CN109412786B - Integer cipher text arithmetic operation method based on homomorphic encryption - Google Patents

Integer cipher text arithmetic operation method based on homomorphic encryption Download PDF

Info

Publication number
CN109412786B
CN109412786B CN201811355108.7A CN201811355108A CN109412786B CN 109412786 B CN109412786 B CN 109412786B CN 201811355108 A CN201811355108 A CN 201811355108A CN 109412786 B CN109412786 B CN 109412786B
Authority
CN
China
Prior art keywords
homomorphic
ciphertext
polynomial
encryption
bit
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201811355108.7A
Other languages
Chinese (zh)
Other versions
CN109412786A (en
Inventor
拱长青
李梦飞
赵亮
戚晗
林娜
郭振洲
李席广
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Shenyang Aerospace University
Original Assignee
Shenyang Aerospace University
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Shenyang Aerospace University filed Critical Shenyang Aerospace University
Priority to CN201811355108.7A priority Critical patent/CN109412786B/en
Publication of CN109412786A publication Critical patent/CN109412786A/en
Application granted granted Critical
Publication of CN109412786B publication Critical patent/CN109412786B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/008—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols involving homomorphic encryption

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Complex Calculations (AREA)

Abstract

The invention provides a homomorphic calculation method of integer ciphertext arithmetic operation based on homomorphic encryption. The operation rules of complementation, addition, subtraction, multiplication and division of binary integers in a computer are referred to, and the rules are converted into Boolean polynomials only comprising logical AND and XOR operations. In multiplication and division, different calculations need to be made to correct the result of the final calculation according to the information of the particular bit. Therefore, the form of the boolean polynomial is modified to represent different operation results, i.e., the boolean polynomial includes all the inputs and mutually exclusive computation branches of the present layer. And then converting the Boolean polynomial into a homomorphic polynomial suitable for ciphertext calculation, proving the safety of the homomorphic polynomial and meeting the requirement of semantic safety. The multi-bit parallel operation of integer homomorphic arithmetic operation is realized, the algorithm efficiency of homomorphic operation is improved, the frequency of noise reduction operation is reduced, and the operation efficiency is improved.

