CN108768612A - A kind of full homomorphic cryptography method based on random unitary matrix during outsourcing calculates - Google Patents

Abstract

A kind of full homomorphic cryptography method based on random unitary matrix in being calculated the invention discloses outsourcing.The existing full homomorphic cryptography characteristic of this method, and the calculating of non-integer domain is can apply to, while there is the honesty verification characteristic in total domain.Integer field is can be only applied to compared to classical cryptoraphy scheme, this method can be applied to the manipulable number field of any matrix, including real number, plural number etc.；Compared to existing same type encryption method, this programme not only has full homomorphic characteristic, but also because using unitary matrice, ill-condition number will not be introduced to being calculated after encryption, to have true verification characteristic.This method is suitable for any matrix encryption, because isomorphism is good, especially suitable for calculating and encrypting independent application scenario, such as outsourcing calculating.

Description

Fully homomorphic encryption method based on random unitary matrix in outsourcing calculation

Technical Field

The invention belongs to the technical field of information security, relates to an encryption method, and particularly relates to a symmetric key homomorphic encryption method based on a random unitary matrix in outsourcing computation, which is applied to the field of computation outsourcing.

Background

Mobile devices and internet services are becoming more and more popular, and computing outsourcing services have created strong demands for homomorphic encryption methods. For example, in outsourced computing services, it appears that outsourced computing obtains good win-win results between the customer and the service provider based on the shared economy. In practice, however, the customer loses all sensitive information in the data during the outsourcing of the computing process, particularly when the network is not trusted, or the service provider is not trusted, or the server computing environment is not trusted. A theoretically good homomorphic encryption method ensures that data privacy is not revealed when a user fully applies computing resources.

However, current homomorphic encryption methods based on classical cryptography, such as a large number decomposition assumption, a discrete logarithm assumption, an elliptic curve assumption, a lattice-based assumption and the like, are all based on an integer domain, and obviously cannot cover non-integer domain calculations. Most of the matrix calculations are performed in the real number domain, even the complex number domain. There is a class of encryption methods that use matrix multiplication similar to the method of the present invention, but the prior art methods use random invertible matrices. The norm of the random invertible matrix cannot be determined and may directly cause morbidity of the calculation result. For example, in a calculation, assuming a register of 16 bits, less than 2 would be absorbed^-16Error of (2) canOverflow greater than 2¹⁶Is an integer of (1). A normal equation solution results in:

however, when both sides of the equation are multiplied by the same random inverse matrix, the result may become uncontrollable:

possibly resulting in a false output being completed. This is because a random matrix is used, which causes the coefficient matrix to appear ill-conditioned. In the complex field or real field calculation, because the number of bits of the CPU register is always limited, the number of truncated bits, overflow, etc. are inevitable. The random encryption is carried out by introducing a matrix with uncertain norm, which can cause uncertain calculation results. There is a certain probability that, as in the example, not only is there an incorrect result, but the integrity check problem cannot be passed. Thereby causing embarrassment that the calculation result is uncertain. Or, the calculation loses due certainty value.

Disclosure of Invention

In order to solve the technical problem, the invention provides a symmetric key homomorphic encryption method based on a random unitary matrix in outsourcing calculation, which belongs to an encryption method determined by norm and is a homomorphic method; by adopting the unitary matrix, the problem of uncertainty of a calculation result can not be caused.

The technical scheme adopted by the invention is as follows: a full homomorphic encryption method based on a random unitary matrix in outsourcing calculation is characterized in that an encryption process comprises the following steps:

step 1: inputting parameters;

the parameters include the set of matrices that need to be encrypted P_i}、Safety control parameters K and q; wherein K is more than 2 and less than or equal to { P_iHalf of the dimension of the maximum row or column of the matrix in the array, and q is more than or equal to 2; let a set of matrices { P_iThe number of all the dimensions of different rows or columns in the page is m, and the number of the dimensions of different columns is recorded as n₁,…,n_m}；

