RU2780150C1 - System for homomorphic data encryption based on a system of residual classes - Google Patents

Abstract

FIELD: computer technology.

SUBSTANCE: invention relates to computational modular systems and is designed to perform homomorphic data encryption. A system of homomorphic data encryption based on a system of residual classes (SRC), including a data encryption block, a data decryption block, contains n encryption blocks, n blocks for finding residues by modulo p_j(x), j=1, ..., n, a computing environment performing calculations on encrypted data, a neural network recovery block, a decryption block, while as the system of residual classes, a polynomial system of residual classes is taken with n mutually simple polynomials p_j(x) over the field F₂, for which k<n is the threshold, K(x) is the secret key, which is mutually simple with each of the SRC modules, Seed(x) is a random polynomial satisfying the condition

where d is the maximum degree of the source data

, and N is the number of multiplication operations with encrypted data, the source data comes through encryption blocks to the inputs of the corresponding blocks for finding residues by modulo p_j(x), together implementing data encryption according to the formula

, where i is the number of the source data, the outputs of the residue finding blocks by modulo p_j(x) are connected to the inputs of the computing environment, the outputs of which are connected to the inputs of the neural network recovery block implementing the formula

, where

,

, and P(x) is the product of the modules p _j (x), j=1, ..., k, the output of the neural network recovery block connected to the input of the decryption block, which finds the remainder by the secret key K(x), the output of the decryption block is the output of the system.

EFFECT: reduction in the complexity of calculations due to the use of a polynomial system of residual classes and the ability to perform calculations on encrypted data.

1 cl, 2 dwg

Description

The invention relates to modular computing systems and is intended to perform homomorphic data encryption by translating residual classes into a polynomial system and uses the Asmuth-Bloom scheme to provide calculations on encrypted data.

The need to ensure the security of data storage and processing becomes especially relevant in connection with the spread of large-scale distributed computing infrastructures, such as clouds. Given that no single storage and processing service, node, or user can be fully trusted, sensitive data must be encoded and distributed across a set of independent storage nodes. Based on these fundamental principles, a number of robust storage systems, such as threshold secret sharing schemes, have been developed that are capable of protecting data in the cloud because they potentially provide improvements over conventional encryption and replication strategies because they are not subject to issues such as key management. and brute force attacks. At the same time, the processing of encrypted data remains an important problem.

A method and device for processing participant feedback, equipment and an information carrier are known (patent CN109981293, published on 07/05/2019), which provide a method for processing participant feedback. Based on a digital signature based scheme, each real member in the control system generates each member's secret share using each member's historical private key and a random number; each real member generates a new private key using the other members and secret shares obtained by the real member, the whole process ensures that the group public key and group private key still remain the same when the members leave, and the group public key and group private key by can still be used for signing and verification, which reduces the cost of system upgrades; and meanwhile, if the current private key is lost, the historical private key and the subsequent period private key cannot be known, so that the security of the historical signature and the subsequent signature is also guaranteed. The invention further discloses a participant feedback processing apparatus, participant feedback processing equipment, and a readable storage medium, which have the aforementioned beneficial effects.

The disadvantage of this invention is the impossibility of computing with encrypted data.

A device and a method for storing a secret key in a heterogeneous redundant system are known (patent CN110430042, publ. 08.11.2019), which relates to the field of heterogeneous redundant systems and technology for storing secret encryption keys, in particular, to a device and method for storing a secret key in a heterogeneous redundant system . The device contains a secret key segmentation module used to segment a secret key of a certain length into m blocks of secret keys of the same length and label each secret key block with a data label 1, 2, ..., m; a secret key distribution module used to allocate (k-1)⋅m secret key blocks to k secret key storage blocks according to a set strategy; a secret key storage module used to correctly store n secret key blocks allocated to each secret key storage block, the secret key storage blocks being distributed in various heterogeneous actuators; and a secret key combination module used to obtain the secret key blocks from the secret key storage block and combine the secret key blocks into a complete secret key according to the data label. The secret keys are segmented and stored in different secret key storage units so that all the secret keys cannot be lost under the conditions of a single point system breach.

