KR102466015B1 - Server device for processing homomorphic ciphertext and method thereof - Google Patents

Abstract

A server device is disclosed. The server device comprises: a communication device that communicates with a first electronic device; a memory for storing data received from the first electronic device; and a processor. The processor receives, from the first electronic device, a homomorphic ciphertext having homomorphically encrypted user information and digital signature information for the homomorphic ciphertext, performs digital signature verification for the homomorphic ciphertext based on the received digital signature information, restores the user information if the digital signature verification for the homomorphic ciphertext is checked, and transmits the restored user information to the first electronic device.

Description

Server device for processing homomorphic ciphertext and method thereof

The present disclosure relates to a server apparatus and method for processing homomorphic ciphertext, and more specifically, to a server apparatus and method for restoring and transmitting user information only when a user desires.

Thanks to the development of electronic and communication technologies, various services for transmitting and receiving data between various devices are supported. As an example, a cloud computing service in which a user stores his or her personal information in a server and uses the information of the server is also actively used.

In such an environment, the use of security technology to prevent data leakage is essential. Therefore, the server stores the encrypted data. In this case, whenever the server retrieves stored data or performs a series of operations based on the data, the encrypted data must be decrypted, wasting resources and time.

In addition, when hacking by a third party is performed while temporarily decrypted for calculation in the server, there is a problem that personal information can be easily leaked to the third party.

In order to solve this problem, a homomorphic encryption method is being studied. If the homomorphic encryption method is used, even if an operation is performed on the ciphertext itself without decrypting the encrypted information, the same result as the encrypted value after the operation on the plaintext can be obtained. Accordingly, various operations can be performed without decrypting the ciphertext.

Meanwhile, in relation to an electronic device such as a bank server that stores homomorphic encrypted user information and performs an operation according to a user's request, decryption of homomorphic ciphertext is required to provide user information to the user, and decryption of the homomorphic ciphertext requires decryption. It can be done on the server.

In this regard, when a bank server, etc. directly requests decryption of user information that has been homomorphically encrypted according to a user's request, there is a problem that user information may be exposed to the bank server, etc., and arbitrary user information by the bank server, etc. There was a problem that the decryption request could not be blocked.

Conversely, when a bank server or the like provides homomorphically encrypted user information to a user and the user directly decrypts the user information through the decryption server, there is a problem in that it is impossible to prevent another person from requesting decryption of the user information by hacking or the like.

Therefore, the present disclosure is intended to solve the above-mentioned problems, and the first electronic device, which is a user terminal device, does not directly request the server device to decrypt the user information. An object of the present invention is to provide a server device and method for preventing user information from being exposed to a second electronic device and preventing decryption of user information by the second electronic device by requesting the server device to decrypt the user information.

In addition, the present disclosure discloses that decryption of user information is performed by an arbitrary third party by transmitting decrypted user information to the first electronic device only when the user ID included in the isomorphic ciphertext and the user ID of the electronic signature match. It is to provide a server device and method that can prevent.

In order to achieve the above object, a method for decrypting isomorphic ciphertext in a server device according to an embodiment of the present disclosure includes isomorphic ciphertext having homomorphically encrypted user information and digital signature information for the isomorphic ciphertext from a first electronic device. receiving, performing digital signature verification on the isomorphic ciphertext based on the received digital signature information, restoring the user information when the digital signature verification of the isomorphic ciphertext is confirmed, and restoring the user information; It may include transmitting information to the first electronic device.

In this case, the homomorphic ciphertext further has a homomorphically encrypted user ID, digital signature information for the homomorphic ciphertext is digital signature information generated based on the user ID, and the restoring step includes the user ID And the transmitting may include transmitting the restored user information to the first electronic device when the restored user ID and the user ID for the digital signature information match. have.

In this case, the isomorphic ciphertext may be an isomorphic ciphertext generated by a second electronic device distinct from the first electronic device according to a request of the first electronic device and transmitted to the first electronic device.

Meanwhile, the receiving step includes receiving digital signature information of the second electronic device for the isomorphic ciphertext, and performing digital signature verification includes digital signature information of the second electronic device. and the time recorded in the timestamp included in the digital signature information of the second electronic device is preset from the time of receiving the digital signature information of the second electronic device. It may include a step of checking whether it is within the time.

Meanwhile, the homomorphically encrypted user ID is a homomorphic cipher text obtained by homomorphically encrypting the user ID transmitted to the second electronic device together with the user information request of the first electronic device by the second electronic device, and the homomorphically encrypted user ID The information may be a result of performing the calculation in the second electronic device according to a request of the first electronic device for calculating the homomorphically encrypted user information stored in the second electronic device.

Meanwhile, in the homomorphic ciphertext, the homomorphically encrypted user ID and the homomorphically encrypted user information may be stored in different slots of the homomorphic ciphertext.

Meanwhile, the decryption method may further include deleting the homomorphic ciphertext and the electronic signature information received from the first electronic device after transmitting the restored user information to the first electronic device.