Step 2: generating a secret key;

according to the safety control parameter K, q and each dimension n_i∈{n₁,…,n_mGenerating a random unitary matrix set (R)₁,…,R_mAs a key; wherein, { R₁,…,R_mOne and only one matrix for each dimension in the tree;

step 2.1: selecting a random sequence k₁,…,k_s}; wherein k is_iSatisfies the condition 2. ltoreq. k_i≤K，

Step 2.2: random selection of unitary matrix sequence { M₁,...,M_s}; wherein M is_iSatisfies the condition Dim (M)_i)＝k_iI.e. each matrix dimension M_iInteger k of position corresponding to random sequence_iSame, requiring each M simultaneously_iThe middle element has at least entropy value q;

step 2.3: generating two random permutationsWherein,all lengths are n_iEach element randomly and differently takes a natural number sequence {1, …, n_i}；Refers toMiddle (i)And (4) each element.

Step 2.4: according to two random arrangementsGenerating two n_i×n_iElementary transformation matrixWherein each element of the matrix isIf it is not If it is not Generating method andthe same process is carried out;

step 2.5: output ofWherein diag { M₁,...,M_mDenotes a matrix sequence of { M }₁,...,M_mA block diagonal matrix formed by the columns;

and step 3: matrix encryption;

get the secret key { R₁,…,R_mAfter the previous step, with C_i＝R_LP_iR_R ^HMode encryption { P_iAll the matrixes in the set get the corresponding ciphertext set { C_i}; wherein R is_L,R_R∈{R₁,…,R_mAccording to P_iCalculating the required value; if P here_iDifferent dimension of rows and columns, then R_L,R_RThe dimensions are also different; the superscript H denotes the conjugate transpose matrix.

Compared with the prior art, the invention has the following advantages and beneficial effects:

(1) the unitary matrix replaces the random inverse matrix, so that the condition number of a calculation task is kept unchanged, namely the error estimation in the calculation is not expanded; thus allowing errors in the calculations to exist;

(2) since the allowable error exists, in the verification, when the error is within the design allowable range, the calculation result is honest. Or errors among all honest calculation results cannot be uncontrollable due to the introduction of an encryption method, so that the errors can be verified; this is not effectively achieved by current methods, because at present, random invertible matrices may cause uncontrollable computer results;

(3) the invention improves the safety of the current method, and simultaneously uses two primary transformations to ensure full randomization;

(4) thereby effectively reducing the amount of calculation caused by the increase of the lengths of K and q.

Drawings

Fig. 1 is a schematic diagram of an application scenario of outsourcing computation in the embodiment of the present invention.

Detailed Description

In order to facilitate the understanding and implementation of the present invention for those of ordinary skill in the art, the present invention is further described in detail with reference to the accompanying drawings and examples, it is to be understood that the embodiments described herein are merely illustrative and explanatory of the present invention and are not restrictive thereof.

The application scenario of the embodiment is outsourcing calculation, and a certain application is assumedFamily presence set of data P_i}＝{P_1(r×t),P_2(t×t),P_3(t×t),(P_4(t×t)A calculation task f₁({P_i})＝P₁P₂÷(P₃+P₄) In which P is_iThe corner marks representing the number of rows and columns of the matrix, e.g. P_1(r×t)Denotes P₁Is an (r × t) matrix. The user gives a security target G, and a security parameter λ under the target. Assuming that a user selects an internet cloud server, as shown in fig. 1, the invention provides a random unitary matrix-based fully homomorphic encryption method in outsourcing computation, which includes the following steps:

step 1: inputting parameters;

parameter has matrix set { P) that needs encryption_iH, safety control parameters K and q; requirement K>2, but not preferably more than { P_iHalf of the maximum row or column dimension of the matrix in the row; q is required to be more than or equal to 2; set of matrices P in this example_iThe number of all different row or column dimensions in the row is m-2, and the number of different dimensions is n₁＝r,n₂＝t}。

When K is 4 and q is 8, the method is resistant to random guess attack, and the worst probability is given Failure, where n ═ min (r, t). After a user selects K and q once, the security probability of the random guess attack resistance provided by the method is 1-g (K and q);

step 2: generating a secret key;

according to the safety control parameters K, q and each dimension n_i∈{n₁＝r,n₂T, generating a random unitary matrix set { R }_t,R_r}；