The disadvantage of this invention is the impossibility of computing with encrypted data.

A secret sharing scheme with polynomial division over the field GF(Q) is known (application US2010046739, published on February 25, 2010), in which the secret is represented by a secret polynomial of degree d over GF(q) constructed using a prime number or a power of a prime number. The secret polynomial is then embedded in the extended polynomial of degree m greater than d. The extension polynomial is divided into n coprime divisor polynomials over GF(q) using the arithmetic defined for polynomials over GF(q) to generate n shares of the secret. Each fraction includes one of the divisor polynomials and the corresponding remainder. These n shared resources are shared among multiple cooperating entities to share the secret.

The disadvantage of this invention is the lack of data security and the impossibility of computing with encrypted data.

The closest in technical essence is a method and system for secure storage of data using a secret sharing scheme (application US2019288841, published on September 19, 2019), in which, based on the Chinese remainder theorem, a method for secure storage of a target number is provided. A set of n pairs of coprime numbers is generated, while the target number (secret) can be uniquely obtained from any t of n pairs. In one aspect, the divisors are preselected such that any randomly selected n integers from the sequence are a valid Asmuth-Bloom sequence for any access structure (t, n) where 1 <t≤n≤N. In another aspect, means are provided for pre-storing the terms of the Mignotte or Asmuth-Bloom sequence of N divisors in a lookup table from which n divisors can be selected. Thus, a flexible access structure is maintained. Sharing secrets for a chosen access structure can be generated without having to perform the laborious process of computing Mignotte sequences for each secret and access structure. The amount of memory required to store secret shares is also reduced by storing and retrieving comparison pairs in the form of index and remainder.

The disadvantage of this invention is the complexity of performing operations with large numbers to obtain parts of the secret and the impossibility of computing with encrypted data.

The technical result of this invention is to reduce the complexity of calculations through the use of a polynomial system of residual classes and expand the functionality, namely, performing calculations on encrypted data.

- максимальная степень исходных данных

, а N - максимальное количество операций умножения с зашифрованными данными, исходные данные поступают через блоки шифрования на входы соответствующих блоков нахождения остатков по модулю p_j(x), совместно реализующих шифрование данных по формуле

где i - номер исходных данных, выходы блоков нахождения остатков по модулю p_j(x) соединены с входами вычислительной среды, выходы которой соединены со входами нейросетевого блока восстановления, реализующего формулу

а P(x) - произведение модулей p _j (x) принятых k секретов, j=1,…,k, выход нейросетевого блока восстановления соединен со входом блока дешифрования, осуществляющего нахождение остатка по секретному ключу K(x), выход блока дешифрования является выходом системы, при этом нейросетевой блок восстановления содержит n нейронных сетей конечного кольца, выполняющих оператор взятия остатка по модулю p_j(x) произведения входного значения

на веса нейронной сети

, n блоков умножения многочленов, выполняющих умножение на

, блок суммирования многочленов, при этом каждый вход нейросетевого блока восстановления подключен к каждому входу нейронных сетей конечного кольца, выходы которых подключены к входам соответствующих блоков умножения многочленов, выходы которых подключены ко входам блока суммирования многочленов, выход которого является выходом нейросетевого блока восстановления.The technical result is achieved by the fact that the homomorphic data encryption system based on the system of residual classes (SOC), including a data encryption unit, a data decryption unit, contains n encryption units, n units for finding residues modulo p _j (x) , j=1,… ,n, a computing environment that performs calculations on encrypted data, a neural network recovery unit, a decryption unit, while the system of residual classes is taken as a polynomial system of residual classes with n coprime polynomials p _j (x) over the field F ₂ , for which k< n is a threshold, K(x) is a secret key that is relatively prime to each of the RNS modules, Seed(x) is a random polynomial that satisfies the condition