Description

Integer cipher text arithmetic operation method based on homomorphic encryption
The technical field is as follows:
the invention belongs to the technical field of cryptography, and relates to an integer cipher text arithmetic operation method based on homomorphic encryption.
Background art:
the cipher text arithmetic operation involved in this patent is an integer cipher text arithmetic operation based on homomorphic encryption. The homomorphic calculation has the advantages that the relevant operation in the plaintext space can be realized in the ciphertext, and the correct result of the corresponding operation of the plaintext can be obtained just after the obtained ciphertext calculation result is decrypted. Some relevant schemes for homomorphic calculations of arithmetic operations are described below.
Gentry et al propose a homomorphic calculation of complex circuitry, using the BGV scheme, to achieve a complete AES-128 bit homomorphic calculation. The scheme uses batch processing techniques, key conversion and analog-to-digital conversion techniques to achieve an efficient hierarchical implementation. Chen y, et al, propose a cipher text integer algorithm and homomorphic data aggregation algorithm based on the BGV scheme. The scheme utilizes the Helib homomorphic encryption operation library to realize homomorphic addition, subtraction, multiplication and division operations of unsigned integers. However, these schemes do not optimize the bootstrap and modulo conversion operations of the integer algorithm in the ciphertext, and the experimental results have limitations.
Gentry et al, from 2009, proposed a series of fully homomorphic encryption schemes, including homomorphic encryption on ideal lattices, homomorphic encryption on integers, and the simpler and faster RLWE fully homomorphic encryption method based on LWE, among others. The ciphertext operations of these homomorphic encryption schemes involve noise, which exceeds a certain upper limit and causes decryption to fail. Therefore, the noise reduction algorithm must be frequently performed, and the noise reduction algorithm needs to be operated on the input ciphertext every time the addition or multiplication operation is performed, so that the fully homomorphic characteristic of the operation process is ensured. The frequent noise reduction operation greatly reduces the operation efficiency of the algorithm and weakens the practicability of the homomorphic encryption scheme.
The invention content is as follows:
in view of the above-mentioned problems with homomorphic cryptographic ciphertext arithmetic operations, the present invention constructs a homomorphic computation scheme for integer arithmetic operations that includes homomorphic computations for complement operations, homomorphic computations for addition operations, homomorphic computations for subtraction operations, homomorphic computations for multiplication operations, and homomorphic computations for division operations. The method is not limited to the operation between ciphertexts corresponding to a certain plaintext, but can realize the operation between a plurality of cipher text sequences, namely a plurality of cipher text vectors. Moreover, the scheme optimizes the operation flow to a certain extent, can reduce the frequency of noise reduction operation, and improves the algorithm efficiency.
The invention has the technical characteristics and beneficial effects that:
we refer to the operation rule of complement, add, subtract, multiply and divide of binary integer in computer and convert the rule into Boolean polynomial containing only logical AND and or operation. In the multiplication and division method, different calculations are required to be made according to the information of special bits, and the final calculation result is corrected; therefore, the form of the boolean polynomial is modified to represent different operation results, that is, the boolean polynomial includes all the inputs and mutually exclusive calculation branches of the layer; the boolean polynomial is then converted into a homomorphic polynomial that can be applied to ciphertext computations. The homomorphic polynomial in the scheme meets the requirement of semantic safety through safety demonstration.
The scheme realizes multi-bit parallel operation of integer homomorphic arithmetic operation, and improves the algorithm efficiency of homomorphic arithmetic operation; according to the scheme, the related homomorphic operation process is optimized, the frequency of noise reduction operation can be reduced, and the operation efficiency is improved.
The scheme of the invention can be used in the fields of electronic ticket counting, ciphertext retrieval, encryption machine learning and the like.
The specific implementation mode is as follows:
in order to make the objects, technical solutions and advantages of the present invention more apparent, the present invention is further described in detail with reference to the following embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.
The invention provides an integer ciphertext arithmetic operation method based on homomorphic encryption, which converts an algorithm in traditional computing equipment into ciphertext arithmetic operation carried out under the condition of ciphertext, and comprises homomorphic calculation of complement operation, homomorphic calculation of addition operation, homomorphic calculation of subtraction operation, homomorphic calculation of multiplication operation and homomorphic calculation of division operation, and the method comprises the following steps of:
in an arithmetic operation unit of a CPU, binary addition, subtraction, multiplication, and division operations are realized by addition and shift of complement codes. A simple one-bit full adder can pass
Figure BDA0001865875860000031
(logical exclusive or) sum, carry is found using ^ (logical and). The binary integer operations described below are all performed in the following manner
Figure BDA0001865875860000032
And
Figure BDA0001865875860000033
as input, the two are all complement codes,
Figure BDA0001865875860000034
and
Figure BDA0001865875860000035
is that
Figure BDA0001865875860000036
And
Figure BDA0001865875860000037
the complement of the negative of the original code. We use the ciphertext vector
Figure BDA0001865875860000038
Indicating after encryption
Figure BDA0001865875860000039
Wherein a is i ＝Enc(a i )，0≤i≤n，
Figure BDA00018658758600000310
Indicating after encryption
Figure BDA00018658758600000311
Wherein
Figure BDA00018658758600000312
Ciphertext vector
Figure BDA00018658758600000313
Indicating after encryption
Figure BDA00018658758600000314
Figure BDA00018658758600000315
Vector of ciphertext
Figure BDA00018658758600000316
Indicating after encryption
Figure BDA00018658758600000317
Wherein
Figure BDA00018658758600000318
Figure BDA00018658758600000319
and
Figure BDA00018658758600000323
Is the input to the homomorphic computation of the certificate arithmetic operation. n is large enough that we do not consider overflow between operations.
(1) Homomorphic computation of complement operations
The conversion rule from the original code to the complementary code is that if the original code is a positive number, the original code is the same as the complementary code, if the original code is a negative number, the most significant bit of the original code is marked as symbol position 1, the significant bit after the most significant bit is negated, and then 1 is added. Assume a binary integer primary code
Figure BDA00018658758600000320
Highest bit a n Is the sign bit, a n-1 …a 0 For the significance of the bit (for convenience of presentation, the following is used
Figure BDA00018658758600000321
And
Figure BDA00018658758600000322
representing complements of binary integers, i.e. using
Figure BDA0001865875860000041
And
Figure BDA0001865875860000042
representing the input of an operation), default initial carry c -1 When 0, then the complement of binary is calculated
Figure BDA0001865875860000043
The iterative formula of (c):
Figure BDA0001865875860000044
in the above formula c i ＝a i ∨c i-1 In homomorphic encryption, only logical XOR is used
Figure BDA0001865875860000045
Homomorphic operation (additive homomorphic) and homomorphic operation of logical and (multiplication homomorphic). Thus c i Is converted into exclusive OR only
Figure BDA0001865875860000046
And a formula of ^ into an iterative formula of
Figure BDA0001865875860000047
Figure BDA0001865875860000048
Due to c -1 ＝0，c i Can be expressed as the following polynomial:
Figure BDA0001865875860000049
wherein
Figure BDA00018658758600000410
In the collection of the images, the image data is collected,
Figure BDA00018658758600000411
is the length of the subset. We use the ciphertext vector
Figure BDA00018658758600000412
Indicating after encryption
Figure BDA00018658758600000413
Wherein alpha is i ＝Enc(a i )，0≤i≤n-1， α n Enc (e). The complemented homomorphic polynomial can be written as:
Figure BDA00018658758600000414
wherein x 0 Is the largest odd public key in homomorphic encryption.
Figure BDA00018658758600000415
Is to complement the ciphertext carry generated by homomorphic polynomial to satisfy
Figure BDA00018658758600000416
Indicates the complement of the obtained ciphertext to satisfy
Figure BDA00018658758600000417
(2) Homomorphic calculation of addition and subtraction operations
The binary complement addition operation calculates the result and carry in turn from low order to high order, adds the carry to the high order result, and iterates continuously to obtain the result of complement addition. Assume binary integer complement
Figure BDA00018658758600000418
And
Figure BDA00018658758600000419
a n and
Figure BDA00018658758600000420
is composed of
Figure BDA00018658758600000421
And
Figure BDA00018658758600000422
the sign bit of (c). Initial carry is c -1 When equal to 0, the sum is
Figure BDA0001865875860000051
Then the sum of each bit
Figure BDA0001865875860000052
The sum carry can be written as the following boolean iteration formula:
Figure BDA0001865875860000053
converting into an addition homomorphic polynomial under a ciphertext:
Figure BDA0001865875860000054
wherein
Figure BDA00018658758600000529
Is the cipher text carry generated in the operation process of the homomorphic polynomial of the cipher text, and meets the requirement
Figure BDA0001865875860000055
The initial carry is
Figure BDA0001865875860000056
The ith bit of the ciphertext sum generated for the ciphertext homomorphic polynomial, the final result is
Figure BDA0001865875860000057
Satisfy the requirements of
Figure BDA0001865875860000058
The binary subtraction operation is obtained by addition, assuming a complement of a binary integer
Figure BDA0001865875860000059
And
Figure BDA00018658758600000510
a n and
Figure BDA00018658758600000511
is composed of
Figure BDA00018658758600000512
And
