a private key corresponding to the public key,

[0021] The first party's device is configured to perform the following operations:

[0022] Obtaining a first ciphertext and a second ciphertext, where the first ciphertext and the second ciphertext are homomorphic ciphertexts of a first plaintext polynomial and a second plaintext polynomial, respectively, the first ciphertext and the second ciphertext correspond to the public key, and the first plaintext polynomial and the second plaintext polynomial are polynomials in the same polynomial space;

[0023] determining, based on a first number of first coefficients serving as target coefficients in the first plaintext polynomial and the second plaintext polynomial, a first parameter value and a second parameter value, the first parameter value being used in a homomorphic computation of homomorphic replacement on the homomorphic ciphertext, and the second parameter value being used in a homomorphic computation of homomorphic multiplication on the homomorphic ciphertext;

[0024] performing homomorphic computation based on the first parameter value, the second parameter value, the first ciphertext, and the second ciphertext to obtain a third ciphertext, wherein a third plaintext polynomial corresponding to the third ciphertext includes a first coefficient of the first number;

[0025] sending the third ciphertext to a device of the second party;

[0026] The device of the second party is used to decrypt the third ciphertext based on the private key to obtain the third plaintext polynomial, and obtain the first coefficient of the first number from the third plaintext polynomial.

[0027] A fifth aspect of this specification provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed in a computer, the computer is caused to execute the method described in the second aspect.

[0028] A sixth aspect of this specification provides a computing device comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method described in the second aspect is implemented.

[0029] An embodiment of the present specification provides a privacy-preserving data processing method. Through the scheme of this embodiment, multiple ciphertexts can be homomorphically calculated based on the number of target coefficients in each ciphertext, so that in a data processing process of two ciphertexts, the two ciphertexts are packaged into a packaged ciphertext, so that the plaintext corresponding to the packaged ciphertext includes all the target coefficients corresponding to the two ciphertexts, and the packaged ciphertext can be sent to the second party's device so that the second party's device obtains all the target coefficients corresponding to the two ciphertexts. Compared with existing schemes, while achieving the same effect, the amount of communication data between the first party device and the second party device is reduced, and the computational complexity is also reduced, saving computing resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the technical solutions of the embodiments of this specification, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0031] FIG1 is a system structure diagram in one embodiment;

[0032] FIG2 is a flow chart of a method for data processing according to an embodiment of the present specification;

[0033] FIG3 is a schematic diagram of the process of the matrix holder executing the method shown in FIG2 ;

[0034] FIG4 is a schematic diagram of a process in which a matrix holder packages multiple ciphertexts in accordance with an embodiment of the present specification;

[0035] FIG5 shows a flow chart of a method for data processing in another embodiment of the present specification;

[0036] FIG6 is an architecture diagram of a computing device according to an embodiment of the present specification. DETAILED DESCRIPTION

[0037] To help those skilled in the art better understand the technical solutions in this specification, the following will provide a clear and complete description of the technical solutions in the embodiments of this specification, in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of this specification, not all of them. All other embodiments derived by those skilled in the art based on the embodiments in this specification without creative effort shall fall within the scope of protection of this specification.

[0038] The solutions in the embodiments of this specification are based on homomorphic encryption algorithms. Homomorphic encryption algorithms include the following six algorithms:

[0039] (1) Key generation algorithm (KeyGen), which is used to generate private key sk and public key pk.

[0040] Let the plaintext space be a polynomial space Among them, the degree in the polynomial space is less than N, where N is a power of 2, for example, it can take values ​​4096, 8192, etc., and the coefficient is an integer in [0,q). The ciphertext space corresponding to the plaintext space is R can be randomly generated by the key generation algorithm q A polynomial in , as the private key sk, each coefficient of the polynomial is subject to the standard deviation of χ σ Then, the public key pk = (-a*sk+e,a) can be generated, where a is R q A randomly generated polynomial in , e←χ σ .

[0041] (2) Encoding algorithm (Encode), used to convert plaintext vector Convert to polynomial v∈R q .

[0042] (3) Encryption algorithm, used to encrypt the plaintext polynomial v into ciphertext (the ciphertext is in the form of two polynomials) using the public key. Specifically, let pk = (p0, p1), then the ciphertext Here c1=u*p1+e1,c0=u*p0+e0+v,where v is the plaintext polynomial.

[0043] (4) Decryption algorithm: This decryption algorithm is used to decrypt ciphertext into plaintext polynomial. Suppose ciphertext ct = (c0, c1), then v≈(c0+c1*sk)modq is the decrypted plaintext polynomial.

[0044] (5) Decoding algorithm (Decode), which is used to convert the plaintext polynomial into a plaintext vector.

[0045] (6) Homomorphic computation, including homomorphic addition, homomorphic multiplication, homomorphic substitution, etc.

[0046] Specifically, in homomorphic addition, for plaintext polynomial m and plaintext polynomial t, E(m+t)=E(m)+E(t), where plaintext polynomial m and plaintext polynomial t are polynomials in the same polynomial space, and E() represents the ciphertext obtained by homomorphically encrypting the ciphertext polynomial; in homomorphic multiplication, E(t*m)=t*E(m), in a homomorphic multiplication, E(x i *m)=x i *E(m); In homomorphic substitution, assuming that the ciphertext of polynomial m(x) is ct(x), then ct(x t )=E(m(x t )).

[0047] Figure 1 is a system architecture diagram for one embodiment. As shown in Figure 1, the system may include a device 101 for matrix holder P0 and a device 102 for vector holder P1. Device 101 stores an m-row, n-column matrix owned by matrix holder P0, and device 102 stores an n-dimensional vector owned by vector holder P1. To protect the privacy data of matrix holder P0 and vector holder P1, respectively, device 102 may generate a private key sk and a public key pk for homomorphic encryption. Device 102 may use the public key pk to homomorphically encrypt the vector, generating a ciphertext of the vector (i.e., the ciphertext of the plaintext polynomial corresponding to the vector), and then send this ciphertext to device 101. Device 101 may convert each row vector of the matrix into at least one plaintext polynomial, and then calculate ciphertext containing an inner product result based on the at least one plaintext polynomial and the ciphertext of the vector, and send the ciphertext containing the inner product result to device 102. Device 102 then homomorphically decrypts the ciphertext containing the inner product result using the private key sk to obtain the inner product of each row vector of the matrix and the vector. The ciphertext containing an inner product means that the plaintext polynomial corresponding to the ciphertext includes an inner product.

[0048] The embodiments of this specification can be applied, for example, in scenarios involving joint modeling by multiple parties. In this scenario, the matrix holder P0 is, for example, the model provider providing the model, and the matrix held by the model provider is, for example, the parameter matrix of the model. The vector holder is, for example, the data provider providing the feature data. After the data provider sends the ciphertext containing the vector to the model provider, the model provider can input the ciphertext into the model, which then outputs the ciphertext containing the inner product.