The specific implementation of the step 2 comprises the following substeps:

step 2.1: selecting a random sequencek₁,…,k_s}; wherein k is_iSatisfies the condition 2. ltoreq. k_i≤K，

Step 2.2: random selection of unitary matrix sequence { M₁,...,M_s}; wherein M is_iSatisfies the condition Dim (M)_i)＝k_iI.e. each matrix dimension M_iInteger k of position corresponding to random sequence_iSame, requiring each M simultaneously_iThe middle element has at least entropy value q;

step 2.3: generating two random permutationsWherein,all lengths are n_iEach element randomly and differently takes a natural number sequence {1, …, n_i}；Refers toThe ith element.

Step 2.4: according to two random arrangementsGenerating two n_i×n_iElementary transformation matrixWherein each element of the matrix isIf it is not If it is not Generating method andthe same process is carried out;

for example: when n is_iIs equal to 3, provided withThenBecause of the fact thatTherefore, it is not only easy to useThe other same principles are adopted.

Step 2.5: output ofWherein diag { M₁,...,M_mDenotes a matrix sequence of { M }₁,...,M_mThe columns form a block diagonal matrix.

By running steps 2.1-2.5 in two runs, { R } can be obtained_t,R_r}

And step 3: matrix encryption: get the secret key { R_t,R_rAfter the previous step, with C_i＝R_LP_iR_R ^HMode encryption { P_iAll the matrixes in the set get the corresponding ciphertext set { C_i}. Note that R_L,R_R∈{R_t,R_rAccording to P_iCalculating the need to get(ii) a If P here_iDifferent dimension of rows and columns, then R_L,R_RThe dimensions are also different; the superscript H denotes the conjugate transpose matrix. Obtaining:

the invention supports full homomorphic calculation in the full number domain: if necessary according to the calculation logic f_iIn data { P_iOn f, the result f is calculated_i({P_i}) that the method supports the use of the same computation logic f_iAfter encryption data { C_iCalculate f on }_i({C_i) }) and satisfies f_i({P_i})＝R_L ^Hf_i({C_i})R_RWherein R is_L，R_R∈{R₁,…,R_m}. I.e. f_i({C_iIs f)_i({P_i}). The method being fully homomorphic, i.e. allowing f_iIncluding add, subtract, multiply, divide, and bracket operations. The method can operate in real number and complex number domains by fully homomorphic calculation, and is not limited to integer domains. Therefore, the method can be used for applications including outsourcing computation, and privacy protection completely independent of computation and encryption is provided. I.e. the user can outsource f_i({C_i}) to any computing-capable entity without fear of leaking { P }_i}; and f can be obtained with less calculation cost_i({P_i})；

For example, f can be output₁({C_i})＝C₁C₂÷(C₃+C₄) To any computing capable entity, such as cloud server S, if S is theoretically available:

the invention supports the calculation integrity check of the whole number field: let the computational entity be S, let f_i,S({C_i}) calculating f for the calculation entity S_i({C_i}). When S is dishonest, f_i({C_i}) result is not true f_i({C_i}). However, the user can repeat steps 1-3 to encrypt the same f with different keys_i({P_i}) to obtain different f in the same S_i,s({C_i}) by decrypting different f_i,S({C_i}) to obtain a difference f_i,S({P_i})＝R_L ^Hf_i,s({C_i})R_RIf S is honest, all different f_i,s({P_i}) will be very small, whereas all different f's will be very small_i,s({P_i}) may be very large. The method supports outsourced homomorphic computational inspection because R₁,…,R_mMean unitary matrix in the (f) does not cause f_i({C_i}) the calculation of the morbidity of the result, so that the error test method holds. When the user security objective is resistance, S is dishonest, and through random guess attack, the probability that integrity verification can be passed is less thanWhen K, q are chosen appropriately, this probability is negligible.

The user of this embodiment has { P_iAnd calculation task f_i({P_i}) selecting K and q, and generating a group of random unitary matrixes { R by the method disclosed by the patent₁,…,R_mThe number m of matrixes with different dimensionalities in R is equal to a matrix set P appearing in a calculation task_iThe number of all different dimensions in the page is multiplied; user usage C_i＝R_LP_iR_R ^HMethod encryption { P_iEach matrix of (i) }, wherein R is_L，R_R∈{R₁,…,R_mIs adapted to each P_iThe matrix calculated accordingly is known as such. Because of P_iThe calculation dimension is not predicted, and each dimension matrix has one or only one in R, so that the form and conclusion are not influenced by adopting the general expression; obtaining a new encrypted calculation task f according to the original logic expression_i({C_i}); this computing task can be performed by any entity S with computing powerCalculating; when the user obtains the calculation result f returned by S_i,S({C_iH) after (f), with_i,S({P_i})＝R^Hf_i,s({C_i}) R method. The encryption method is not limited to integer domains and can be applied to any matrix-applicable calculation number domain; and due to { R } in the encryption matrix₁,…,R_mThe calculation results are not ill-conditioned, so that whether the calculation entities are honest or not can be verified in comparison of different outsourcing results of the same task. Therefore, the method disclosed by the patent has homomorphism, can cover all number domains and can obtain good verification characteristics.

The invention is characterized in that:

(1) all the whole number domain calculation suitable for the calculation task is realized, and the calculation task is not required to be limited to an integer;

(2) the result obtained by encryption is reliable, and because of norm invariance of the unitary matrix, the calculation result is not ill-conditioned by encryption;

(3) and under the condition of reliable results, the verification is guaranteed to be true and reliable.

It should be understood that parts of the specification not set forth in detail are well within the prior art.

It should be understood that the above description of the preferred embodiments is given for clarity and not for any purpose of limitation, and that various changes, substitutions and alterations can be made herein without departing from the spirit and scope of the invention as defined by the appended claims.

Claims (2)

1. A full homomorphic encryption method based on a random unitary matrix in outsourcing calculation is characterized by comprising the following steps:

step 1: inputting parameters;

the parameters include the set of matrices that need to be encrypted P_iA safety control parameter K and q; wherein K is more than 2 and less than or equal to { P_iHalf of the dimension of the maximum row or column of the matrix in the array, and q is more than or equal to 2; let a set of matrices { P_iThe number of all the dimensions of different rows or columns in the page is m, and the number of the dimensions of different columns is recorded as n₁,…,n_m}；

Step 2: generating a secret key;

according to the safety control parameter K, q and each dimension n_i∈{n₁,…,n_mGenerating a random unitary matrix set (R)₁,…,R_mAs a key; wherein, { R₁,…,R_mOne and only one matrix for each dimension in the tree;

and step 3: matrix encryption;

get the secret key { R₁,…,R_mAfter the previous step, with C_i＝R_LP_iR_R ^HMode encryption { P_iAll the matrixes in the set get the corresponding ciphertext set { C_i}; wherein R is_L,R_R∈{R₁,…,R_mAccording to P_iCalculating the required value; if P here_iDifferent dimension of rows and columns, then R_L,R_RThe dimensions are also different; the superscript H denotes the conjugate transpose matrix.

2. The fully homomorphic encryption method based on random unitary matrix in outsourcing computation of claim 1, wherein the specific implementation of step 2 comprises the following sub-steps:

step 2.1: selecting a random sequence k₁,…,k_s}; wherein k is_iSatisfies the condition 2. ltoreq. k_i≤K，

Step 2.2: random selection of unitary matrix sequence { M₁,...,M_s}; wherein M is_iSatisfies the condition Dim (M)_i)＝k_iI.e. each matrix dimension M_iInteger k of position corresponding to random sequence_iSame, requiring each M simultaneously_iThe middle element has at least entropy value q;

step 2.3: generating two random permutationsWherein,all lengths are n_iEach element randomly and differently takes a natural number sequence {1, …, n_i}；Refers toThe ith element.

Step 2.4: according to two random arrangementsGenerating two n_i×n_iElementary transformation matrixWherein each element of the matrix isIf it is not If it is not Generating method andthe same process is carried out;

step 2.5: output ofWherein diag { M₁,...,M_mDenotes a matrix sequence of { M }₁,...,M_mThe columns form a block diagonal matrix.