Figure BDA00018658758600000513
the sign bit of (c). Computing
Figure BDA00018658758600000514
Is converted into
Figure BDA00018658758600000515
(the upper right-hand corner represents
Figure BDA00018658758600000516
Two's complement of (i.e. a)
Figure BDA00018658758600000517
The complement after the negative number) is taken, and the addition is used. To find
Figure BDA00018658758600000518
I.e. using the compensation circuit to calculate
Figure BDA00018658758600000519
Bit, get
Figure BDA00018658758600000520
Sign bit is then checked
Figure BDA00018658758600000521
Get the inverse, i.e.
Figure BDA00018658758600000522
Therefore, the subtraction operation has the same formula and the same number of calculations as the addition operation. Therefore, the homomorphic calculation of the ciphertext subtraction only needs to use addition
Figure BDA00018658758600000523
The result can be obtained.
(3) Homomorphic calculation of multiplication operations
The multiplication is performed based on Booth's algorithm. The algorithm multiplies two signed numbers by a binary complement representation. Setting multiplicand
Figure BDA00018658758600000524
Sum multiplier
Figure BDA00018658758600000525
Booth's algorithm checks the multiplier
Figure BDA00018658758600000526
Comprises an implicit bit below the least significant bit,
Figure BDA00018658758600000527
we use
Figure BDA00018658758600000528
Indicating an accumulator. Basic algorithm steps of multiplication:
1. initialization
Figure BDA0001865875860000061
And
Figure BDA0001865875860000062
the value of (c).
·
Figure BDA0001865875860000063
Arithmetic shifts left (n +1) bits.
Figure BDA0001865875860000064
·
Figure BDA0001865875860000065
The arithmetic is left shifted by (n +1) bits.
Figure BDA0001865875860000066
·
Figure BDA0001865875860000067
The most significant n bits are filled with 0 s. For the right part
Figure BDA0001865875860000068
And (6) filling. Finally the LSB pad is 0.
Figure BDA0001865875860000069
2.
Figure BDA00018658758600000610
Is used to determine the accumulator
Figure BDA00018658758600000611
The operation method of (1).
If
Figure BDA00018658758600000612
Arithmetic shifts right by 1 bit.
If
Figure BDA00018658758600000613
Arithmetic shifts right by 1 bit.
If
Figure BDA00018658758600000614
Arithmetic shifts right by 1 bit.
Repeating the second step for n-1 times and deleting
Figure BDA00018658758600000615
The least significant bit of (a). According to the technique mentioned in the second step, we can summarize a decision to select a boolean polynomial:
Figure BDA00018658758600000616
use of
Figure BDA00018658758600000617
Accumulator representing each step
Figure BDA00018658758600000618
The boolean formula for the multiplication is shown below:
Figure BDA00018658758600000619
where > arithmetic right shift. We use the boolean formula above the homomorphic transformation to homomorphic polynomials for additive homomorphic synthesis:
Figure BDA00018658758600000620
Figure BDA00018658758600000621
and
Figure BDA00018658758600000622
to represent
Figure BDA00018658758600000623
And
Figure BDA00018658758600000624
r ═ r of the ciphertext vector<r 0 ，…，r n-1 >Is a vector of the noise that is,
Figure BDA00018658758600000625
Figure BDA00018658758600000626
the homomorphic polynomial of the multiplication is:
Figure BDA00018658758600000627
wherein- > represents the right shift of the ciphertext vector when
Figure BDA0001865875860000071
The right-hand shift is made by one ciphertext slot,
Figure BDA0001865875860000072
is padded to the original most significant component. Final product of
Figure BDA0001865875860000073
Valid ciphertext result product.
(4) Homomorphic calculation of division operations
Division is the most complex basic arithmetic operation. For simple computers that use adder circuits for arithmetic operations, variations using conventional long division (known as non-reduction division) provide simpler and faster speeds. The method only needs to carry out decision and addition and subtraction operation once on each quotient digit, and step length does not need to be recovered after subtraction. We set the dividend
Figure BDA0001865875860000074
And divisor
Figure BDA0001865875860000075
Is that
Figure BDA0001865875860000076
The Two's component of (a),
Figure BDA0001865875860000077
is the remainder of the number of bits,
Figure BDA0001865875860000078
is a quotient. The specific algorithm is shown below
1. Initialization
Figure BDA0001865875860000079
And
Figure BDA00018658758600000710
the value of (c).
·
Figure BDA00018658758600000711
Arithmetic shifts left by n bits.
Figure BDA00018658758600000712
·
Figure BDA00018658758600000713
Arithmetic shifts left by n bits.
Figure BDA00018658758600000714
·
Figure BDA00018658758600000715
Arithmetic shifts right by n bits.
Figure BDA00018658758600000716
·
Figure BDA00018658758600000717
N 0 s are filled.
2. According to
Figure BDA00018658758600000718
The least significant bit of the bit performs the following operations.
If
Figure BDA00018658758600000719
Filled with 1
Figure BDA00018658758600000720
Logically shifted left by 1 bit.
Figure BDA00018658758600000721
If
Figure BDA00018658758600000722
Filled with 0
Figure BDA00018658758600000723
Logically shifted left by 1 bit.
Figure BDA00018658758600000724
3. Repeat the second part n-1 times.
4. Conversion
Figure BDA00018658758600000725
(suppose that
Figure BDA00018658758600000726
)。
·
Figure BDA00018658758600000727
Take the inverse
Figure BDA00018658758600000728
Finding the difference