[0049] The embodiments of this specification can also be used in the context of private information retrieval. In this scenario, device 101 of matrix holder P0 is, for example, a server storing a database containing matrix-formatted data, and device 102 is a user device. When the user device needs to query the i-th column of the matrix, it can construct a vector for querying the data, where the i-th component of the vector is 1 and all other components are 0.

[0050] For example, the matrix W owned by the matrix holder is a 4*4 matrix:

[0051] Among them, it can be considered that W includes four row vectors

[0052] When the device 102 needs to query the data in the second column of the matrix, it can construct a vector for querying the data

[0053] in, Represents a vector With vector The inner product of is, specifically,

[0054] That is, by adding the vector Set as the vector above, by calculating the matrix W and the vector The product of matrix W is a column of matrix W. When multiplying, by calculating the matrix W including each row vector and vector The inner product of matrix W and vector Based on this, in order to protect the privacy data of the matrix holder and the vector holder, the above calculation can be performed based on the homomorphic encryption algorithm.

[0055] Specifically, the vector holder can Convert to polynomial v = 0 + x + 0x 2 +0x 3 = x, use the public key pk of homomorphic encryption to encrypt the polynomial v, and obtain the ciphertext Cv=E(v) of the polynomial v, where E() represents the homomorphic encryption algorithm. The ciphertext Cv includes two ciphertext polynomials (C v0 ,C v1 ). The vector holder can send the ciphertext Cv to the matrix holder.

[0056] The matrix holder can include the four row vectors of matrix W Convert to 4 polynomials: w0=1-4x-3x 2 -2x 3, w1=3-6x-5x 2 -4x 3 , w2=2-5x-4x 2 -3x 3 , w3=4-7x-6x 2 -5x 3 .

[0057] Among them, w0×v=(1-4x-3x 2 -2x 3 )×(0+x+0x 2 +0x 3 ) =(1×0-4x×0x 3 -3x 2 ×0x 2 -2x 3 ×x)+…=(1×0-4×0x 4 -3×0x 4 -2×1x 4 )+… (1)

[0058] In the above formula (1), “…” represents other terms of powers of x, which are not specifically written here. As mentioned above, in the homomorphic encryption algorithm, the plaintext space is the polynomial space R q , the degree of the polynomial space is less than 4, where N = 4. In the polynomial space with N = 4, we can set x 4 =-1, thus, the above formula (1) can be converted to:

[0059] That is, the constant term in the polynomial of w0×v is

[0060] Similar to formula (2), we can derive

[0061] According to the homomorphic encryption algorithm, E(w×v)←w×E(v). Therefore, the matrix holder can calculate the polynomial w i The product w of (i is any value between 0 and 3) and the homomorphic ciphertext Cv of the polynomial v i × Cv, get the same value as w i ×v corresponding to the ciphertext C wi =E(w i ×v)=w i ×Cv, and the four ciphertexts C w0 ~C w3 Sent to the vector holder. Among them, the polynomial w i The product of the homomorphic ciphertext Cv of polynomial v is w i×(C v0 ,C v1 )=(w i ×C v0 ,w i ×C v1 ). The vector holder can use the four ciphertexts C w0 ~C w3 Decrypt and get each polynomial w i ×v, can be obtained from various polynomials w i ×v obtains the constant term, thereby obtaining each Thus, the second column of the matrix W can be obtained. In this way, during the data query process, the server cannot know the specific data queried by the user, thus protecting the user's privacy. At the same time, the user cannot obtain the data of other columns in the matrix W, thus protecting the server's data privacy.

[0062] In the above process, the matrix holder obtains four ciphertexts C w0 ~C w3 Afterwards, the four ciphertexts need to be sent to the vector holder so that the vector holder can obtain the constant terms in the plaintext polynomials corresponding to the four ciphertexts. Therefore, the amount of communication data between the matrix holder and the vector holder is large.

[0063] Embodiments of this specification provide a privacy-preserving data processing method. A server can package multiple ciphertexts into a single ciphertext, ensuring that the plaintext polynomial corresponding to the packaged ciphertext includes all coefficients required to be retained from the multiple plaintext polynomials corresponding to the multiple ciphertexts, and then send the packaged ciphertext to a user device. Compared to solutions in related arts, the data processing method provided in this embodiment reduces the amount of communication data.

[0064] FIG2 is a flowchart of a privacy-preserving data processing method in an embodiment of this specification, which is executed, for example, by a vector holder and a matrix holder.

[0065] As shown in FIG2 , in step S210 , the vector holder generates a ciphertext Cv of the vector.

[0066] As mentioned above, the vector holder can pre-generate the private key sk and public key pk for homomorphic encryption. Convert to a plaintext polynomial v, encrypt the plaintext polynomial v using the public key pk, and obtain a ciphertext Cv of the plaintext polynomial v, where the ciphertext Cv includes two ciphertext polynomials.

[0067] Specifically, in one embodiment, as described above, the vector For example, it is a 4-dimensional vector, that is, n=4 in Figure 1, It can be converted into a polynomial v = 0 + x + 0x 2 +0x 3 =x, the vector holder uses the public key pk to encrypt the plaintext polynomial v to obtain the ciphertext Cv.

[0068] In step S520, the vector holder sends the ciphertext Cv to the matrix holder.

[0069] In step S530, the matrix owner converts the matrix W it owns into multiple plaintext polynomials, and multiplies the multiple plaintext polynomials with the ciphertext Cv respectively to obtain multiple ciphertexts.

[0070] Specifically, the matrix W is, for example, a 4*4 matrix

[0071] The matrix holder can include the four row vectors of matrix W Convert to 4 polynomials: w 10 =1-4x 5 -3x 6 -2x 7 , w 11 =3-6x 5 -5x 6 -4x 7 , w 12 =2-5x 5 -4x 6 -3x 7 , w 13 =4-7x 5 -6x 6 -5x 7 .

[0072] Afterwards, the matrix holder can use the plaintext polynomial w 10 and w 12 Generate plaintext polynomial y0 based on w 11 and w 13 Generate plaintext polynomial y1: y0=w 10 +x 4 ×w 12 =1+5x+4x 2 +3x 3 +2x 4 -4x 5 -3x 6 -2x 7 , y1=w 11 +x 4 ×w 13 =1+7x+6x 2 +5x 3 +4x 4 -6x 5 -5x6 -4x 7 .

[0073] In this case, the degree of the polynomial space to which the plaintext polynomials y0 and y1 belong is less than 8, that is, N=8. In this polynomial space, x 8 =-1.

[0074] The matrix holder can obtain two ciphertexts y0×Cv and y1×Cv by multiplying the plaintext polynomials y0 and y1 with the ciphertext Cv respectively. These two ciphertexts can be expressed as C1 and C2 respectively. As mentioned above, y0×Cv=E(y0×v), y1×Cv=E(y1×v),

[0075] in,

[0076] in, Represents a vector With vector The inner product of .