A server device according to an embodiment of the present disclosure includes a communication device that communicates with a first electronic device, a memory that stores data received from the first electronic device, and a processor, wherein the processor includes homomorphic encryption Receives a homomorphic ciphertext having user information and digital signature information on the isomorphic ciphertext from the first electronic device, performs digital signature verification on the homomorphic ciphertext based on the received digital signature information, and If the verification of the digital signature for is confirmed, the user information may be restored, and the restored user information may be transmitted to the first electronic device.

In this case, the homomorphic ciphertext further has a homomorphic encrypted user ID, the digital signature information for the isomorphic ciphertext is digital signature information generated based on the user ID, and the processor is configured to: If signature verification is confirmed, the user ID is restored, and if the restored user ID and the user ID for the digital signature information match, the restored user information may be transmitted to the first electronic device.

In this case, the isomorphic ciphertext may be an isomorphic ciphertext generated by a second electronic device distinct from the first electronic device according to a request of the first electronic device and transmitted to the first electronic device.

Meanwhile, the processor receives and stores digital signature information of the second electronic device for the isomorphic ciphertext, and performs digital signature verification for the isomorphic ciphertext using the digital signature information of the second electronic device; It may be checked whether the time recorded in the timestamp included in the electronic signature information of the second electronic device is within a preset time from the time of receiving the digital signature information of the second electronic device.

Meanwhile, the homomorphically encrypted user ID is a homomorphic cipher text obtained by homomorphically encrypting the user ID transmitted to the second electronic device together with the user information request of the first electronic device by the second electronic device, and the homomorphically encrypted user ID The information may be a result of performing the calculation in the second electronic device according to a request of the first electronic device for calculating the homomorphically encrypted user information stored in the second electronic device.

Meanwhile, in the homomorphic ciphertext, the homomorphically encrypted user ID and the homomorphically encrypted user information may be stored in different slots of the homomorphic ciphertext.

Meanwhile, the processor may transmit the restored user information to the first electronic device and then delete the homomorphic ciphertext and the digital signature information received from the first electronic device.

In a computer-readable recording medium containing a program for executing a method of decrypting an isomorphic ciphertext in a server device according to an embodiment of the present disclosure, the method of decrypting an isomorphic ciphertext comprising the isomorphic ciphertext having homomorphic encrypted user information and the isomorphic ciphertext Receiving digital signature information on the ciphertext from a first electronic device, performing digital signature verification on the isomorphic ciphertext based on the received digital signature information, and verifying the digital signature on the isomorphic ciphertext; It may include restoring the user information and transmitting the restored user information to the first electronic device.

According to various embodiments of the present disclosure as described above, the first electronic device, which is a user terminal device, does not directly request decryption of user information to the server device by the second electronic device storing the homomorphically encrypted user information. Since decryption of user information is requested, exposure of user information to the second electronic device can be prevented, and decryption of any user information by the second electronic device can be prevented.

Meanwhile, the isomorphic ciphertext generated by the second electronic device and transmitted to the first electronic device includes a homomorphically encrypted user ID and homomorphically encrypted user information, and the isomorphic ciphertext digitally signed by the user ID in the first electronic device As it is transmitted to the server device, the server device can transmit the decrypted user information to the first electronic device only when the user ID included in the isomorphic ciphertext and the user ID of the electronic signature match. Decryption can be prevented from being performed.

1 is a diagram for explaining the structure of a homomorphic ciphertext decryption system according to an embodiment of the present disclosure.
2 is a block diagram showing the configuration of a server device according to an embodiment of the present disclosure.
3 is a timing diagram illustrating operations of a server device, a first electronic device, and a second electronic device according to an embodiment of the present disclosure.
4 to 6 are flowcharts illustrating a method of decrypting homomorphic ciphertext in a server device according to an embodiment of the present disclosure.

Hereinafter, the present disclosure will be described in detail with reference to the accompanying drawings. Encryption/decryption may be applied to the information (data) transmission process performed in the present disclosure, if necessary, and expressions describing the information (data) transmission process in the present disclosure and claims are all encryption/decryption, even if not separately mentioned. It should be interpreted as including the case. In the present disclosure, expressions such as “transmission (delivery) from A to B” or “A receiving from B” include transmission (transmission) or reception with another medium included in the middle, and must be transmitted from A to B. It does not represent only what is directly transmitted (delivered) or received.

In the description of the present disclosure, the order of each step should be understood as non-limiting, unless the preceding step must logically and temporally necessarily precede the succeeding step. In other words, except for the above exceptional cases, even if the process described as the later step is performed before the process described as the preceding step, the nature of the disclosure is not affected, and the scope of rights must also be defined regardless of the order of the steps. And, in this specification, "A or B" is defined to mean not only selectively indicating either one of A and B, but also including both A and B. In addition, in the present disclosure, the term "include" has a meaning encompassing further including other components in addition to the elements listed as included.

In this disclosure, only essential components necessary for the description of the present disclosure are described, and components unrelated to the essence of the present disclosure are not mentioned. In addition, it should not be interpreted as an exclusive meaning that includes only the mentioned components, but should be interpreted as a non-exclusive meaning that may include other components.

The present disclosure may be performed by electronic calculation devices such as computers, servers, and mobile devices such as smart phones capable of electronic calculations, and mathematical calculations and calculations of each step of the present disclosure described below are performed in order to perform the corresponding calculations or calculations. It may be implemented as other operations in the execution of a computer program by a known coding method and/or coding designed in accordance with the present disclosure. A computer program executing the present disclosure may be stored in a computer-readable recording medium.

Also, in the present disclosure, “value” may be defined as a concept in a broad sense including all values that can be expressed as mathematical expressions such as vectors, matrices, and polynomials as well as scalar values.

In the present disclosure, the meaning of obtaining a predetermined value by performing an operation such as encryption or hash on a specific value is not only the specific value, but also a modified value of the specific value (for example, operation by adding a predetermined value to the specific value) or another value calculated through a process such as changing a corresponding specific value according to a predetermined rule) may also be defined as including an operation such as encryption or hash.

Mathematical operations and calculations of each step of the present disclosure described below may be implemented as computer operations by a known coding method and/or coding designed appropriately for the present disclosure to perform the calculations or calculations.

The specific equations described below are illustratively described among possible alternatives, and the scope of the present disclosure should not be construed as being limited to the equations mentioned in the present disclosure.

For convenience of explanation, in the present disclosure, the notation is defined as follows.

a ← D: select element (a) according to distribution (D)

s ₁ , s ₂ ∈ R : Each of S1 and S2 is an element belonging to the set R.

mod(q) : Modular operation with elements q

: 내부 값을 반올림함

: round internal value

Hereinafter, various embodiments of the present disclosure will be described in detail using the accompanying drawings.

1 is a diagram for explaining the structure of a homomorphic ciphertext decryption system according to an embodiment of the present disclosure.

Referring to FIG. 1 , the homomorphic ciphertext decryption system may include a server device 100 , a first electronic device 200 , and a second electronic device 300 . The server device 100 can communicate with the first electronic device 200, and the first electronic device 200 can communicate with the second electronic device 300. The present invention is not limited thereto, and the server device 100 and the second electronic device 300 may also communicate with each other.

For example, the server device 100, the first electronic device 200, and the second electronic device 300 may be connected through a network. The network may be implemented in various types of wired and wireless communication networks, broadcast communication networks, optical communication networks, cloud networks, etc., and each device may be connected in a manner such as Wi-Fi, Bluetooth, Near Field Communication (NFC), etc. without a separate medium.

Although FIG. 1 illustrates one electronic device connected to the second electronic device 300, one electronic device is not necessarily used, and a plurality of electronic devices may be connected to the second electronic device 300.

For example, the first electronic device 200 may be a user terminal device, and may be implemented in various types of devices such as smart phones, tablets, game players, PCs, laptop PCs, home servers, kiosks, etc., and other IoT functions. It can also be implemented in the form of a home appliance to which this is applied.

The user may input various information through the first electronic device 200 used by the user. The input information may be stored in the first electronic device 200 itself, but may also be transmitted and stored in an external device for storage capacity and security reasons. In FIG. 1 , the second electronic device 300 may serve to store such information and use some or all of the stored information.

For example, the second electronic device 300 may be a bank server. In this case, the information transmitted from the first electronic device 200 to the second electronic device 300 includes user personal information, user ID, and account information. and the like, but is not limited thereto.

The first electronic device 200 may homomorphically encrypt input information and transmit homomorphic cipher text to the second electronic device 300 . The first electronic device 200 may include encryption noise, that is, an error, generated in the process of performing homomorphic encryption in the ciphertext. For example, the homomorphic ciphertext generated by the first electronic device 200 may be generated in a form in which a resultant value including a message and an error value is restored when decrypted later using a private key.

For example, the homomorphic ciphertext generated by the first electronic device 200 may be generated in a form satisfying the following properties when decrypted using a secret key.

[Equation 1]

Dec(ct, sk) = <ct, sk> = M+e(mod q)

Here, < , > are the usual inner product, ct is the ciphertext, sk is the secret key, M is the plaintext message, e is the encryption error value, and mod q is the modulus of the ciphertext. q should be chosen larger than the resulting value M multiplied by a scaling factor (Δ) to the message. If the absolute value of the error value e is sufficiently small compared to M, the decryption value M+e of the ciphertext is a value that can replace the original message with the same precision in significant figure calculation. Among the decoded data, an error may be placed on the least significant bit (LSB) side, and M may be placed on the next least significant bit side.

If the size of the message is too small or too large, the size may be adjusted using a scaling factor. When a scaling factor is used, not only an integer type message but also a real number type message can be encrypted, and thus usability can be greatly increased. In addition, by adjusting the size of the message using the scaling factor, the size of an area where messages exist in the ciphertext after the operation is performed, that is, the size of an effective area can also be adjusted.

Depending on the embodiment, the ciphertext modulus q may be set and used in various forms. For example, the modulus of the ciphertext may be set in the form of an exponential power q= ^ΔL of the scaling factor Δ. If Δ is 2, it can be set to a value such as q=2 ¹⁰ .

As another example, the ciphertext modulus may be set to a value obtained by multiplying a plurality of different scaling factors. Each factor may be set to a value within a similar range, that is, a value having a similar size to each other. For example, q=q ₁ q ₂ q ₃ . It can be set as q _x , q ₁ , q ₂ , q ₃ ,… , q _x are similar in size to the scaling factor Δ and may be set to values having a small relationship with each other.

When the scaling factor is set in this way, the entire operation can be separated into a plurality of modulus operations according to the Chinese Remainder Theorem (CRT), and thus the operation burden can be reduced.

In addition, as factors having similar sizes are used, almost the same results as those in the previous example can be obtained when rounding is performed in a step described later.

The second electronic device 300 may store the received homomorphic ciphertext in a ciphertext state without decrypting it. The first electronic device 200 may request a specific processing result for the homomorphic cipher text from the second electronic device 300 . The second electronic device 300 may perform a specific operation according to the request of the first electronic device 200 and transmit the result to the first electronic device 200 .

For example, the first electronic device 200, which is a user terminal device, transmits homomorphically encrypted deposit and withdrawal information to the second electronic device 300, which is a bank server, and stores the homomorphically encrypted deposit and withdrawal information in the second electronic device 300. It can be. In addition, the user may request the second electronic device 300 for average deposit and withdrawal information for a specific period through the first electronic device 200 . Upon request of the first electronic device 200, the second electronic device 300 may perform an operation of calculating an average value of homomorphically encrypted deposit and withdrawal information received during a specific period.

Due to the nature of the homomorphic ciphertext, the second electronic device 300 may perform an operation without decrypting the homomorphic ciphertext, and user information as a result value may also be in the form of the homomorphic ciphertext.

In order for the user to recognize the resulting value, it is necessary to decrypt the homomorphic ciphertext into plain text, and the decryption of the homomorphic ciphertext may be performed by the server device 100 .

If the second electronic device 300 directly transmits an operation result value to the server device 100 to receive decrypted user information and retransmits it to the first electronic device 200, user information requiring security is provided. 2 A problem of being exposed to the electronic device 300 may occur.

In addition, even when the first electronic device 200 does not request user information, the second electronic device 300 requests the server device 100 to decrypt the arbitrarily homomorphically encrypted user information to obtain the decrypted user information As far as could be done, it was necessary to prevent this.

Meanwhile, in order to prevent user information exposure by the second electronic device 300, the isomorphic ciphertext on which the calculation has been performed is transmitted to the first electronic device 200, and the first electronic device 200 transmits the isomorphic ciphertext to the server device ( 100) to perform decryption, but in this case, a third party intercepts the homomorphic encrypted text and transmits it to the server device 100, thereby preventing a problem in which a third party can arbitrarily decrypt user information requiring security. There was a need.

Accordingly, the server device 100 receives, from the first electronic device 200, the homomorphic encrypted user ID and the homomorphic ciphertext including the homomorphically encrypted user information and digital signature information for the homomorphic ciphertext generated based on the user ID. and verifying the homomorphic ciphertext using the received digital signature information. When the isomorphic ciphertext is verified, the server device 100 decrypts the isomorphic ciphertext into a user ID and user information, and checks whether the decrypted user ID and the user ID of the digital signature information received from the first electronic device 200 match. . If the user ID matches, the server device 100 may transmit decrypted user information to the first electronic device 200 .

In this case, the isomorphic cipher text transmitted from the first electronic device 200 to the server device 100 is generated by the second electronic device 300 that is distinguished from the first electronic device according to the request of the first electronic device 200, This is the homomorphic cipher text transmitted to the first electronic device 200 .

2 is a block diagram showing the configuration of the server device 100 according to an embodiment of the present disclosure.

Referring to FIG. 2 , the server device 100 may include a communication device 110 , a memory 120 and a processor 130 . The server device 100 may be implemented in various types of devices, and may be various devices such as a personal computer (PC), a laptop computer, and a server.

The communication device 110 is formed to connect the server device 100 with an external device, and is connected to an external device through a local area network (LAN) and an Internet network, as well as a Universal Serial Bus (USB) A form connected through a port or wireless communication (eg, WiFi 802.11a/b/g/n, NFC, Bluetooth) port is also possible. Such a communication device 230 may also be referred to as a transceiver.

For example, the server device 100 may receive a secret key for isomorphic ciphertext decryption from an external device through the communication device 110 . Alternatively, if the server device 100 itself generates the public key and private key, the public key and private key generated through the communication device 110 may be transmitted to an external device. When the server device 100 generates the public key and the private key by itself, various parameters required for generating the public key and the private key may be received from an external device through the communication device 110 . Meanwhile, in implementation, various parameters may be directly input from a user of the server device 100 .

Meanwhile, the server device 100 may receive the isomorphic cipher text from the first electronic device 200 through the communication device 110, and send decrypted user information through the communication device 110 to the first electronic device 200. can also be sent to

The memory 120 may store at least one instruction related to the server device 100 . For example, various programs (or software) for operating the server device 100 according to various embodiments of the present disclosure may be stored in the memory 120 .

The memory 120 may be implemented in various forms such as RAM, ROM, buffer, cache, flash memory, HDD, external memory, memory card, etc., but is not limited to any one.

The memory 120 may store data received from an external device. Data received from an external device may be homomorphic ciphertext, or may be digital signature information for the homomorphic ciphertext. For example, the memory 120 may store data received from the first electronic device 200 .

In addition, the memory 120 may store a public key and a private key, and when the server device 100 directly generates a public key and a private key, it may also store various parameters required for key generation.

The processor 130 controls overall operations of the server device 100 . For example, the processor 130 may overall control the operation of the server device 100 by executing at least one instruction stored in the memory 120 . The processor 130 may be composed of a single device such as a central processing unit (CPU) and an application-specific integrated circuit (ASIC), or may be composed of a plurality of devices such as a CPU and a graphics processing unit (GPU).

The processor 130 may store in the memory 120 when a plain text message or homomorphic cipher text is input. Further, the processor 130 may homomorphically encrypt a message or decrypt homomorphic ciphertext using various setting values and programs stored in the memory 120 . In this case, a public key and a private key may be used.

The processor 130 may generate and use a public key and a private key required to perform encryption and decryption by itself, or may receive and use them from an external device. For example, the processor 130 may generate a public key and a private key and distribute the public key to other external devices.

When generating a key by itself, the processor 130 may generate a public key using a Ring-LWE technique. For example, the processor 130 may first set various parameters and rings and store them in the memory 120 . Examples of the parameter may include the length of a plaintext message bit, the size of a public key and a private key, and the like.

The ring can be expressed as Equation 2 below.

[Equation 2]

where R is a ring, Zq is a coefficient, and f(x) is a polynomial of degree n.

A ring is a set of polynomials having predetermined coefficients, and means a set in which addition and multiplication are defined between elements and are closed with respect to addition and multiplication. Such a ring may be referred to as a ring.

For example, a ring means a set of n-order polynomials having coefficients Zq. For example, when n is Φ(N), it may mean an N-th cyclotomic polynomial. (f(x)) represents the ideal of Zq[x] generated by f(x). The Euler totient function Φ(N) means the number of natural numbers that are prime to N and smaller than N. If Φ _N (x) is defined as an Nth-order cyclotomic polynomial, the ring can also be expressed in Equation 3 as follows. Here, 2 ¹⁷ may be used for N.

[Equation 3]

The secret key (sk) can be expressed as:

Meanwhile, the ring of Equation 3 described above has a complex number in the plain text space. Meanwhile, in order to improve the operation speed for homomorphic ciphertext, only sets whose plaintext spaces are real numbers among the above-described ring sets may be used.

When such a ring is established, the processor 130 may calculate a secret key sk from the ring.

[Equation 4]

sk ← (1, s(x)), s(x) ∈ R

Here, s(x) means a polynomial generated randomly with small coefficients.

Also, the processor 130 may calculate a first random polynomial (a(x)) from the ring. The first random polynomial can be expressed as

[Equation 5]

a(x) ← R

Also, the processor 130 may calculate an error. For example, the processor 130 may extract an error from a discrete Gaussian distribution or a distribution statistically close to the discrete Gaussian distribution. This error can be expressed as:

[Equation 6]

e(x) ←D ⁿ _αq

If an error is calculated, the processor 130 may calculate a second random polynomial by performing a modular operation on the error in the first random polynomial and the secret key. The second random polynomial can be expressed as

[Equation 7]

b(x) = -a(x)s(x) + e(x)(mod q)

Finally, the public key (pk) is set as follows in a form including a first random polynomial and a second random polynomial.

[Equation 8]

pk = (b(x), a(x))

Since the above key generation method is only an example, it is not necessarily limited thereto, and the public key and the private key may be generated by other methods, of course.

Meanwhile, when the public key is generated, the processor 130 may control the communication device 110 to transmit it to other devices.

In addition, the processor 130 may generate homomorphic ciphertext for the message. For example, the processor 130 may generate the homomorphic ciphertext by applying the previously generated public key to the message.

The generated homomorphic ciphertext may be restored as a result value obtained by adding an error to a value in which the scaling factor is reflected in the message when decrypted. As for the scaling factor, a value input and set in advance may be used as it is.

Alternatively, the processor 130 may directly encrypt using the public key after multiplying the message and the scaling factor. In this case, an error calculated in the encryption process may be added to a result value obtained by multiplying the message and the scaling factor.

Also, the processor 130 may generate the length of the ciphertext to correspond to the size of the scaling factor.

When the homomorphic ciphertext is generated, the processor 130 may store it in the memory 120 or control the communication device 110 to transmit the homomorphic ciphertext to another device according to a user request or a preset default command.

When decryption of the homomorphic ciphertext is required, the processor 130 may apply a secret key to the homomorphic ciphertext to generate polynomial-type decryption text and decode the polynomial-type decryption text to generate a message. At this time, the generated message may include an error as mentioned in Equation 1 described above.

For example, the processor 130 may decrypt the homomorphic ciphertext received from the first electronic device 200 . And the processor 130 may transmit the decrypted message to the first electronic device 200 .

3 is a timing diagram illustrating operations of the server device 100, the first electronic device 200, and the second electronic device 300 according to an embodiment of the present disclosure.

First, the first electronic device 200 may transmit an operation request for user information stored in the second electronic device 300 to the second electronic device 300 (S310). Meanwhile, the first electronic device 200 may request user information stored in the second electronic device 300 without a separate operation.

The first electronic device 200 may transmit a user ID together with a request for user information to the second electronic device 300 (S310). A user ID is information for identifying a user, and user information stored in the second electronic device 300 may be matched with the user ID and stored.

The second electronic device 300 may perform the operation requested by the first electronic device 200 (S320). Since the user information stored in the second electronic device 300 is homomorphically encrypted, calculation can be performed without separate decryption.

The second electronic device 300 may homomorphically encrypt the user ID received from the first electronic device 200 together with performing an operation on the homomorphically encrypted user information (S320). The second electronic device 300 may generate homomorphic ciphertext so that the homomorphically encrypted user ID and the homomorphically encrypted user information are stored in different slots (S330).

Since the homomorphically encrypted user ID and the homomorphically encrypted user information are stored in different slots of the homomorphic ciphertext, it may be difficult for a third party, an attacker, to determine which value is related to which user when viewing the homomorphic ciphertext. For example, a function of specifying a slot of a homomorphic cipher or a function of rotating a homomorphic cipher may be used to store the same in each slot of the cipher text.

The second electronic device 300 may generate digital signature information for the generated homomorphic ciphertext. The second electronic device 300 may include a timestamp, which is a time when the digital signature information was generated, in the digital signature information. In addition, the second electronic device 300 may transmit the generated homomorphic encrypted text and digital signature information on the homomorphic encrypted text to the first electronic device 200 (S340).

Since the digital signature information of the second electronic device 300 is transmitted together with the homomorphic ciphertext generated by the second electronic device 300, falsification of the generated homomorphic ciphertext can be prevented. In addition, since a time stamp is included in the digital signature information, when the server device 100 to be described later decrypts the same type of cipher text, a request for decryption of the same type of cipher text after a predetermined point in time can be prevented. Accordingly, it is possible to prevent a third party who is an attacker from hacking the first electronic device 200 and stealing user information by using the homomorphic ciphertext received from the second electronic device 300 in the past.

The first electronic device 200 may generate digital signature information based on the user ID for the homomorphic encrypted text from the second electronic device 300 . The present invention is not limited thereto, and digital signature information may be generated for the homomorphic encrypted text and the entire digital signature information of the second electronic device 300 .

The first electronic device 200 transmits the homomorphic encrypted user ID received from the second electronic device 300 and the homomorphic ciphertext including the homomorphically encrypted user information and digital signature information for the homomorphic ciphertext generated based on the user ID. It can be transmitted to the server device 100. In addition, the first electronic device 200 may also transmit digital signature information of the second electronic device 300 for the isomorphic encrypted text received from the second electronic device 300 to the server device 100 (S350).

For example, the processor 130 of the server device 100 may store the homomorphic ciphertext and digital signature information received from the first electronic device 200 in the memory 120 .

The server device 100 may perform digital signature verification on the homomorphic ciphertext using digital signature information generated based on the user ID. As an example, when the digital signature information of the second electronic device 300 is also received from the first electronic device 200, the digital signature of the homomorphic ciphertext is verified using the digital signature information of the second electronic device 300. can be performed. The time recorded in the timestamp included in the electronic signature information of the second electronic device 300 is within a preset time from the time of receiving the digital signature information of the second electronic device 300 from the first electronic device 200. It is possible to check whether or not it is (S360).

If verification of the digital signature for the homomorphic ciphertext is not confirmed or if the time recorded in the timestamp exceeds a predetermined time from the time of receiving the digital signature information, the server device 100 does not decrypt the received homomorphic ciphertext. may not be For example, the server device 100 may transmit information indicating that the homomorphic ciphertext is not decrypted to the first electronic device 200 .

Since the server device 100 checks not only the digital signature information but also the timestamp, when decrypting the homomorphic ciphertext, it is possible to prevent a request for decryption of the homomorphic ciphertext after a predetermined point in time. Accordingly, it is possible to prevent a third party who is an attacker from stealing user information by using the past homomorphic ciphertext.

The server device 100 converts the received isomorphic ciphertext into the user ID and user information when the electronic signature verification for the isomorphic ciphertext is confirmed and the time recorded in the timestamp is within a predetermined time from the time of receiving the digital signature information. It can be decrypted (S370).

The server device 100 may check whether the decrypted user ID and the user ID for digital signature information generated based on the user ID match (S380). When the user ID matches, the server device 100 may transmit the decrypted user information to the first electronic device 200 (S390).

That is, the second electronic device 300 that stores the homomorphically encrypted user information does not directly request the server device 100 to decrypt the user information, but the first electronic device 200, which is a user terminal device, sends the server device ( 100) to request decryption of user information, it is possible to prevent user information from being exposed to the second electronic device 300, and to prevent decryption of arbitrary user information by the second electronic device 300. can

In addition, the server device 100 transmits the decrypted user information to the first electronic device 200 only when the user ID included in the isomorphic ciphertext and the user ID of the electronic signature match, and the user information is stored by an arbitrary third party. Decryption of can be prevented from being performed.

Meanwhile, the server device 100 may transmit the decrypted user information to the first electronic device 200 and then delete the homomorphic cipher text and digital signature information received from the first electronic device 200 (S395). In addition, the server device 100 can also delete the decrypted user ID and user information, so that the security of the user information can be maintained.

Meanwhile, decryption of the homomorphic ciphertext described in the above section may have the same meaning as restoration of the homomorphic ciphertext.

4 to 6 are flowcharts illustrating a method of decrypting homomorphic ciphertext in a server device according to an embodiment of the present disclosure.

Referring to FIG. 4 , a method of decrypting a homomorphic ciphertext in a server device according to an example of the present disclosure includes receiving, from a first electronic device, a homomorphic ciphertext having homomorphically encrypted user information and digital signature information for the homomorphic ciphertext (S410). ), performing digital signature verification for the isomorphic ciphertext based on the received digital signature information (S420), restoring user information when the digital signature verification for the isomorphic ciphertext is confirmed (S430), and restored user information may include transmitting (S440) to the first electronic device. Referring to FIG. 5 , a method for decrypting a homomorphic ciphertext in a server device according to various examples of the present disclosure includes a user ID that is homomorphically encrypted from the first electronic device. and receiving digital signature information for the isomorphic ciphertext generated based on the user ID and the isomorphic ciphertext including the homomorphic encrypted user information (S510). Performing (S520), if the digital signature verification for the homomorphic ciphertext is confirmed, decrypting the homomorphic ciphertext with the user ID and user information (S530), and if the decrypted user ID and the user ID for the digital signature information match , transmitting the decrypted user information to the first electronic device (S540).

In this case, the homomorphic ciphertext may be homomorphic ciphertext generated by a second electronic device that is distinct from the first electronic device at the request of the first electronic device and transmitted to the first electronic device, a homomorphically encrypted user ID, and a homomorphic encrypted user ID. Since the contents related to information and digital signatures have been described in the above section, redundant descriptions will be omitted.

Referring to FIG. 6 , a method for decrypting an isomorphic ciphertext of a server device according to various examples of the present disclosure includes generating an isomorphic ciphertext from a first electronic device, digital signature information of a second electronic device for the same ciphertext, and a user ID. Receiving digital signature information on the isomorphic encrypted text (S610), performing digital signature verification on the received isomorphic encrypted text using the digital signature information generated based on the user ID and the digital signature information of the second electronic device. (S620), checking whether the time recorded in the timestamp included in the digital signature information of the second electronic device is within a predetermined time from the time of receiving the digital signature information of the second electronic device (S630), If the verification of the digital signature on the ciphertext is confirmed and the time recorded in the timestamp is within a predetermined time, decrypting the isomorphic ciphertext into the user ID and user information (S640), the user ID of the decrypted user ID and the digital signature information If the ID matches, the decrypted user information may be transmitted to the first electronic device (S650) and the isomorphic cipher text and digital signature information received from the first electronic device may be deleted (S660).

Meanwhile, the isomorphic ciphertext decryption method according to various embodiments described above may be implemented in the form of program code for performing each step, stored in a recording medium, and distributed. In this case, the device equipped with the recording medium can perform the operation of the above-described homomorphic ciphertext decryption method.

Such a recording medium may be various types of computer readable media such as ROM, RAM, memory chip, memory card, external hard drive, hard drive, CD, DVD, magnetic disk or magnetic tape.

Although the present disclosure has been described with reference to the accompanying drawings, the scope of the present disclosure is determined by the claims described below and should not be construed as being limited to the foregoing embodiments and/or drawings. And it should be clearly understood that improvements, changes and modifications obvious to those skilled in the art of the disclosure described in the claims are also included in the scope of the present disclosure.

100: server device 200: first electronic device
300: second electronic device 110: communication device
120: memory 130: processor

Claims (15)

In the isomorphic ciphertext decryption method of the server device,
Receiving homomorphic encrypted user information, homomorphic encrypted text having a homomorphically encrypted user ID, and digital signature information for the homomorphic encrypted text from a first electronic device;
performing digital signature verification on the homomorphic ciphertext based on the received digital signature information;
restoring the user information when verification of the digital signature for the homomorphic ciphertext is confirmed; and
Transmitting the restored user information to the first electronic device; including,
The homomorphic ciphertext,
wherein the homomorphically encrypted user ID and the homomorphically encrypted user information are stored in different slots of the homomorphic ciphertext. According to claim 1,
The digital signature information for the isomorphic ciphertext is digital signature information generated based on a user ID,
The restoring step is
Including; restoring the user ID,
The sending step is
and transmitting the restored user information to the first electronic device when the restored user ID matches the user ID of the digital signature information. According to claim 2,
The isomorphic ciphertext is an isomorphic ciphertext generated by a second electronic device that is distinct from the first electronic device according to a request of the first electronic device and transmitted to the first electronic device. According to claim 3,
In the receiving step,
Receiving digital signature information of the second electronic device for the homomorphic ciphertext;
The step of performing the digital signature verification,
performing digital signature verification on the homomorphic ciphertext using digital signature information of the second electronic device; and
Checking whether the time recorded in the timestamp included in the digital signature information of the second electronic device is within a predetermined time from the time of receiving the digital signature information of the second electronic device; decryption method. According to claim 3,
The homomorphically encrypted user ID,
Homomorphic ciphertext obtained by isomorphically encrypted by the second electronic device the user ID transmitted to the second electronic device together with the user information request of the first electronic device;
The homomorphically encrypted user information,
The isomorphic ciphertext decryption method of claim 1 , which is a result of performing the operation in the second electronic device in response to an operation request of the first electronic device for homomorphic encrypted user information stored in the second electronic device. delete According to claim 1,
and deleting the isomorphic ciphertext and the electronic signature information received from the first electronic device after transmitting the restored user information to the first electronic device. In the server device,
a communication device that communicates with the first electronic device;
a memory for storing data received from the first electronic device; and
Including a processor;
the processor,
Receiving homomorphic encrypted user information, homomorphic ciphertext having a homomorphically encrypted user ID, and digital signature information for the homomorphic ciphertext from the first electronic device, and obtaining a digital signature for the homomorphic ciphertext based on the received digital signature information Verification is performed, and when verification of the digital signature for the homomorphic ciphertext is confirmed, restoring the user information and transmitting the restored user information to the first electronic device;
The homomorphic ciphertext,
wherein the homomorphically encrypted user ID and the homomorphically encrypted user information are stored in different slots of the homomorphic cipher text. According to claim 8,
The digital signature information for the isomorphic ciphertext is digital signature information generated based on a user ID,
the processor,
If the digital signature verification of the isomorphic ciphertext is confirmed, the user ID is restored, and if the restored user ID and the user ID for the digital signature information match, the restored user information is transmitted to the first electronic device. , the server device. According to claim 9,
The isomorphic ciphertext is an isomorphic ciphertext generated by a second electronic device that is distinct from the first electronic device according to a request of the first electronic device and transmitted to the first electronic device. According to claim 10,
the processor,
receiving and storing digital signature information of the second electronic device for the isomorphic ciphertext, performing digital signature verification on the isomorphic ciphertext using the digital signature information of the second electronic device, and and determining whether a time recorded in a timestamp included in the digital signature information is within a predetermined time from the time of receiving the digital signature information of the second electronic device. According to claim 10,
The homomorphically encrypted user ID,
Homomorphic ciphertext obtained by isomorphically encrypted by the second electronic device the user ID transmitted to the second electronic device together with the user information request of the first electronic device;
The homomorphically encrypted user information,
The server device is a result of performing the calculation in the second electronic device according to an operation request of the first electronic device for the homomorphically encrypted user information stored in the second electronic device. delete According to claim 8,
the processor,
The server device transmitting the restored user information to the first electronic device and then deleting the homomorphic ciphertext and the digital signature information received from the first electronic device. A computer-readable recording medium containing a program for executing a method of decrypting an isomorphic ciphertext of a server device,
The isomorphic ciphertext decryption method,
Receiving homomorphic encrypted user information, homomorphic encrypted text having a homomorphically encrypted user ID, and digital signature information for the homomorphic encrypted text from a first electronic device;
performing digital signature verification on the homomorphic ciphertext based on the received digital signature information;
restoring the user information when verification of the digital signature for the homomorphic ciphertext is confirmed; and
Transmitting the restored user information to the first electronic device; including,
The homomorphic ciphertext,
wherein the homomorphically encrypted user ID and the homomorphically encrypted user information are stored in different slots of the homomorphic cipher text.

Images