Figure BDA00018658758600000729
5. Final remainder
Figure BDA0001865875860000081
Quotient digit odd, remainder
Figure BDA0001865875860000082
In the range of
Figure BDA0001865875860000083
If the remainder is a negative number, a remainder conversion is required:
Figure BDA0001865875860000084
and
Figure BDA0001865875860000085
according to the algorithm, Boolean judgment polynomial (JCBP) of division can be written out
Figure BDA0001865875860000086
Use of
Figure BDA0001865875860000087
The intermediate result, representing the remainder of each iteration, is divided by a boolean polynomial of:
Figure BDA0001865875860000088
wherein
Figure BDA0001865875860000089
Is that
Figure BDA00018658758600000810
Least significant bit of the first and last correction is performed
Figure BDA00018658758600000811
And
Figure BDA00018658758600000812
we transform the Boolean judge polynomial of division to homomorphic polynomial as:
Figure BDA00018658758600000813
wherein
Figure BDA00018658758600000814
And
Figure BDA00018658758600000815
represent
Figure BDA00018658758600000816
And
Figure BDA00018658758600000817
the ciphertext vector of (1). The homomorphic polynomial of the division is:
Figure BDA00018658758600000818
wherein
Figure BDA00018658758600000819
Represent
Figure BDA00018658758600000820
The vector of the ciphertext of (a) is,
Figure BDA00018658758600000821
to represent
Figure BDA00018658758600000822
The vector of the ciphertext of (a) is,
Figure BDA00018658758600000823
representation of operations
Figure BDA00018658758600000824
Finally, we correct the ciphertext vector
Figure BDA00018658758600000825
And
Figure BDA00018658758600000826
Figure BDA00018658758600000827
Figure BDA00018658758600000828
and
Figure BDA00018658758600000829
the final ciphertext result of the homomorphic operation of the division is obtained.
The safety of the invention is as follows:
homomorphic calculations of integer arithmetic operations are built on DGHV and its variants, and therefore their security relies on the cryptographic algorithm itself. In the original scheme of DGHV, the safety of the DGHV is ensured by the difficulty hypothesis of approximate GCD, and the simple factor decomposition is difficult to directly realizeThe private key is recovered from the public key. And the enhanced decryption circuit ensures that the operation times of multiplication or addition cannot be leaked in the ciphertext result. The re-randomization of the plaintext by the encryption circuit masks the information in the plaintext. And the privacy of the circuit is justified by hashing the residue. The improved scheme of homomorphic encryption of the original integer also inherits the security. In homomorphic operation of basic integer arithmetic, the complement operation is input by encrypted cipher text of original code of integer
Figure BDA0001865875860000091
And initial carry cipher text
Figure BDA0001865875860000092
The security of the encryption algorithm ensures that each encrypted ciphertext is infinitely close to uniform distribution (Hash residue lemma), and the only thing which can reveal plaintext information is initial carry
Figure BDA0001865875860000093
According to the encryption circuit, the encryption circuit comprises three parts, namely a plaintext part, a public key random subsequence and random noise. The random noise part ensures that the noise in the ciphertext is random, and the public key random subsequence ensures the randomness of a quotient obtained by dividing the ciphertext by the secret key. The randomness of the two parts ensures the randomness of the ciphertext. Thus even knowing that
Figure BDA0001865875860000094
Is 0, nor can any information about the key be found from it. In the complementary operation process, the carry of i-1 bit operation is carried out through continuous iteration operation
Figure BDA0001865875860000095
As one of the inputs for solving for the i-bit complement
Figure BDA0001865875860000096
Each input ciphertext participates in the calculation, namely the probability that each ciphertext is calculated is the same, so the calculation processIn the method, no information is leaked by the input of the ciphertext or the intermediate result generated by the ciphertext. Also, integer addition and subtraction homomorphic computations are similar to integer complement homomorphic computations (integer ciphertext complementation is a special integer ciphertext addition operation) and therefore have the same security.
The integer multiplication homomorphic calculation process involves complementation homomorphic calculation and addition homomorphic calculation. But does not mean that integer multiplication homomorphic calculations do not reveal any information. Because the partial product after shifting needs to be judged in the multiplication process
Figure BDA0001865875860000101
And multiplicand
Figure BDA0001865875860000102
Or also
Figure BDA0001865875860000103
And (4) adding. It is the focus of our analysis that the process of presence determination is safe. Determining ciphertext using a ciphertext vector
Figure BDA0001865875860000104
The last two ciphertexts after adding the additional bit Enc (0)
Figure BDA0001865875860000105
And
Figure BDA0001865875860000106
as a basis for the determination. As ciphertext complementation, we know the multiplier ciphertext additional bit
Figure BDA0001865875860000107
But also does not reveal information. Then the formula (8) used in the process of judging the final ciphertext in the ciphertext state is the formula