[0077] That is to say, the constant coefficient of the plaintext polynomial y0×v corresponding to the ciphertext C1 is the row vector With vector The inner product of the plaintext polynomial y0×v corresponding to the ciphertext C1 is x 4 The coefficients of the terms are row vectors With vector The inner product of the constant term coefficient and x in the plaintext polynomial corresponding to the ciphertext C1 4 The term coefficients need to be provided to the vector holder.

[0078] Similarly,

[0079] That is to say, the constant coefficient of the plaintext polynomial y1×v corresponding to the ciphertext C2 is the row vector With vector The inner product of the plaintext polynomial y1×v corresponding to the ciphertext C2 is x 4 The coefficients of the terms are row vectors With vector The inner product of the constant term coefficient and x in the plaintext polynomial corresponding to the ciphertext C2 4 The term coefficients need to be provided to the vector holder.

[0080] It can be understood that the matrix W and vector This is merely exemplary and not intended to limit the scope of the embodiments of this specification. In one embodiment, the matrix W2 of the matrix holder includes, for example, There are 8 row vectors in total. Similar to the above, the row vectors can be Convert to polynomial w respectively 20 、w 21 、…w 27 .

[0081] Similar to the above, the matrix holder can use the plaintext polynomial w 20 and w 24 Generate plaintext polynomial y 20 , based on w 21 and w 25 Generate plaintext polynomial y 21 , based on the plaintext polynomial w 22 and w 26 Generate plaintext polynomial y 22 , based on the plaintext polynomial w 23 and w 27 Generate plaintext polynomial y 23 , that is: y 20 =w 20 +x 4 ×w 24 , y 21 =w 21 +x 4 ×w 25 , y 22 =w 22 +x 4 ×w 26 , y 23 =w 23 +x 4 ×w 27 ,

[0082] Similarly, by transforming the plaintext polynomial y 20 ~y 23 Multiply them with the ciphertext Cv respectively to get four ciphertexts y 20 ×Cv~y 23 ×Cv, the four ciphertexts can be represented as C 21 ~C 24 .

[0083] Referring to the above formula (3) and formula (4), similarly, the ciphertext C can be obtained 21 ~C 24 The four corresponding plaintext polynomials are:

[0084] That is, the ciphertext C 21 ~C 24 The constant term coefficient and x in each of the four corresponding plaintext polynomials4 The term coefficients need to be provided to the vector holder.

[0085] In step S240, the matrix holder packages multiple ciphertexts to obtain ciphertext Cq.

[0086] In one example, the matrix holder obtains the ciphertext C1 and ciphertext C2 as described above. As described above, the number of coefficients (i.e., target coefficients) that need to be provided to the vector holder in the plaintext polynomials corresponding to the ciphertext C1 and ciphertext C2 is 2 respectively.

[0087] As shown in FIG. 2 , the matrix holder may perform a packaging process on the ciphertext C1 and the ciphertext C2 by executing steps S241 and S243 .

[0088] Specifically, in step S241, the matrix holder determines the first parameter value and the second parameter value based on the target number of coefficients in the plaintext polynomial Vi and the plaintext polynomial Vj corresponding to the ciphertext Ci and the ciphertext Cj.

[0089] The first parameter value is the number of times x in the ciphertext is homomorphically replaced, and the second parameter value is the number of times x is homomorphically multiplied.

[0090] In one embodiment, based on the number of coefficients that need to be retained in the plaintext polynomial Vi and the plaintext polynomial Vj, s , 2 s Should be less than or equal to N, the first parameter value can be determined to be 2 s +1, the second parameter value is N / 2 s .

[0091] FIG3 is a schematic diagram of the process of the matrix holder executing step S240. As shown in FIG3, it is assumed that the ciphertext C1 corresponds to the plaintext polynomial V1 (i.e., y0×v), and the ciphertext C2 corresponds to the plaintext polynomial V2 (i.e., y1×v). For example, the plaintext polynomial V1 corresponding to the ciphertext C1 is in the form of V1=v0+v1x+…v N x N Assuming N=8, the boxes in Figure 3 are arranged in order to represent the coefficients of the terms in the plaintext polynomial V1, where "*" represents the coefficients of the terms that are not of interest in the plaintext polynomial V1. In the above example, the specific form of V1 can be V1=2+…+3x 4 +…, the specific form of V2 can be V2==4+…+5x 4 +…. As mentioned above, the constant term coefficients and the N / 2th term (i.e. x 4The coefficients of the first and fifth terms are the vector inner products, i.e., 2 and 3 in the first and fifth boxes, respectively, of V1 in Figure 3, and 4 and 5 in the first and fifth boxes, respectively, of V2. This means that the total number of target coefficients to be retained in plaintext polynomials V1 and V2 is 2 + 2 = 4. Accordingly, the first parameter value can be determined to be 5, and the second parameter value can be determined to be 8 / 4 = 2.

[0092] In step S243, the matrix holder performs homomorphic calculation based on the first parameter value, the second parameter value, the ciphertext Ci and the ciphertext Cj to obtain the ciphertext Ck.

[0093] Referring to Figure 3, the matrix holder can first perform homomorphic replacement on both ciphertext C1 and ciphertext C2 based on the first parameter value, that is, replace x in ciphertext C1 with x 5 , replace x in ciphertext C2 with x 5 Specifically, replace x in the two polynomials included in the ciphertext C1 with x 5 , replace x in the two polynomials included in the ciphertext C2 with x 5 .

[0094] Based on the principle of homomorphic substitution, x in the ciphertext C1 is replaced by x 5 , which is equivalent to replacing x in the plaintext polynomial V1 with x 5 , that is, the plaintext polynomial V1 is converted into the following form: V1(x 5 )=v0+v1x 5 +…v N x 5N (5)

[0095] Among them, the plaintext polynomial V1(x 5 ) is the same as the constant term of the plaintext polynomial V1.

[0096] For formula (5) mod (x N +1), that is, x in formula (5) N is replaced by -1 so that V1(x 5 ) corresponds to the polynomial space of the plaintext polynomial. After this processing, the polynomial space in formula (5) That is to say, after homomorphic substitution, The coefficients of the terms become the plaintext polynomial V1 The negative of the coefficient of the term. Similarly, in formula (5) That is to say, after homomorphic substitution, The coefficients of the terms become the plaintext polynomial V1 The negative number of the coefficient of the term. In addition, in formula (5) That is to say, after homomorphic substitution, The coefficients of the terms are the same as those in the plaintext polynomial V1 The coefficients of the terms are the same.

[0097] In the case of N=8, referring to FIG3, after homomorphic substitution of the ciphertext C1, the polynomial V1(x 5 ) corresponds to the ciphertext C1(x 5 ), plaintext polynomial V1(x 5 ) Compared with the plaintext polynomial V1, the plaintext polynomial V1(x 5 ) constant term and x 4 (Right now ) items have the same coefficients as the corresponding items in the plaintext polynomial V1. The plaintext polynomial V1(x 5 ) 2 (Right now ) and x 6 (Right now ) are respectively the negatives of the coefficients of the corresponding terms in the plaintext polynomial V1.

[0098] By doing so, by comparing the ciphertext C1 with the ciphertext C1(x 5 ) are added together to obtain the corresponding plaintext polynomial V1+V1(x 5 ) and x 4 The coefficient of the term is twice the coefficient of the corresponding term in the plaintext polynomial V1, that is, as shown in Figure 3, the plaintext polynomial (V1+V1(x 5 )) / 2 constant term and x 4 The coefficients of the terms are the same as those of the corresponding terms in the plaintext polynomial V1, and their x 2 (Right now ) and x 6 (Right now ) becomes zero. 5 ) is to add the first polynomial of the ciphertext C1 to C1(x 5 ) and add the first polynomial of the ciphertext C1 to the second polynomial of C1(x 5 ) are added together to obtain two new ciphertext polynomials.

[0099] Similarly, the ciphertext C2 is processed to obtain the ciphertext (C2+C2(x 5 )) / 2, which corresponds to the plaintext polynomial (V2+V2(x 5)) / 2, as shown in Figure 3, the plaintext polynomial (V2+V2(x 5 )) / 2 constant term and x 4 The coefficients of the terms are the same as the corresponding terms in the plaintext polynomial V2, and their x 2 (Right now ) and x 6 (Right now ) becomes zero.

[0100] Afterwards, the ciphertext (C2+C2(x 5 )) / 2 performs homomorphic multiplication to obtain the ciphertext x 2 ×(C2+C2(x 5 )) / 2, the ciphertext corresponds to the plaintext polynomial x 2 ×(V2+V2(x 5 )) / 2, specifically, x 2 Respectively with (C2+C2(x 5 )) / 2, we multiply the two polynomials to get the two new ciphertext polynomials. 2 ×(V2+V2(x 5 )) / 2 by the coefficients of the plaintext polynomial (V2+V2(x 5 )) / 2 is obtained by processing the coefficients as follows: the plaintext polynomial (V2+V2(x 5 Each of the coefficients of the 1st to 6th terms in )) / 2 is moved back two spaces, and the 7th and 8th terms are multiplied by -1 and moved to the first and second spaces. After this homomorphic multiplication process, x 2 ×(V2+V2(x 5 )) / 2 and the coefficients to be retained are the same as (V1+V1(x 5 )) / 2 has a coefficient of 0, corresponding to the position of x 2 ×(V2+V2(x 5 )) / 2 with zero coefficients and (V1+V1(x 5 )) / 2 corresponds to the position of the coefficients that need to be retained. Thus, referring to Figure 3, by (C1+C1(x 5 )) / 2 and ciphertext x 2 ×(C2+C2(x 5 )) / 2, and the ciphertext C3 is obtained. Its corresponding plaintext polynomial (V1+V1(x 5 )) / 2+x 2 ×(V2+V2(x 5)) / 2 (i.e. plaintext polynomial V3) includes all coefficients that need to be retained in plaintext polynomials V1 and V2, i.e. 2, 4, 3, and 5. According to formulas (3) and (4) above, it can be concluded that the ciphertext C3 corresponds to the plaintext polynomial That is, the coefficients in the plaintext polynomial V3 include the row vectors of the matrix W and the vector The inner product of .

[0101] In one embodiment, the ciphertext C3 can be transformed by the following homomorphic calculation: C3 = (C1 + C1 (x 5 )+x 2 ×(C2+C2(x 5 ))) / 2=(C1+x 2 ×C2+(C1(x 5 )+x 2 ×C2(x 5 ))) / 2 = (C1+x 2 ×C2+(C1(x 5 )-x 2+8 ×C2(x 5 ))) / 2 = (C1+x 2 ×C2+(C1(x 5 )-(x 5 ) 2 ×C2(x 5 ))) / 2 = (C1+x 2 ×C2+(C1-x 2 ×C2)(x 5 )) / 2 (6)

[0102] According to formula (6), the matrix holder can first perform homomorphic multiplication on the ciphertext C2 to obtain x 2 ×C2, then the matrix holder can calculate the ciphertext C1-x 2 ×C2, then only the ciphertext C1-x 2 ×C2 performs a homomorphic replacement, that is, the ciphertext C1-x 2 ×Replace the x in C2 with x 5 , the ciphertext C3 can be obtained, thus saving computing resources.

[0103] It is understood that the embodiment of this specification is not limited to setting the first parameter value to 2. s +1, set the second parameter value to N / 2 s , for example, in 2 s+1 If it is less than or equal to N, the first parameter value can be set to 2 s+1+1, and set the second parameter value accordingly according to the first parameter value. For example, when the degree of the polynomial space is less than 16, when the first parameter value is set to 9, one of the two ciphertexts is x-ed. 9 Homomorphic replacement is performed, so that the ciphertext can be converted similarly to the above, so that the 2nd term (i.e., 16 / 8 term) coefficient, the 6th term (i.e., 16*3 / 8 term) coefficient, the 10th term (i.e., 16*5 / 8 term) coefficient, and the 14th term (i.e., 16*7 / 8 term) coefficient of the plaintext polynomial corresponding to the ciphertext after conversion are set to 0, and by setting the second parameter value accordingly according to the first parameter value, the coefficients that need to be retained in the plaintext polynomial corresponding to the other ciphertext of the two ciphertexts can be packed into at least one of the 2nd term coefficient, the 6th term coefficient, the 10th term coefficient, and the 14th term coefficient in the plaintext polynomial corresponding to the final ciphertext.

[0104] In the case where the matrix holder only packages the two ciphertexts C1 and C2, the obtained ciphertext C3 is also the ciphertext Cq to be sent to the vector holder.

[0105] In another case, the matrix holder obtains the four ciphertexts C 21 ~C 24 , the matrix holder can iteratively execute steps S241 and S243 in FIG2 to convert the four ciphertexts C 21 ~C 24 Packed into a ciphertext, so that the ciphertext obtained by the packing includes four ciphertexts C 21 ~C 24 All coefficients that need to be retained in the corresponding plaintext polynomial.

[0106] Figure 4 is a schematic diagram of the process of packing four ciphertexts in the embodiment of this specification. As shown in Figure 4, assuming that the two values ​​in the plaintext polynomial corresponding to each ciphertext are the coefficients that need to be retained in the plaintext polynomial, the matrix holder can first pack the ciphertext C 21 and C 23 Execute step S241 in FIG2 , where similar to the process shown in FIG3 , the plaintext polynomial C 21 and V 25 The number of coefficients that need to be retained in is 4, so the first parameter value is 5 and the second parameter value is 2. Then, the matrix holder performs step S243, thereby obtaining the ciphertext C similar to the process shown in Figure 3. 25 , the ciphertext C 25 The corresponding plaintext polynomial V 25 The plaintext polynomial V is included 21 and V 25 There are four coefficients that need to be retained in .

[0107] Then, the matrix holder can use the ciphertext C22 and C 24 Execute step S241 in FIG2 , where the plaintext polynomial C 22 and V 24 The number of coefficients that need to be retained in is 4, so the first parameter value is 5 and the second parameter value is 2. After that, the matrix holder executes step S243 to obtain the ciphertext C 26 , the ciphertext C 26 The corresponding plaintext polynomial V 26 The plaintext polynomial V is included 22 and V 24 There are four coefficients that need to be retained in .

[0108] After getting the ciphertext C 25 and C 26 Afterwards, the matrix holder can 25 and C 26 Execute step S241 in FIG2, where the ciphertext C 25 The corresponding plaintext polynomial C 25 and ciphertext C 26 The corresponding plaintext polynomial V 26 The number of coefficients that need to be retained is 4+4=8, so the first parameter value is 8+1=9 and the second parameter value is 8 / 8=1. In this case, s=l+h, where 2 l is the number of ciphertexts initially involved in the data processing process (i.e., C 21 ~C 24 4 in total), 2 h The number of coefficients that need to be retained in the plaintext polynomial corresponding to each initial ciphertext (i.e. 2), 2 l+h =2 l ×2 h , that is, the number of all coefficients that need to be retained included in all the ciphertexts initially involved in the data processing process.

[0109] Afterwards, the matrix holder executes step S243. Similar to the process shown in FIG3 , the matrix holder can 25 and C 26 Replace the x in the 9 , and the ciphertext C 26 +C 26 (x 9 ) is homomorphically multiplied with x to obtain x×(C 26 +C 26 (x 9 )), and C 25 +C 25 5(x 9 ) and x×(C 26 +C 26 (x 9)) add together to get the ciphertext C 27 =((C 25 +C 25 (x 9 ))+x×(C 26 +C 26 (x 9 ))) / 2, the plaintext polynomial V corresponding to the ciphertext 27 =((V 25 +V 25 (x 9 ))+x×(V 26 +V 26 (x 9 ))) / 2 As shown in Figure 4, it includes the plaintext polynomial V 21 ~V 24 All coefficients that need to be retained in . In this case, the ciphertext C obtained by the matrix holder 27 is the ciphertext Cq to be sent to the vector holder.

[0110] That is to say, the matrix holder can package multiple ciphertexts in the form of a binary tree, so that the final ciphertext includes the coefficients that need to be retained in each plaintext polynomial corresponding to all the ciphertexts.

[0111] Referring to the processing process shown in FIG4, for the four ciphertexts C arranged in sequence 21 ~C 24 By packing the odd and even items in the four ciphertexts respectively, the ciphertext C 27 The corresponding plaintext polynomial V 27 The coefficients of the first to fourth items in the sequence are respectively the plaintext polynomial V 21 ~V 24 The four constant terms, and the coefficients of these four terms are in the plaintext polynomial V 27 The position order in the corresponding plaintext polynomial V 21 ~V 24 The order of arrangement (ie, the ciphertext C 21 ~C 24 The order of arrangement is consistent), and the coefficients of the 5th to 8th items are respectively the plaintext polynomial V 21 ~V 24 Four x's 4 The four coefficients are in the plaintext polynomial V 27 The position order in the corresponding plaintext polynomial V 21 ~V 24 The order of arrangement is consistent.

[0112] In step S250, the matrix holder sends the ciphertext Cq to the vector holder.

[0113] In step S260, the vector holder decrypts the ciphertext Cq, obtains the plaintext polynomial Vq, and obtains multiple vector inner products from the plaintext polynomial Vq.

[0114] Specifically, in the above example, the vector holder can use the private key sk to decrypt the ciphertext C3 and obtain the above plaintext polynomial V3, so that the constant term and x in V3 can be obtained. 2 Item, x 4 Term and x 6 The coefficients of the terms are obtained by taking the row vectors and vectors of the matrix W. The inner product of .

[0115] In another example above, the vector holder can use the private key sk to encrypt the ciphertext C 27 Decryption, get the above plaintext polynomial V 27 , which can be obtained from V 27 The coefficients of the 8 items in the matrix W2 are obtained by combining the row vectors and the vector The inner product of .

[0116] Through the scheme in this embodiment, the matrix holder packs multiple ciphertexts into one ciphertext and only needs to send one ciphertext to the vector holder. In this way, multiple target coefficients included in multiple plaintext polynomials corresponding to the multiple ciphertexts can be provided to the vector holder without sending multiple ciphertexts to the vector holder, thereby reducing the amount of communication data between the matrix holder and the vector holder.

[0117] It should be understood that the application scenario shown in Figure 2 is merely an example scenario for the data processing solution in one embodiment of this specification. This embodiment is not limited thereto and can be applied to other scenarios requiring the packaging of multiple ciphertexts. Figure 5 shows a flow chart of a data processing method in another embodiment of this specification. This method can be executed by any computing device.

[0118] As shown in FIG5 , first in step S510 , the ciphertext Ci corresponding to the plaintext polynomial Vi and the ciphertext Cj corresponding to the plaintext polynomial Vj are obtained.

[0119] Wherein, the ciphertext Ci and the ciphertext Cj are ciphertexts based on the same homomorphic encryption public key pk. The plaintext polynomial Vi corresponding to the ciphertext Ci is in the form of Vi=v i0 +v i1 x+…v iN x N , the plaintext polynomial Vj corresponding to the ciphertext Cj is in the form of Vj=v j0 +v j1 x+…v jN x NIn one case, the ciphertext Ci and the ciphertext Cj can be the ciphertexts obtained by directly encrypting the corresponding plaintext polynomials with the public key pk. In another case, the ciphertext Ci and the ciphertext Cj can be the ciphertexts obtained by performing homomorphic calculations on the homomorphically encrypted ciphertexts. For example, the ciphertext C in the above text 25 and C 26 .

[0120] In step S520, a first parameter value and a second parameter value are determined based on the number of target coefficients in the plaintext polynomial Vi and the plaintext polynomial Vj.

[0121] The first parameter value is the number of times x in the ciphertext is homomorphically replaced, and the second parameter value is the number of times x is homomorphically multiplied.

[0122] In one embodiment, based on the number of coefficients that need to be retained in the plaintext polynomial Vi and the plaintext polynomial Vj, s , 2 s Should be less than or equal to N, the first parameter value can be determined to be 2 s +1, the second parameter value is N / 2 s It is understood that the embodiment of this specification is not limited to setting the first parameter value to 2. s +1, set the second parameter value to N / 2 s , for example, in 2 s+1 If it is less than or equal to N, the first parameter value can be set to 2 s+1 +1, set the second parameter value accordingly according to the first parameter value.

[0123] For example, there are a total of 4 target coefficients that need to be retained in the plaintext polynomial Vi and the plaintext polynomial Vj, so the first parameter value can be determined to be 5 and the second parameter value to be N / 4.

[0124] In one embodiment, s=l+h, where 2 l is the number of ciphertexts initially involved in the data processing process, 2 h The number of coefficients that need to be retained in the plaintext polynomial corresponding to each initial ciphertext, 2 l+h =2 l ×2 h , that is, the number of all coefficients that need to be retained included in all the ciphertexts initially involved in the data processing process.

[0125] In step S230, a homomorphic calculation is performed based on the first parameter value, the second parameter value, the ciphertext Ci, and the ciphertext Cj to obtain the ciphertext Ck.

[0126] Assuming the first parameter value is 5 and the second parameter value is N / 4, the computing device can first perform homomorphic replacement on both the ciphertext Ci and the ciphertext Cj based on the first parameter value, that is, replace x in the ciphertext Ci with x 5 , replace x in the ciphertext Cj with x 5 Specifically, replace the x in the two polynomials included in the ciphertext Ci with x 5 , replace x in the two polynomials included in the ciphertext Cj with x 5 .

[0127] Among them, based on the principle of homomorphic substitution, the x in the ciphertext Ci is replaced by x 5 , which is equivalent to replacing x in the plaintext polynomial Vi with x 5 , that is, the plaintext polynomial Vi is converted into the following form: Vi(x 5 )=v0+v1x 5 +…v N x 5N

[0128] Referring to the derivation above, after homomorphic substitution, the plaintext polynomial Vi(x 5 ) The coefficients of the terms are the same as those in the plaintext polynomial Vi The coefficients of the terms are the same, the plaintext polynomial Vi(x 5 ) Xiang He The coefficients of the terms are the negatives of the coefficients of the corresponding terms in the plaintext polynomial Vi.

[0129] By doing so, by combining the ciphertext Ci with the ciphertext Ci(x 5 ) is added, and the plaintext polynomial Vi+Vi(x 5 ) and x 4 The coefficient of the term is twice the coefficient of the corresponding term in the plaintext polynomial Vi. and The coefficient of the term becomes zero. 5 ) is to add the first polynomial of the ciphertext Ci to Ci(x 5 ) is added to the first polynomial, and the second polynomial of the ciphertext Ci is added to Ci(x 5 ) are added together to obtain two new ciphertext polynomials.

[0130] Similarly, the ciphertext Cj is processed to obtain the ciphertext Cj+Cj(x 5 ), its corresponding plaintext polynomial Vj+Vj(x 5 ) and The coefficient of the term is twice the coefficient of the corresponding term in the plaintext polynomial Vj. and The coefficient of the term becomes zero.

[0131] Afterwards, the ciphertext (Cj+Cj(x 5 )) / 2 performs homomorphic multiplication to obtain the ciphertext The ciphertext corresponds to the plaintext polynomial Specifically, Respectively with (Cj+Cj(x 5 )) / 2, we multiply the two polynomials to get the two new ciphertext polynomials. After the homomorphic multiplication, The coefficients that need to be retained in Vj+Vj(x 5 ) corresponds to the position of the term with a coefficient of 0, The terms with zero coefficients in Vi+Vi(x 5 ) in the corresponding coefficient position. Thus, by (Ci+Ci(x 5 )) / 2 and ciphertext Add together to get the ciphertext Ck, and its corresponding plaintext polynomial It includes all the coefficients that need to be retained in the plaintext polynomial Vi and the plaintext polynomial Vj.

[0132] In one embodiment, the conversion can be performed by the following homomorphic computation:

[0133] According to the above formula, the computing device can first perform homomorphic multiplication on the ciphertext Cj to obtain The computing device can then calculate the ciphertext Then only the ciphertext Perform a homomorphic replacement, that is, the ciphertext Replace the x in the 5 , the ciphertext Ck can be obtained, thus saving computing resources.

[0134] Referring to the description above, when a computing device packages M ciphertexts, the ciphertexts may be packaged based on a binary tree structure. When M is a power of 2, the ciphertexts in the multiple ciphertexts may be first combined in pairs to obtain multiple ciphertext pairs. Each ciphertext pair may then be packaged to obtain M / 2 ciphertexts. The M / 2 ciphertexts may then be packaged in pairs, and so on, until a ciphertext Cq is obtained, such that the plaintext polynomial corresponding to the ciphertext Cq includes all coefficients that need to be retained in the M plaintext polynomials corresponding to the M ciphertexts. It can be understood that when M is not a power of 2, multiple ciphertexts can still be packaged and processed based on the binary tree structure. For example, when M=3, assuming that the ciphertexts Ci, Cj, and Ck are packaged and processed, the computing device can first package the ciphertexts Ci and Cj to obtain the ciphertext Ct, and then package the ciphertext Ct and the ciphertext Ck to obtain the final ciphertext Cq, so that the plaintext polynomial corresponding to the ciphertext Cq includes all the coefficients that need to be retained in the three plaintext polynomials corresponding to the ciphertexts Ci, Cj, and Ck.

[0135] After the computing device obtains the ciphertext Cq by packaging multiple ciphertexts, it can send the ciphertext Cq to another device to provide the other device with multiple target coefficients in the plaintext polynomial corresponding to the ciphertext Cq.

[0136] Through the scheme of this embodiment, multiple ciphertexts can be homomorphically calculated based on the number of coefficients that need to be retained in each ciphertext, so that in the process of packing two ciphertexts once, the two ciphertexts are packed into one packed ciphertext, so that the plaintext polynomial corresponding to the packed ciphertext includes all the target coefficients that need to be retained corresponding to the two ciphertexts, thereby saving computational complexity and storage resources required for storing ciphertexts, and reducing the amount of communication data required to provide the target coefficients to other devices.

[0137] FIG6 is an architecture diagram of a computing device according to an embodiment of this specification, including:

[0138] An acquiring unit 61 is configured to acquire a first ciphertext and a second ciphertext, where the first ciphertext and the second ciphertext are homomorphic ciphertexts of a first plaintext polynomial and a second plaintext polynomial, respectively, and the first plaintext polynomial and the second plaintext polynomial are polynomials in the same polynomial space;

[0139] a determining unit 62, configured to determine a first parameter value and a second parameter value based on a first number of first coefficients to be retained in the first plaintext polynomial and the second plaintext polynomial, wherein the first parameter value is used in a homomorphic computation of homomorphic replacement of the homomorphic ciphertext and the second parameter value is used in a homomorphic computation of homomorphic multiplication of the homomorphic ciphertext;

[0140] The calculation unit 63 is configured to perform homomorphic calculation based on the first parameter value, the second parameter value, the first ciphertext, and the second ciphertext to obtain a third ciphertext, where a third plaintext polynomial corresponding to the third ciphertext includes the first coefficient of the first number.

[0141] The embodiments of this specification also provide a computer-readable storage medium on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute the method shown in FIG. 2 or FIG. 5 .

[0142] An embodiment of this specification also provides a computing device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method shown in Figure 2 or Figure 5 is implemented.

[0143] In the 1990s, technological improvements could be clearly distinguished as either hardware improvements (for example, improvements to circuit structures like diodes, transistors, and switches) or software improvements (improvements to process flows). However, with the advancement of technology, many process flow improvements today can now be considered direct improvements to hardware circuit structures. Designers almost always create the corresponding hardware circuit structure by programming the improved process flow into the hardware circuit. Therefore, it cannot be said that a process flow improvement cannot be implemented using hardware modules. For example, a programmable logic device (PLD), such as a field programmable gate array (FPGA), is an integrated circuit whose logical function is determined by user programming. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to hire a chip manufacturer to design and manufacture a dedicated integrated circuit chip. Moreover, nowadays, instead of manually fabricating integrated circuit chips, this programming is mostly done using "logic compiler" software. This is similar to the software compiler used when developing programs. Before compilation, the original code must also be written in a specific programming language, called a hardware description language (HDL). There is not just one HDL, but many, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art will also understand that by simply programming the method flow in one of these hardware description languages ​​and then programming it into an integrated circuit, a hardware circuit that implements the logic method flow can be easily obtained.

[0144] The controller can be implemented in any suitable manner. For example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also know that in addition to implementing the controller in a purely computer-readable program code format, the controller can be implemented in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, such a controller can be considered a hardware component, and the devices included therein for implementing various functions can also be considered as structures within the hardware component. Or even, the devices for implementing various functions can be considered as both software modules that implement the method and structures within the hardware component.

[0145] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, this application does not exclude that with the future development of computer technology, the computer that implements the functions of the above embodiments may be, for example, a personal computer, a laptop computer, an in-vehicle human-computer interaction device, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0146] Although one or more embodiments of this specification provide method operation steps as described in the embodiments or flow charts, more or fewer operation steps may be included based on conventional or non-creative means. The order of steps listed in the embodiments is only one way of executing the order of many steps and does not represent the only execution order. When the device or terminal product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiments or the drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The term "comprise", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or equipment including a series of elements includes not only those elements, but also includes other elements that are not clearly listed, or also includes elements inherent to such process, method, product or equipment. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or equipment including the elements. For example, if the words first, second, etc. are used to represent the name, they do not represent any particular order.

[0147] For the convenience of description, the above devices are described in terms of functions divided into various modules. Of course, when implementing one or more of the present specifications, the functions of each module can be implemented in the same or multiple software and / or hardware, or the module that implements the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0148] The present invention is described with reference to the flowcharts and / or block diagrams of the methods, apparatus (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the functions specified in one or more processes in the flowchart and / or one or more blocks in the block diagram.

[0149] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0150] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0151] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0152] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0153] Computer-readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic disk storage, graphene storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory media such as modulated data signals and carrier waves.

[0154] Those skilled in the art will appreciate that one or more embodiments of this specification may be provided as a method, system, or computer program product. Thus, one or more embodiments of this specification may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0155] One or more embodiments of this specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. One or more embodiments of this specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communications network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0156] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between the various embodiments can be referenced across them. Each embodiment focuses on the differences from the other embodiments. In particular, since the system embodiments are generally similar to the method embodiments, their description is relatively simple. For relevant parts, reference can be made to the description of the method embodiments. Throughout this specification, reference to the terms "one embodiment," "some embodiments," "examples," "specific examples," or "some examples" means that the specific features, structures, materials, or characteristics described in conjunction with that embodiment or example are included in at least one embodiment or example of this specification. In this specification, the schematic representations of these terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, those skilled in the art may combine and integrate the different embodiments or examples, and features of different embodiments or examples, described in this specification, without conflict.

[0157] The foregoing description is merely an example of one or more embodiments of this specification and is not intended to limit the one or more embodiments of this specification. Those skilled in the art will appreciate that various modifications and variations of one or more embodiments of this specification are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of this specification are intended to be included within the scope of the claims.

Claims

1. A privacy-protecting data processing method, the method being executed by a first party's device and a second party's device, wherein: The second party has a public key for homomorphic encryption and a private key corresponding to the public key, and the method includes: The first party's device performs the following operations: Obtain a first ciphertext and a second ciphertext, wherein the first ciphertext and the second ciphertext are homomorphic ciphertexts of a first plaintext polynomial and a second plaintext polynomial, respectively, the first ciphertext and the second ciphertext correspond to the public key, and the first plaintext polynomial and the second plaintext polynomial are polynomials in the same polynomial space; Determine a first parameter value and a second parameter value based on a first number of first coefficients as target coefficients in the first plaintext polynomial and the second plaintext polynomial, the first parameter value being used in a homomorphic calculation of homomorphic replacement of a homomorphic ciphertext, and the second parameter value being used in a homomorphic calculation of homomorphic multiplication of a homomorphic ciphertext; perform homomorphic calculation based on the first parameter value, the second parameter value, the first ciphertext, and the second ciphertext to obtain a third ciphertext, the third plaintext polynomial corresponding to the third ciphertext including the first number of first coefficients; sending the third ciphertext to a device of the second party; The device of the second party decrypts the third ciphertext based on the private key to obtain the third plaintext polynomial, and obtains the first coefficient of the first number from the third plaintext polynomial.

2. The method according to claim 1, wherein the first coefficients of the first plaintext polynomial and the second plaintext polynomial as target coefficients at least include constant term coefficients and x N / 2 The coefficient of the term.

3. According to the method of claim 1 or 2, the performing homomorphic calculation based on the first parameter value, the second parameter value, the first ciphertext and the second ciphertext comprises: The first ciphertext is homomorphically replaced based on the first parameter value to obtain a fourth ciphertext, wherein at least x of the fourth plaintext polynomial corresponding to the fourth ciphertext i Item and x j The coefficient of the term is x in the first plaintext polynomial i Item and x j The negative number of the coefficient of the term, where x in the first plaintext polynomial i Item and x j The coefficient of the term is not the target coefficient in the first plaintext polynomial.

4. According to the method of claim 3, the performing homomorphic calculation based on the first parameter value, the second parameter value, the first ciphertext and the second ciphertext further comprises: Based on the first parameter value, the second ciphertext is homomorphically replaced to obtain a fifth ciphertext, and based on the second parameter value, the second ciphertext and the fifth ciphertext are homomorphically multiplied to obtain a sixth ciphertext, and the xth value of the sixth plaintext polynomial corresponding to the sixth ciphertext is i Item and x j The coefficient of the term is the target coefficient in the second plaintext polynomial, the coefficient of the term in the sixth plaintext polynomial corresponding to the first coefficient in the first plaintext polynomial is zero, and the third ciphertext is obtained based on adding the sixth ciphertext to the first ciphertext and the fourth ciphertext.

5. The method according to claim 1 or 2, wherein the performing homomorphic calculation based on the first parameter value, the second parameter value, the first ciphertext and the second ciphertext comprises: The second ciphertext is homomorphically multiplied based on the second parameter value to obtain a seventh ciphertext, the difference between the first ciphertext and the seventh ciphertext is homomorphically replaced based on the first parameter value to obtain an eighth ciphertext, and the third ciphertext is obtained by adding the first ciphertext, the seventh ciphertext and the eighth ciphertext.