- the maximum degree of the initial data

, and N is the maximum number of multiplication operations with encrypted data, the original data is fed through encryption blocks to the inputs of the corresponding blocks for finding residues modulo p _j (x), jointly implementing data encryption according to the formula

where i is the number of initial data, the outputs of the units for finding residues modulo p _j (x) are connected to the inputs of the computing environment, the outputs of which are connected to the inputs of the neural network recovery unit that implements the formula

and P(x) is the product of modules p _j (x) of received k secrets , j=1,…,k, the output of the neural network recovery unit is connected to the input of the decryption unit, which finds the remainder by the secret key K(x), the output of the decryption unit is the output of the system, while the neural network recovery unit contains n finite ring neural networks that perform the operator of taking the remainder modulo p _j (x) of the product of the input value

on the weights of the neural network

, n polynomial multiplication blocks that perform multiplication by

, a polynomial summation unit, wherein each input of the neural network recovery unit is connected to each input of the finite ring neural networks, the outputs of which are connected to the inputs of the corresponding polynomial multiplication units, the outputs of which are connected to the inputs of the polynomial summation unit, the output of which is the output of the neural network recovery unit.

The essence of the invention is based on the following mathematical apparatus. In the polynomial system of residual classes (RMS), a number is represented as a polynomial F(x), which in turn is represented as a set of residuals

wheref _i (x)=rest(F(x)/p _i (x))the remainder of the division of polynomials;p _i (x) are coprime polynomials over the field F₂, for example, trinomials of the formp _i (x)=x ^fifteen +x ^a +1, wherea=[1,2,3,4,5,6,7,8,9,11,13,14].However, in this (k,n) the secret sharing scheme uses a thresholdk when splitting the secret inton=k+rparts,those. any k residues can restore the secret, but less than k residues cannot. To move from a binary representation to a polynomial, we will associate the number in the binary system with 1011₂ polynomialx ³ +x+1 aboveF ₂ , i.e. 1 corresponds to 1 before the corresponding degree. Calculations over the field F₂ correspond to the XOR operation, modulo 2 summation. The mathematical apparatus is based on the following properties:

и

, где

- количество обрабатываемых данных, подлежащих гомоморфному шифрованию, при этом заранее известно, что при гомоморфном шифровании в вычислительной среде будет выполнено не более N умножений с зашифрованными данными. Под вычислительной средой могут пониматься любые ЭВМ, выполняющие вычисления над зашифрованными данными, в том числе, с использованием облачных вычислений. Система гомоморфного шифрования определяется двумя параметрами:

- секретный ключ, взаимно прост с каждым из модулей СОК,

- случайное число, при этом существуют следующие условия: из свойства 1) следует, что количество операций сложения с шифр текстом неограниченно, из свойства 2) и Китайской теоремы об остатках следует, что количество операций умножение с зашифрованными данными ограничено следующим неравенствомLet the initial data be given, reduced to a representation in the form of polynomials

and

, where

- the amount of processed data subject to homomorphic encryption, while it is known in advance that with homomorphic encryption in the computing environment no more than N multiplications with encrypted data will be performed. A computing environment can be understood as any computer that performs calculations on encrypted data, including using cloud computing. The homomorphic encryption system is defined by two parameters:

- secret key, coprime with each of the SOK modules,

- a random number, while the following conditions exist: from property 1) it follows that the number of addition operations with cipher text is unlimited, from property 2) and the Chinese remainder theorem it follows that the number of multiplication operations with encrypted data is limited by the following inequality

From a security point of view, the following restriction applies

могут быть представлены в виде шифр текстов

по следующей формулеThen the initial data

can be presented in the form of cipher texts

according to the following formula

When decrypted based on k parts by

где P(x) - произведение модулей p _j (x), j=1,…,k. where

where P(x) is the product of modules p _j (x), j=1,…,k.

The invention is illustrated by figures 1 and 2.

The figure 1 shows the general scheme of the homomorphic data encryption system based on the system of residual classes, containing n encryption blocks 1.i, n blocks 2.i of finding residues modulo p _i (x), i=1,…,n, computing environment 3 , neural network recovery unit 4, decryption unit 5. The system input is connected to the inputs of encryption units 1.i, the outputs of which are connected to the inputs of the corresponding units 2.i of finding residues modulo p _i (x) , the outputs of which are connected to the inputs of the computing environment 3, in which the processing of ciphertexts is carried out, the result of processing from the computing environment 3 is fed to the inputs of the neural network recovery unit 4, the output of which is connected to the input of the decryption unit 5, the output of which is the output of the system.

, может быть объединен с блоком 1.i шифрования, реализуя общие вычисления по формуле

Figure 1 explains, but does not limit the invention, for example, blocks 2.i of finding residues modulo p _i (x), which implements the operation

, can be combined with the encryption block 1.i, implementing the general calculations according to the formula

на веса нейронной сети

, n блоков умножения многочленов 7.i, выполняющих умножение на

, блок суммирования многочленов 8, при этом каждый вход нейросетевого блока восстановления 4 подключен к каждому входу нейронных сетей конечного кольца 6.i, тем самым сообщая по каким модулям получен секрет для вычисления

и

в блоке умножения многочленов 7.i.The figure 2 discloses a diagram of the neural network recovery unit 4, containing n neural networks of the finite ring 6.i, executing the operator of taking the remainder modulo p _i (x) of the product of the input value

on the weights of the neural network

, n polynomial multiplication blocks 7.i, performing multiplication by

, the polynomial summation block 8, each input of the neural network recovery block 4 is connected to each input of the neural networks of the finite ring 6.i, thereby reporting which modules the secret was obtained for calculating

and

in the polynomial multiplication block 7.i.

Consider an example. Let the polynomial system of residual classes p ₁ =x ¹⁵ +x+1, p ₂ =x ¹⁵ +x ² +1, p ₃ =x ¹⁵ +x ³ +1, p ₄ =x ¹⁵ +x ⁴ +1, p ₅ \u003d x ¹⁵ +x ⁵ +1, p ₆ \u003d x ¹⁵ +x ⁶ +1, p ₇ \u003d x ¹⁵ +x ⁷ +1, p ₈ \u003d x ¹⁵ +x ⁸ +1, p ₉ \u003d x ¹⁵ +x ⁹ +1, p ₁₀ =x ¹⁵ +x ¹¹ +1, p ₁₁ =x ¹⁵ +x ¹³ +1, p ₁₂ =x ¹⁵ +x ¹⁴ +1 with threshold k=10. The polynomial K(x)=x ⁴⁹ +x+1 is given as a secret key. Let it be necessary to perform calculations on the numbers D ₁ (x)=x ⁹ +x+1, D ₂ (x)=x ¹⁶ +x+1, calculate d, we get d=max(deg(D ₁ (x)),deg (D ₂ (x)))=max(9,16)=16. Let's check the condition (N+1)⋅d<deg(K(x)), which implies that the computing system can perform up to 2 multiplications on encrypted data. Let N=1.

, получим:Compute

, we get:

.

.

, получим:Compute

, we get:

.

.

при кодировании

, тогда в блоках 1.j шифрования и блоках 2.j нахождения остатков по модулю p _j (x) получают следующие значения

, которые совместно со значением модуля p _j (x) передаются в вычислительную среду 3:Let

when encoding

, then in blocks 1.j of encryption and blocks 2.j of finding residues modulo p _j (x) the following values are obtained

, which together with the value of the module p _j (x) are transferred to the computing environment 3:

при кодировании

, тогда в блоках 1.j шифрования и блоках 2.j нахождения остатков по модулю p _j (x) получают следующие значения

, которые совместно со значением модуля p _j (x) передаются в вычислительную среду 3:Let

when encoding

, then in blocks 1.j of encryption and blocks 2.j of finding residues modulo p _j (x) the following values are obtained

, which together with the value of the module p _j (x) are transferred to the computing environment 3:

Let the computing environment 3 perform the addition of encrypted numbers. Get

Let 10 parts out of 12 be obtained for recovery from computing environment 3, and since the threshold is 10, this is enough for recovery. Let, for simplicity, the results for the first 10 modules be obtained, i.e. R ₁ (x)-R ₁₀ (x). These values with the corresponding modules are sent to the neural network recovery unit 4.

In the neural network of the finite ring 6.1, based on the received values of the modulus, the values are found

then the output of the neural network of the final ring will be the value

, и подающий на свой выход, который является входом блока суммирования многочленов 8, значение

which is fed to the input of the polynomial multiplication block 7.1, which performs multiplication by

, and feeding to its output, which is the input of the polynomial summation block 8, the value

Similar calculations are carried out in the remaining blocks 6.i and 7.i. In the case when data on these modules is not accepted, the values are taken equal to 0.

Thus, at the output of the polynomial summation block 8, we get the encrypted result of addition x ⁶⁰ +x ⁵⁸ +x ⁵⁰ +x ¹⁶ +x ¹² +x ¹¹ +x ¹⁰ +x ² +x.

The decryption block 5 contains the remainder of the secret key K(x).

(x ⁶⁰ +x ⁵⁸ +x ⁵⁰ +x ¹⁶ +x ¹² +x ¹¹ +x ¹⁰ +x ² +x) mod (x ⁴⁹ +x+1)= x ¹⁶ +x ⁹ .

Let's check by adding in the field F ₂ [x] the values D ₁ (x)=x ⁹ +x+1, D ₂ (x)=x ¹⁶ +x+1, we get x ¹⁶ +x+1+ x ⁹ +x +1= ^x16 + ^x9 _.

Thus, the claimed system allows to perform calculations on encrypted numbers.

что позволяет производить вычисления с использованием логического элемента XOR, а также возможность выполнения операций над зашифрованными числами.The advantage of this device is to perform operations on the field

which allows you to perform calculations using the XOR logic element, as well as the ability to perform operations on encrypted numbers.

The implementation of the entire device is possible using programmable logic integrated circuits (FPGA), specialized integrated circuits, as well as in the form of a computer operation algorithm and can be used as a separate device or as a coprocessor to perform homomorphic data encryption based on a system of residual classes.

Claims (1)

A system of homomorphic data encryption based on a system of residual classes (RCS), including a data encryption unit, a data decryption unit, characterized in that it contains n encryption units, n units of finding residues modulo p _j (x) , j = 1, …, n , a computing environment that performs calculations on encrypted data, a neural network recovery unit, a decryption unit, while the system of residual classes is taken as a polynomial system of residual classes with n coprime polynomials p _j (x) over the field F ₂ , for which k<n is threshold, K(x) is a secret key that is coprime with each of the RNS modules, Seed(x) is a random polynomial that satisfies the condition

, where d is the maximum power of the original data

, and N is the maximum number of multiplication operations with encrypted data, the original data is fed through encryption blocks to the inputs of the corresponding blocks for finding residues modulo p _j (x), jointly implementing data encryption according to the formula

, where i is the number of initial data, the outputs of the blocks for finding residues modulo p _j (x) are connected to the inputs of the computing environment, the outputs of which are connected to the inputs of the neural network recovery block that implements the formula

, where

,

, and P(x) is the product of modules p _j (x) of received k secrets , j = 1, …, k, the output of the neural network recovery unit is connected to the input of the decryption unit, which finds the remainder by the secret key K(x), the output of the decryption unit is the output of the system, while the neural network recovery block contains n finite ring neural networks that execute the operator of taking the remainder modulo p _j (x) of the product of the input value

on the weights of the neural network

, n polynomial multiplication blocks that perform multiplication by

, a polynomial summation unit, wherein each input of the neural network recovery unit is connected to each input of the finite ring neural networks, the outputs of which are connected to the inputs of the corresponding polynomial multiplication units, the outputs of which are connected to the inputs of the polynomial summation unit, the output of which is the output of the neural network recovery unit.

Images