Figure BDA0001865875860000108
Is added homomorphically to hide
Figure BDA0001865875860000109
Is determined by the information of (a) or (b),
Figure BDA00018658758600001010
hide and part of product
Figure BDA00018658758600001011
Added are
Figure BDA00018658758600001012
Or
Figure BDA00018658758600001013
In this process, no multiplier will be leaked
Figure BDA00018658758600001014
Last two digits
Figure BDA00018658758600001015
2r, add perturbation to the result of the operation, modulo x 0 The traces left in the operation process are erased. Because of the fact that
Figure BDA00018658758600001016
And
Figure BDA00018658758600001017
all participate in the operation, and each branch of the selection calculation is also calculated at the same time, so that the calculated probability is the same, and information cannot be leaked due to the preference of the calculation process.
We define an eavesdropping indistinguishable test
Figure BDA00018658758600001018
Make guesses
Figure BDA00018658758600001019
This experiment is applicable to any attacker a, as well as to any security parameter λ, homomorphic encryption ∈ (Gen, Enc, Dec, Evalute).
Test for indistinguishable eavesdropping
Figure BDA00018658758600001020
(1) Given input 1 λ Outputting a result to the attacker A, A
Figure BDA00018658758600001021
(2) Run Gen (1) λ ) Generating a key k, selecting two random bits b 1 And b 2 ， b 1 ←{0，-1}，b 2 And ← {0, -1 }. By calculation of
Figure BDA00018658758600001022
c is the challenge cryptogram.
(3) A outputs two bits b' 1 And b' 2 .
(4) The experimental output is defined as: if it is not
Figure BDA00018658758600001023
Figure BDA00018658758600001024
Success is achieved, otherwise failure occurs.
According to the fact that homomorphic encryption is consistent with semantic security, the key can be recovered by assuming that an attacker B has the advantage of belonging to the group, and the conversion is that the advantage under the attacker A belongs to the group of belonging to the group of 4. For all polynomial time aggressors a, there is a negligible function negl (λ) ∈/4 such that:
Figure BDA0001865875860000111
even if attacker A knows that c is the result of the plaintext message operation, it still cannot be determined that c is the result of the plaintext message operation
Figure BDA0001865875860000112
Whether it is encrypted
Figure BDA0001865875860000113
And then encrypted. Cannot naturally know
Figure BDA0001865875860000114
The result of (1). The judgment process of the integer ciphertext division and the multiplication is the same although the judgment bits are different, so that information cannot be leaked. Integer ciphertext division is also secure.
Noise of the invention
In the basic operation part of the integer, the maximum times and the maximum terms (formulas 1, 4, 8 and 11) required to be calculated by an iterative formula of five operations of complementing, adding, subtracting, multiplying and dividing the n-bit integer are obtained. As shown in table 1 below in detail,
TABLE 1 maximum depth and number of terms of iterative formula
Figure RE-GDA0001946775780000115
The number of terms of the iterative formula for integer multiplication and division is too large, which does not discuss specific values. From Table 1 we can see that the number of calculations in the complementation, addition and subtraction is
Figure BDA0001865875860000116
Calculating sub-digits in multiplication and ciphertext division operations
Figure BDA0001865875860000117
The noise of the homomorphic polynomial f can be represented by the noise 2 contained in each input ρ′ The degree of the polynomial d and the polynomial l 1 Norm of
Figure BDA0001865875860000118
To represent
Figure BDA0001865875860000119
log d represents the number of homomorphic polynomial levels. The coefficients of homomorphic polynomials in integer arithmetic operations are all 1, so we can represent them by the number of terms of homomorphic polynomials
Figure BDA0001865875860000121
We set the upper limit of homomorphic calculated noise for the fundamental operation with integer length of p' in homomorphic encryption as shown in table 2:
TABLE 2 maximum noise level
Figure BDA0001865875860000122
Homomorphic calculations for integer arithmetic we propose refer to the two's complement arithmetic rules in computers, including the operations of complementation, addition, subtraction, multiplication, division, and converting the rules into Boolean polynomials which contain only the logical AND and XOR operations. Multiplication and division require that addition and subtraction operations be performed continuously to obtain results that require different branches to be selected according to special bits. We therefore propose to judge the boolean polynomial (JCBP) that contains all branches. Then, the JCBP is converted into a judgment homomorphic polynomial (JCHP) through addition and multiplication of the ciphertext, so that the problem that the ciphertext cannot be directly judged is solved; the invention can provide basic cryptograph operation support for electronic ticket counting, cryptograph retrieval, encrypted machine learning and the like; the invention can solve the calculation of basic quantity characteristics of ciphertext statistics, such as average value, similarity, linear fitting and the like. The ciphertext statistics can be further assisted to further realize other operations on the ciphertext document.