6. The method according to claim 1, further comprising: The device of the second party uses the public key to homomorphically encrypt the ninth plaintext polynomial to obtain a ninth ciphertext, where the coefficient of the ninth plaintext polynomial corresponds to the first vector, and sends the ninth ciphertext to the device of the first party. The device of the first party multiplies the tenth plaintext polynomial and the eleventh plaintext polynomial by the ninth ciphertext respectively to obtain the first ciphertext and the second ciphertext, wherein the coefficient of the tenth plaintext polynomial corresponds to the second vector and the third vector, and the coefficient of the eleventh plaintext polynomial corresponds to the fourth vector and the fifth vector, The first coefficients of the first number include an inner product of the second vector and the first vector, an inner product of the third vector and the first vector, an inner product of the fourth vector and the first vector, and an inner product of the fifth vector and the first vector.

7. The method according to claim 1, further comprising: Obtain a twelfth ciphertext and a thirteenth ciphertext, wherein the twelfth ciphertext and the thirteenth ciphertext are homomorphic ciphertexts of a twelfth plaintext polynomial and a thirteenth plaintext polynomial, respectively, the twelfth ciphertext and the thirteenth ciphertext correspond to the public key, and the twelfth plaintext polynomial and the thirteenth plaintext polynomial are polynomials in the polynomial space; Determine a third parameter value and a fourth parameter value based on the second number of the second coefficients as the target coefficients in the twelfth plaintext polynomial and the thirteenth plaintext polynomial, the third parameter value being used in a homomorphic calculation of homomorphic replacement of the homomorphic ciphertext, and the fourth parameter value being used in a homomorphic calculation of homomorphic multiplication of the homomorphic ciphertext; Homomorphic calculation is performed based on the third parameter value, the fourth parameter value, the twelfth ciphertext, and the thirteenth ciphertext to obtain the first ciphertext.

8. According to the method of claim 1, the degree of the polynomials included in the polynomial space is less than N, N is a power of 2, the first number is a power of 2, and the first number is less than or equal to N.

9. The method according to claim 8, wherein: The first parameter value is equal to the first number plus 1, and the second parameter value is equal to N / first number.

10. A data processing method for protecting privacy, comprising: Obtain a first ciphertext and a second ciphertext, wherein the first ciphertext and the second ciphertext are homomorphic ciphertexts of a first plaintext polynomial and a second plaintext polynomial, respectively, and the first plaintext polynomial and the second plaintext polynomial are the same polymorphic polynomial. Polynomials in term space; Determine a first parameter value and a second parameter value based on a first number of first coefficients as target coefficients in the first plaintext polynomial and the second plaintext polynomial, the first parameter value being used in a homomorphic calculation of homomorphic replacement of a homomorphic ciphertext, and the second parameter value being used in a homomorphic calculation of homomorphic multiplication of a homomorphic ciphertext; A third ciphertext is obtained by performing homomorphic calculation based on the first parameter value, the second parameter value, the first ciphertext, and the second ciphertext, wherein a third plaintext polynomial corresponding to the third ciphertext includes a first coefficient of the first number.

11. The method according to claim 10, wherein the method is performed by a device of the first party, and further comprising: The third ciphertext is sent to a device of a second party, wherein the second party possesses a private key corresponding to the third ciphertext.

12. The method according to claim 10, wherein the obtaining of the first ciphertext and the second ciphertext comprises obtaining a first group of ciphertext pairs and a second group of ciphertext pairs, each group of ciphertext pairs comprising a first ciphertext and a second ciphertext, and the obtaining of the third ciphertext comprises obtaining a third ciphertext corresponding to the first group of ciphertext pairs and a third ciphertext corresponding to the second group of ciphertext pairs, and the method further comprises: The data processing is performed using the two third ciphertexts as the first ciphertext and the second ciphertext in a third ciphertext pair to obtain a third ciphertext corresponding to the third ciphertext pair, wherein the plaintext polynomial corresponding to the third ciphertext corresponding to the third ciphertext pair includes the target coefficients in the plaintext polynomials corresponding to the first ciphertext pair and the second ciphertext pair.

13. The method according to claim 12, further comprising: Obtain four ciphertexts arranged in sequence, sequentially compose the first and third ciphertexts into the first group of ciphertext pairs, and sequentially compose the second and fourth ciphertexts into the second group of ciphertext pairs.

14. A computing device comprising: an acquiring unit, configured to acquire a first ciphertext and a second ciphertext, wherein the first ciphertext and the second ciphertext are homomorphic ciphertexts of a first plaintext polynomial and a second plaintext polynomial, respectively, and the first plaintext polynomial and the second plaintext polynomial are polynomials in the same polynomial space; a determining unit, configured to determine a first parameter value and a second parameter value based on a first number of first coefficients as target coefficients in the first plaintext polynomial and the second plaintext polynomial, the first parameter value being used in a homomorphic calculation of homomorphic replacement of a homomorphic ciphertext, and the second parameter value being used in a homomorphic calculation of homomorphic multiplication of a homomorphic ciphertext; a computing unit, configured to calculate a first ciphertext based on the first parameter value, the second parameter value, the first ciphertext and the first The two ciphertexts are homomorphically calculated to obtain a third ciphertext, and a third plaintext polynomial corresponding to the third ciphertext includes the first coefficient of the first number.

15. A data processing system for protecting privacy, the system comprising a device of a first party and a device of a second party, wherein: The second party has a public key for homomorphic encryption and a private key corresponding to the public key. The first party's device is used to perform the following operations: Obtain a first ciphertext and a second ciphertext, wherein the first ciphertext and the second ciphertext are homomorphic ciphertexts of a first plaintext polynomial and a second plaintext polynomial, respectively, the first ciphertext and the second ciphertext correspond to the public key, and the first plaintext polynomial and the second plaintext polynomial are polynomials in the same polynomial space; Determine a first parameter value and a second parameter value based on a first number of first coefficients as target coefficients in the first plaintext polynomial and the second plaintext polynomial, the first parameter value being used in a homomorphic calculation of homomorphic replacement of a homomorphic ciphertext, and the second parameter value being used in a homomorphic calculation of homomorphic multiplication of a homomorphic ciphertext; Performing homomorphic calculation based on the first parameter value, the second parameter value, the first ciphertext, and the second ciphertext to obtain a third ciphertext, wherein a third plaintext polynomial corresponding to the third ciphertext includes a first coefficient of the first number; sending the third ciphertext to a device of the second party; The device of the second party is used to decrypt the third ciphertext based on the private key to obtain the third plaintext polynomial, and obtain the first coefficient of the first number from the third plaintext polynomial.

16. A computing device comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method according to any one of claims 10 to 12 is implemented.

Images