Claims (1)

1. An integer cipher text arithmetic operation method based on homomorphic encryption converts an algorithm in traditional computing equipment into cipher text arithmetic operation carried out under the condition of cipher text, and is characterized by comprising homomorphic calculation of complement operation, homomorphic calculation of addition and subtraction operation, homomorphic calculation of multiplication operation and homomorphic calculation of division operation;
provided with binary integer primary codes
Figure FDA0003750366010000011
And
Figure FDA0003750366010000012
highest bit a n And
Figure FDA0003750366010000013
is composed of
Figure FDA0003750366010000014
And
Figure FDA0003750366010000015
the sign bit of (a); a is n-1 …a 0 And
Figure FDA0003750366010000016
defaulted initial carry c as valid bit -1 ＝0；
Figure FDA0003750366010000017
And
Figure FDA0003750366010000018
is that
Figure FDA0003750366010000019
And
Figure FDA00037503660100000110
the complement of the negative of the original code
Figure FDA00037503660100000111
Ciphertext vector
Figure FDA00037503660100000112
Indicating after encryption
Figure FDA00037503660100000113
Wherein a is i ＝Enc(a i )，0≤i≤n；
Figure FDA00037503660100000114
Indicating after encryption
Figure FDA00037503660100000115
Namely, the obtained ciphertext complement is represented; ciphertext vector
Figure FDA00037503660100000116
Indicating after encryption
Figure FDA00037503660100000117
Ciphertext vector
Figure FDA00037503660100000118
Indicating after encryption
Figure FDA00037503660100000119
Wherein
Figure FDA00037503660100000120
Homomorphic calculation of the complement operation, specifically,
collection of
Figure FDA00037503660100000121
Figure FDA00037503660100000122
Is the length of the subset; the complemented homomorphic polynomial is written as:
Figure FDA00037503660100000123
wherein x is 0 Is a largest odd public key in homomorphic encryption; c. C i Is a cipher text carry generated by complementing homomorphic polynomial and satisfies Dec (c) i )＝c i ；
Figure FDA00037503660100000124
Express to obtainComplement of the ciphertext to satisfy
Figure FDA00037503660100000125
Homomorphic calculations of addition and subtraction operations, specifically,
provided with binary integer complement
Figure FDA00037503660100000126
And
Figure FDA00037503660100000127
a′ n and
Figure FDA00037503660100000128
is composed of
Figure FDA00037503660100000129
And
Figure FDA00037503660100000130
the sign bit of (a); the initial carry is c -1 When equal to 0, the sum is
Figure FDA00037503660100000131
Sum of each bit
Figure FDA00037503660100000132
Homomorphic calculation formulas of addition and subtraction under ciphertext:
Figure FDA0003750366010000021
wherein,
Figure FDA0003750366010000022
indicating after encryption
Figure FDA0003750366010000023
Indicating after encryption
Figure FDA0003750366010000024
By using a i 、b i Obtained in a similar manner to' i 、b′ i ，c i Is cipher text carry generated in the operation process of cipher text homomorphic polynomial and satisfies Dec (c) i )＝c i Initial carry is c -1 ＝Enc(0)，
Figure FDA0003750366010000025
The ith bit of ciphertext sum generated for the ciphertext homomorphic polynomial, the final result is
Figure FDA0003750366010000026
Satisfy the requirement of
Figure FDA0003750366010000027
Figure FDA0003750366010000028
The binary subtraction operation is obtained by an addition operation,
computing
Figure FDA0003750366010000029
Is converted into
Figure FDA00037503660100000210
Figure FDA00037503660100000211
Is composed of
Figure FDA00037503660100000212
The complement of the negative number of (2) is calculated by using addition; to find
Figure FDA00037503660100000213
I.e. using the compensation circuit to calculate
Figure FDA00037503660100000214
Bit, get
Figure FDA00037503660100000215
Sign bit is then checked
Figure FDA00037503660100000216
Taking the inverse, i.e.
Figure FDA00037503660100000217
Homomorphic calculation of multiplication operations, in particular,
setting multiplicand
Figure FDA00037503660100000218
Sum multiplier
Figure FDA00037503660100000219
Booth algorithm checks multiplier
Figure FDA00037503660100000220
Determines the accumulator
Figure FDA00037503660100000221
Including implicit bits below the least significant bit,
Figure FDA00037503660100000222
judging and selecting a Boolean polynomial:
Figure FDA00037503660100000223
use of
Figure FDA00037503660100000224
Accumulator for representing each step
Figure FDA00037503660100000225
The boolean formula for the multiplication is shown below:
Figure FDA00037503660100000226
where > > arithmetic right shift; using an additive homomorphic synthesis method to homomorphically transform the above boolean formula to a homomorphic polynomial:
Figure FDA00037503660100000227
Figure FDA0003750366010000031
and
Figure FDA0003750366010000032
to represent
Figure FDA0003750366010000033
And
Figure FDA0003750366010000034
ciphertext vector of b -1 ＝Enc(0)，r＝<r 0 ，…，r n-1 >Is a vector of the noise that is,
Figure FDA0003750366010000035
ρ' is the noise length, homomorphic polynomial of multiplication:
Figure FDA0003750366010000036
e, E>>Indicating that the ciphertext vector is shifted to the right,
Figure FDA0003750366010000037
represents the ciphertext result generated by the ith accumulation homomorphic operation
Figure FDA0003750366010000038
The right-hand shift is made by one ciphertext slot,
Figure FDA0003750366010000039
is padded to the original most significant component; final product of
Figure FDA00037503660100000310
Valid ciphertext result products;
homomorphic calculations of division operations, in particular,
setting dividend
Figure FDA00037503660100000311
And divisor
Figure FDA00037503660100000312
Is that
Figure FDA00037503660100000313
The complement of the negative number is taken,
Figure FDA00037503660100000314
is the remainder of the number of bits,
Figure FDA00037503660100000315
Figure FDA00037503660100000316
is the result of the quotient,
Figure FDA00037503660100000317
get the inverse of
Figure FDA00037503660100000318
Boolean of the division judges the polynomial JCBP as:
Figure FDA00037503660100000319
use of
Figure FDA00037503660100000320
The intermediate result, representing the remainder of each iteration, is divided by a boolean polynomial of:
Figure FDA00037503660100000321
wherein
Figure FDA00037503660100000322
Is that
Figure FDA00037503660100000323
Least significant bit of the first and last correction is performed
Figure FDA00037503660100000324
And
Figure FDA00037503660100000325
boolean of the conversion division determines the polynomial to homomorphic polynomial as:
Figure FDA00037503660100000326
wherein
Figure FDA00037503660100000327
And
Figure FDA00037503660100000328
represent
Figure FDA00037503660100000329
And
Figure FDA00037503660100000330
the ciphertext vector of (1); the homomorphic polynomial of the division is:
Figure FDA0003750366010000041
wherein
Figure FDA0003750366010000042
To represent
Figure FDA0003750366010000043
The vector of the ciphertext of (a) is,
Figure FDA0003750366010000044
to represent
Figure FDA0003750366010000045
The vector of the ciphertext of (a) is,
Figure FDA0003750366010000046
operation representation q i ＝(q i +Enc(1))mod x 0 I is more than or equal to 0 and less than n; finally, the ciphertext vector is corrected
Figure FDA0003750366010000047
And
Figure FDA0003750366010000048
Figure FDA0003750366010000049
Figure FDA00037503660100000410
and
Figure FDA00037503660100000411
the final ciphertext result of the homomorphic operation of the division is obtained.
CN201811355108.7A 2018-11-14 2018-11-14 Integer cipher text arithmetic operation method based on homomorphic encryption Active CN109412786B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201811355108.7A CN109412786B (en) 2018-11-14 2018-11-14 Integer cipher text arithmetic operation method based on homomorphic encryption

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201811355108.7A CN109412786B (en) 2018-11-14 2018-11-14 Integer cipher text arithmetic operation method based on homomorphic encryption

Publications (2)

Publication Number Publication Date
CN109412786A CN109412786A (en) 2019-03-01
CN109412786B true CN109412786B (en) 2022-09-06

Family

ID=65473120

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201811355108.7A Active CN109412786B (en) 2018-11-14 2018-11-14 Integer cipher text arithmetic operation method based on homomorphic encryption

Country Status (1)

Country Link
CN (1) CN109412786B (en)

Families Citing this family (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111079934B (en) * 2019-11-18 2022-09-27 华中科技大学 Number theory transformation unit and method applied to error learning encryption algorithm on ring domain
CN113098675B (en) * 2019-12-23 2023-04-18 郑珂威 Binary data encryption system and method based on polynomial complete homomorphism
US11671239B2 (en) 2020-05-08 2023-06-06 Samsung Electronics Co., Ltd. Encryption method and apparatus based on homomorphic encryption using odd function property
CN111371545B (en) * 2020-05-27 2020-09-11 支付宝(杭州)信息技术有限公司 Encryption method and system based on privacy protection
CN112543091B (en) * 2020-10-26 2022-10-14 中国人民武装警察部队工程大学 Multi-key fully homomorphic encryption method with fixed ciphertext length
CN112653686B (en) * 2020-12-17 2022-08-09 中国科学院电工研究所 CAN bus message authentication method based on MAC encryption
EP4050471A1 (en) * 2021-02-26 2022-08-31 Zama SAS Encrypted scalar multiplication
CN113849840B (en) * 2021-10-13 2023-06-09 福建师范大学 Encryption data statistical analysis method based on authenticatable encryption counter
CN115001649A (en) * 2022-04-15 2022-09-02 支付宝(杭州)信息技术有限公司 Batch encryption method, related device, system, equipment, medium and program product
CN114553394B (en) * 2022-04-22 2022-08-16 哈尔滨工业大学(深圳)(哈尔滨工业大学深圳科技创新研究院) Complementary code arithmetic unit and arithmetic method based on multi-key fully homomorphic scheme
CN117478305B (en) * 2023-12-28 2024-04-16 粤港澳大湾区数字经济研究院(福田) Fully homomorphic encryption method, system, terminal and medium based on two-party security cooperation

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106452723B (en) * 2016-12-13 2017-05-31 深圳市全同态科技有限公司 Fully homomorphic encryption processing method based on modular operation
CN107359979B (en) * 2017-07-25 2019-11-01 西安电子科技大学 Symmetrical full homomorphic cryptography method based on Representation theorem
CN108282328B (en) * 2018-02-02 2021-03-12 沈阳航空航天大学 Ciphertext statistical method based on homomorphic encryption

Also Published As

Publication number Publication date
CN109412786A (en) 2019-03-01

Similar Documents

Publication Publication Date Title
CN109412786B (en) Integer cipher text arithmetic operation method based on homomorphic encryption
Alawida et al. An image encryption scheme based on hybridizing digital chaos and finite state machine
Sahari et al. A pseudo-random numbers generator based on a novel 3D chaotic map with an application to color image encryption
CN109039640B (en) Encryption and decryption hardware system and method based on RSA cryptographic algorithm
JP4554239B2 (en) Montgomery type modular multiplication apparatus and method
Ghazanfaripour et al. Designing a digital image encryption scheme using chaotic maps with prime modular
CN111444518A (en) Secure processor, method of operating the same, and method of encrypting or decrypting data
Liu et al. A new DNA coding and hyperchaotic system based asymmetric image encryption algorithm
Yang et al. Some properties of the logistic map over the finite field and its application
Agbedemnab et al. A new image encryption and decryption technique using genetic algorithm and residual numbers
Chung et al. Encoding rational numbers for fhe-based applications
Waheed et al. Design and optimization of nonlinear component of block cipher: Applications to multimedia security
Parihar et al. Fast Montgomery modular multiplier for rivest–shamir–adleman cryptosystem
JP2007187908A (en) Modular exponentiation calculation device and method having tolerance to side-channel attack
Marouf et al. Comparative study of efficient modular exponentiation algorithms
WO2023074133A1 (en) Cryptographic processing device, cryptographic processing method, and cryptographic processing program
CN111740821A (en) Method and device for establishing shared secret key
JP4616169B2 (en) Apparatus, method and program for calculating conversion parameter in Montgomery modular multiplication
CN113114461B (en) N-time public key compression method for integer homomorphic encryption
Latoui et al. A two-parameter extended logistic chaotic map for modern image cryptosystems
Babenko et al. Euclidean division method for the homomorphic scheme ckks
AT&T
CN111614465B (en) Public key generation method and device based on super-singular homologous secret key encapsulation protocol
Nti et al. Asic design of low area rsa cryptocore based on montgomery multiplier
Varghese et al. A Novel Method for Mapping Plaintext Characters to Elliptic Curve Affine points over Prime Field and Pseudorandom Number Generation

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant