WO2016000453A1 - 全同态消息认证方法、装置及系统 - Google Patents

全同态消息认证方法、装置及系统 Download PDF

Info

Publication number
WO2016000453A1
WO2016000453A1 PCT/CN2015/072570 CN2015072570W WO2016000453A1 WO 2016000453 A1 WO2016000453 A1 WO 2016000453A1 CN 2015072570 W CN2015072570 W CN 2015072570W WO 2016000453 A1 WO2016000453 A1 WO 2016000453A1
Authority
WO
WIPO (PCT)
Prior art keywords
calculated
data
calculation result
string
character
Prior art date
Application number
PCT/CN2015/072570
Other languages
English (en)
French (fr)
Inventor
陈文彬
雷浩
杨琴琴
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP15775600.8A priority Critical patent/EP3163792B1/en
Priority to US14/985,883 priority patent/US10009343B2/en
Publication of WO2016000453A1 publication Critical patent/WO2016000453A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/126—Applying verification of the received information the source of the received data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/008—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols involving homomorphic encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H04L9/3231—Biological data, e.g. fingerprint, voice or retina
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0861—Network architectures or network communication protocols for network security for authentication of entities using biometrical features, e.g. fingerprint, retina-scan

Definitions

  • the embodiments of the present invention relate to the field of computer information technologies, and in particular, to a method, device, and system for fully homomorphic message authentication.
  • the homomorphic encryption algorithm includes an algorithm for generating a public key, a private key, and a calculation key, an encryption algorithm, a decryption algorithm, and a ciphertext calculation function, and the full homomorphic encryption algorithm is mainly used for authentication of calculation results of distributed computing. , that is, full homomorphic message authentication technology.
  • the specific implementation mode of the homomorphic message authentication technology is: the terminal acquires a message authentication key, and the message authentication key includes a public key, a private key, and a calculation key acquired according to the above homomorphic encryption algorithm, and further includes: a string and a second string, the first string being a subset of the randomly generated set ⁇ 1, 2, ..., n-1, n ⁇ having a length of n/2, the second string being a length of A random string of 0's and n's, where n is an integer greater than or equal to two.
  • the terminal generates an authentication fingerprint for each bit in the data to be calculated according to the encryption algorithm in the homomorphic encryption algorithm, and the data to be calculated, the authentication fingerprint, the message authentication key, and the foregoing all
  • the homomorphic encryption algorithm is sent to the server.
  • the server calculates the to-be-calculated data according to a pre-configured calculation function for calculating data to be calculated, and obtains a calculation result; calculates a first component of the authentication fingerprint of the calculation result by using a pre-configured hash function family, and authenticates the message
  • Each character of the first character string in the key is calculated by the ciphertext calculation function in the homomorphic encryption algorithm according to the calculation result, the authentication fingerprint of each bit in the data to be calculated, and the calculation key.
  • the terminal first recalculates the first component of the authentication fingerprint of the calculation result according to the pre-configured hash function family, to confirm that the first component of the recalculated calculation result of the authentication fingerprint is the same as the first component of the authentication fingerprint returned by the server.
  • the i-th character in the first string of the terminal generates a pseudo-random string rand(i,j) according to a pre-configured pseudo-random function;
  • the rand(i,j) is input to the above encryption algorithm to obtain an encrypted ciphertext of 0 under the pseudo-random string rand(i,j); and according to the encrypted ciphertext, the pre- Firstly, the calculation function for calculating the data to be calculated and the above calculation key are calculated by the ciphertext calculation function in the homomorphic encryption algorithm, and the ith second component of the authentication fingerprint of the calculation result is obtained, according to the above method.
  • the first character string in the message authentication key is composed of a subset of ⁇ 1, 2, ..., n-1, n ⁇ of length n/2, therefore, each of the data to be calculated is calculated.
  • the authentication fingerprint of the bit is complex, the calculation is complicated, and when the calculation result returned by the terminal authentication server is required, the calculation result needs to be recalculated, and each bit of the calculation data needs to be calculated n/2 times to obtain the authentication fingerprint corresponding to the calculation result.
  • the second component is compared and authenticated with the second component of the second authentication fingerprint, so that the calculation amount is large and the verification efficiency is low.
  • the embodiment of the invention provides a method, device and system for fully homomorphic message authentication, which effectively reduces the calculation amount in the verification process and improves the verification efficiency of the calculation result of the server.
  • a first aspect of the present invention provides a full-synchronous message authentication algorithm, where the method is applied to a terminal, including:
  • the message authentication key includes a public key, a first character string, and a second character string, where the first character string is a string of 0 and 1 of length n, and the first character is The number of characters in the string is 2n/3; the second character string is a string of 0 and 1 of length n, and in the second string, and in the first string
  • the character at the position corresponding to the character of 1 includes n/3 zeros, where n is an integer greater than or equal to 2;
  • the authentication fingerprint corresponding to the i-th bit further includes a first component; wherein i is an integer, greater than or equal to 1, and less than or equal to the total number of bits t, t of the data to be calculated is greater than or equal to 1; j is An integer greater than or equal to 1,
  • the server Sending a calculation request to the server, where the calculation request includes: the data to be calculated, the authentication fingerprint corresponding to each bit in the data to be calculated, a pre-configured fully homomorphic encryption algorithm, and the message Authentication key
  • the authentication fingerprint corresponding to the ith bit is generated by the following steps, including:
  • the calculation result is correctly performed according to the received authentication fingerprint corresponding to the calculation result Sexual certification, including:
  • the acquiring, by the recalculated, the first component of the authentication fingerprint corresponding to the calculation result includes:
  • the calculation function for calculating the data to be calculated is a hash tree, and the hash tree includes: t inputs, 1 output, and each node in the hash tree is pre-configured security. Hash function.
  • the acquiring, by the re-calculating the first component of the authentication fingerprint corresponding to the calculation result includes:
  • a first component of the authentication fingerprint is obtained by using a pre-configured calculation function for calculating data to be calculated, and acquiring a first component of the re-calculated authentication fingerprint corresponding to the calculation result;
  • the calculation function for calculating data to be calculated is a hash tree, and the hash tree includes: t inputs, 1 output, and each node in the hash tree is the security Greek function.
  • the message authentication key further includes a private key, and the receiving If the first component of the authentication fingerprint corresponding to the calculation result is equal to the first component of the authentication fingerprint corresponding to the recalculated calculation result, proceed to the calculation result Proof of correctness, including:
  • a second aspect of the present invention provides a method for authenticating a homomorphic message, the method being applied to a server, including:
  • the calculation request includes: data to be calculated, an authentication fingerprint corresponding to each bit in the data to be calculated, a homomorphic encryption algorithm, and a message authentication key;
  • the state encryption algorithm and the message authentication key, and the authentication fingerprint corresponding to the calculation result is calculated;
  • the calculation result of the data to be calculated and the authentication fingerprint corresponding to the calculation result are returned to the terminal, so that the terminal performs correctness authentication on the calculation result according to the received authentication fingerprint corresponding to the calculation result.
  • the calculating according to a pre-configured calculation function for calculating data to be calculated and the data to be calculated, calculating the data to be calculated
  • the calculation results include:
  • the pre-configured computing function for calculating data to be calculated is a hash tree, the hash tree includes: t inputs, 1 output, and each node in the hash tree is pre- a configured secure hash function; t is the total number of bits of the data to be calculated.
  • the authentication fingerprint corresponding to each bit in the data to be calculated includes the first component and the n a two component
  • the message authentication key further includes a calculation key, then the basis
  • the encryption algorithm and the message authentication key are used to calculate an authentication fingerprint corresponding to the calculation result, including:
  • the n second components of the authentication fingerprint corresponding to each bit of the data to be calculated, and the calculation key Obtaining n second components of the authentication fingerprint corresponding to the calculation result.
  • a third aspect of the embodiments of the present invention provides a full homomorphic message authentication apparatus, including:
  • An acquiring module configured to obtain a message authentication key, where the message authentication key includes a public key, a first character string, and a second character string, where the first character string is a string of 0 and 1 of length n, and The number of characters in the first string is 1 n/3; the second string is a string of 0 and 1 of length n, and in the second string, A character at a position corresponding to a character of 1 in a character string includes n/3 zeros, where n is an integer greater than or equal to 2;
  • a generating module configured to generate one of n ciphertexts corresponding to the ith bit in the data to be calculated according to the first input character, the public key, and the pseudo-random string, and determine that the n ciphertexts are the a second component of the authentication fingerprint corresponding to the i bits, wherein, if the jth character in the first character string is 0, the first input character is the i th bit, or, if If the jth character in the first string is 1 and the jth character in the second string is 0, the first input character is 0, or if the first string is in the first string The j-th character is 1 and the j-th character in the second string is 1, the first input character is 1; the authentication fingerprint corresponding to the ith bit further includes a first component; , i is an integer, greater than or equal to 1, and less than or equal to the total number of bits of the data to be calculated t, t is greater than or equal to 1; j is an integer, greater than or equal to 1, and
  • a transceiver module configured to send a calculation request to the server, where the calculation request includes: the data to be calculated, the authentication fingerprint corresponding to each bit in the data to be calculated, and a pre-configured full-synchronization encryption algorithm And the message authentication key;
  • the transceiver module is further configured to receive a calculation result of the data to be calculated returned by the server, and an authentication fingerprint corresponding to the calculation result;
  • a processing module configured to perform correctness authentication on the calculation result according to the authentication fingerprint corresponding to the calculation result received by the transceiver module.
  • the cancellation generating module is specifically configured to:
  • the processing module is specifically configured to:
  • the processing module is further configured to use, according to the obtained t data to be calculated And acquiring, by the calculation function for calculating the data to be calculated, the first component of the authentication fingerprint corresponding to the recalculated calculation result;
  • the calculation function for calculating the data to be calculated is a hash tree, and the hash tree includes: t inputs, 1 output, and each node in the hash tree is pre-configured security. Hash function.
  • the transceiver module is further configured to:
  • a first component of the authentication fingerprint is obtained by using a pre-configured calculation function for calculating data to be calculated, and acquiring a first component of the re-calculated authentication fingerprint corresponding to the calculation result;
  • the calculation function for calculating data to be calculated is a hash tree, and the hash tree includes: t inputs, 1 output, and each node in the hash tree is the security Greek function.
  • the message authentication key further includes a private key
  • the processing module Also used for:
  • a fourth aspect of the embodiments of the present invention provides a full homomorphic message authentication apparatus, including:
  • the transceiver module is configured to receive a calculation request sent by the terminal, where the calculation request includes: data to be calculated, an authentication fingerprint corresponding to each bit in the data to be calculated, a homomorphic encryption algorithm, and a message authentication key ;
  • a processing module configured to calculate a calculation result of the data to be calculated according to a pre-configured calculation function for calculating data to be calculated and the data to be calculated;
  • the processing module is further configured to: according to the pre-configured calculation function for calculating data to be calculated, the calculation result of the data to be calculated, and the data to be calculated An authentication fingerprint corresponding to the bit, the pre-configured full homomorphic encryption algorithm and the message authentication key, and an authentication fingerprint corresponding to the calculation result;
  • the transceiver module is further configured to return the calculation result of the data to be calculated and the authentication fingerprint corresponding to the calculation result to the terminal, so that the terminal performs the calculation according to the received authentication fingerprint corresponding to the calculation result.
  • the result is correctness certification.
  • the processing module is specifically configured to:
  • the pre-configured computing function for calculating data to be calculated is a hash tree, the hash tree includes: t inputs, 1 output, and each node in the hash tree is pre- a configured secure hash function; t is the total number of bits of the data to be calculated.
  • the authentication fingerprint corresponding to each bit in the data to be calculated includes a first component and n first
  • the processing module is further configured to:
  • the n second components of the authentication fingerprint corresponding to each bit of the data to be calculated, and the calculation key Obtaining n second components of the authentication fingerprint corresponding to the calculation result.
  • a fifth aspect of the present invention provides a fully homomorphic message authentication system, where the system includes a terminal and a server, where
  • the terminal is configured to acquire a message authentication key, where the message authentication key includes: a first character string and a second character string, where the first character string is a string of 0 and 1 of length n, and the The number of 1s in the first string is 2n/3; the second string is a string of 0 and 1 of length n, and in the second string, in the first string
  • the character at the corresponding position of 1 includes n/3 0s; n is an integer greater than or equal to 2; and the ith bit corresponding to the data to be calculated is generated according to the first input character, the public key, and the pseudo-random string
  • One of the n ciphertexts Determining that the n ciphertexts are the second component of the authentication fingerprint corresponding to the ith bit, wherein if the jth character in the first string is 0, the first input character Or the i-th bit, or, if the j-th character in the first character string is 1 and the j-th character in the second character string is
  • the server is configured to: receive a calculation request sent by the terminal; calculate a calculation result of the data to be calculated according to a pre-configured calculation function for calculating data to be calculated and the data to be calculated; a calculation function for calculating data to be calculated, a calculation result of the data to be calculated, an authentication fingerprint corresponding to each bit in the data to be calculated, the pre-configured fully homomorphic encryption algorithm, and
  • the message authentication key is used to calculate an authentication fingerprint corresponding to the calculation result; the calculation result of the data to be calculated and the authentication fingerprint corresponding to the calculation result are returned to the terminal, so that the terminal receives the The authentication fingerprint corresponding to the calculation result performs correctness authentication on the calculation result.
  • the terminal is specifically configured to: generate, according to a pre-configured pseudo-random function and a label of an i-th bit in the data to be calculated a first component of the authentication fingerprint corresponding to the i-th bit; generating, according to the pseudo-random function, n pseudo-random strings corresponding to the i-th bit in the data to be calculated; according to the first character string, The second character string and the n pseudo-random strings generate n ciphertexts corresponding to the ith bit as a second component of the authentication fingerprint corresponding to the ith bit, where the first If the jth character in the string is 0, the ith bit, the public key, and the jth pseudorandom string are input into a pre-configured encryption algorithm to generate the ciphertext; If the j-th character in the first character string is 1 and the j-th character in the second character string is 0, then 0, the public key, and the j-th pseudorandom string
  • the method, device, and system for authenticating a homomorphic message provided by the embodiment of the present invention, by satisfying the security verification, by selecting a first character string of length 0 and 1 and the first string
  • the number of the middle 1 is 2n/3
  • the second character string of 0 and 1 of length n and in the second character string, the character at the position corresponding to 1 in the first character string Including n/3 zeros, solving the prior art that the first string is a randomly generated subset of the set ⁇ 1, 2, ..., n-1, n ⁇ having a length of n/2, in calculating each bit
  • the calculation process of the non-1 or 0 random number calculation process is complicated, the calculation amount in the verification process is effectively reduced, and the verification efficiency of the calculation result of the server is improved.
  • Embodiment 1 is a flowchart of Embodiment 1 of a method for authenticating a homomorphic message according to the present invention
  • Embodiment 2 is a flowchart of Embodiment 2 of a method for authenticating a homomorphic message according to the present invention
  • Embodiment 3 is a flowchart of Embodiment 3 of a method for authenticating a homomorphic message according to the present invention
  • Embodiment 4 is a flowchart of Embodiment 4 of a method for authenticating a homomorphic message according to the present invention
  • Embodiment 5 is a flowchart of Embodiment 5 of a method for authenticating a homomorphic message according to the present invention
  • Embodiment 6 is a flowchart of Embodiment 6 of a method for authenticating a homomorphic message according to the present invention
  • FIG. 7 is a schematic diagram showing an example of a calculation function for calculating data to be calculated in the present invention.
  • Embodiment 8 is a schematic structural diagram of Embodiment 1 of a full homomorphic message authentication apparatus according to the present invention.
  • Embodiment 9 is a schematic structural diagram of Embodiment 3 of a full homomorphic message authentication apparatus according to the present invention.
  • FIG. 10 is a schematic structural diagram of Embodiment 1 of a terminal according to the present invention.
  • Embodiment 1 is a schematic structural diagram of Embodiment 1 of a server according to the present invention.
  • FIG. 12 is a schematic structural diagram of Embodiment 1 of a full homomorphic message authentication system according to the present invention.
  • FIG. 1 is a flowchart of Embodiment 1 of a method for authenticating a homomorphic message according to the present invention.
  • the embodiment of the invention provides a method for authenticating a homomorphic message, which is mainly used in a distributed environment, such as a cloud computing environment, that is, the terminal needs the server to specify the data to be calculated, and the data to be calculated according to a certain calculation function. The calculation is performed to obtain the calculation result, and the server returns the calculation result to the terminal, and there is no trust relationship between the server and the terminal, or the server is maliciously attacked or attacked by the enemy, so that the calculation result is not required by the terminal, so the terminal needs The correctness of the calculation result returned by the server is verified.
  • This embodiment mainly provides a technical solution of the method for authenticating the homomorphic message on the terminal side in the foregoing process. As shown in Figure 1, the specific steps are as follows:
  • S101 Acquire a message authentication key, where the message authentication key includes a public key, a first character string, and a second character string, where the first character string is a string of 0 and 1 of length n, and the The number of characters in a string is 1 n/3; the second string is a string of 0 and 1 of length n, and in the second string, the first string
  • the character at the position corresponding to the character of 1 includes n/3 zeros, where n is an integer greater than or equal to 2.
  • the terminal determines a random security parameter n, n is an integer greater than or equal to 2, that is, the length of the first string and the second string, and then selects the first string and the second length n.
  • a string the characters in the first string and the second string are both 0 or 1, in the first string, including 2n/3 1s and n/3 0s, and in the second string, There are n/3 0s and n/3 1s in 2n/3 1 positions corresponding to the position of 1 in the first character string.
  • n is 9, that is, the length of the first string and the second string are both 9, the first string is ⁇ 010111011 ⁇ , wherein 6 is included, and the second string can be ⁇ 100101010 ⁇ .
  • the second character string is not only one form, and the above is only an example, and the second character string may satisfy the above condition, that is, in the second In the string, half of the position corresponding to 1 in the first string is 0, and the other half is 1.
  • S102 Generate one of n ciphertexts corresponding to the ith bit in the data to be calculated according to the first input character, the public key, and the pseudo-random string, and determine that the n ciphertexts are the ith bit a second component of the corresponding authentication fingerprint, wherein, if the jth character in the first character string is 0, the first input character is the i th bit, or if the first character If the jth character in the string is 1 and the jth character in the second string is 0, the first input character is 0, or if the jth in the first string is The character is 1 and the j-th character in the second string is 1, the first input character is 1; the authentication fingerprint corresponding to the ith bit further includes a first component; wherein, i is An integer, greater than or equal to 1, and less than or equal to the total number of bits t, t of the data to be calculated is greater than or equal to 1; j is an integer greater than or equal to 1, and less than or equal to n.
  • the authentication fingerprint corresponding to each bit in the data to be calculated is respectively generated according to the message authentication key, and the data to be calculated includes an information amount of at least one bit, for each of the data to be calculated. Each bit generates a corresponding authentication fingerprint according to the message authentication key.
  • S103 Send a calculation request to the server, where the calculation request includes: the data to be calculated, an authentication fingerprint corresponding to each bit in the data to be calculated, a pre-configured fully homomorphic encryption algorithm, and the message authentication. Key.
  • the calculation request sent to the server includes t authentication fingerprints corresponding to t bits of the data to be calculated.
  • the homomorphic encryption algorithm includes an algorithm for generating a public key, a private key, and a calculation key, an encryption algorithm, a decryption algorithm, and a ciphertext calculation function, which are mainly used to calculate the authentication fingerprint corresponding to each bit and verify the calculation result of the server. In the operation process, it is an existing algorithm, and will not be described here.
  • S104 Receive a calculation result of the data to be calculated returned by the server, and an authentication fingerprint corresponding to the calculation result, and perform authentication according to the received calculation result.
  • the fingerprint performs correctness verification on the calculation result.
  • the terminal receives the calculation result that is obtained after the data to be calculated is calculated by the terminal, and the authentication fingerprint corresponding to the calculation result, and verifies whether the calculation result is correct by using the authentication fingerprint corresponding to the calculation result. If the calculation result is correct, the calculation result is received; if the calculation result is verified to be incorrect, the calculation result is discarded.
  • the full homomorphic message authentication method obtains a message authentication key
  • the message authentication key includes: a first string is a string of 0 and 1 of length n, And the number of 1 in the first character string is 2n/3, the second character string is a character string of 0 and 1 of length n, and characters at positions corresponding to 1 in the first character string include n/3 0, generating an authentication fingerprint corresponding to each bit of the data to be calculated according to the message authentication key, and the data to be calculated, the authentication fingerprint corresponding to each bit, the homomorphic encryption algorithm, and the message
  • the authentication key is sent to the server, so that the server calculates the calculation result of the data to be calculated and the authentication fingerprint corresponding to the calculation result, and returns the terminal to the terminal, and the terminal corrects the calculation result according to the received authentication fingerprint corresponding to the calculation result.
  • the character at the position corresponding to 1 in the first character string includes n/3 zeros, which solves the length of the set ⁇ 1, 2, ..., n-1, n ⁇ which is randomly generated in the prior art.
  • n/2 in the process of calculating the authentication fingerprint corresponding to each bit, the calculation process of the non-1 or 0 random number is complicated, and the complexity and the calculation amount of the terminal algorithm are effectively reduced.
  • FIG. 2 is a flowchart of Embodiment 2 of the method for authenticating a homomorphic message according to the present invention.
  • the message authentication key further includes a public key pk, a private key sk', and a calculation.
  • the key evk', the pre-configured secure hash function, and the pre-configured pseudo-random function, the authentication fingerprint corresponding to the ith bit is generated by the following steps:
  • S201 Generate a first component of the authentication fingerprint corresponding to the i-th bit according to a pre-configured pseudo-random function and a label of an i-th bit in the to-be-calculated data.
  • the data to be calculated has a total of t bits
  • the pre-configured pseudo-random function may be a single function (may also be a function family).
  • the pseudo-random function is f k
  • the first component of the bit's authentication fingerprint is v i
  • each bit in the data to be calculated has a specific label, and the label is an identifier of each bit, similar to a number, used to mark the bit in the data to be processed. s position.
  • S202 Generate, according to the pseudo random function, n pseudo random strings corresponding to an ith bit in the data to be calculated.
  • the n pseudo-random strings may It is represented by rand 1 , rand 2 , ..., rand n for use in the subsequent calculation of the second component of the authentication fingerprint of the i-th bit.
  • S203 Generate, according to the first character string, the second character string, and the n pseudo-random strings, n ciphertexts corresponding to the ith bit as the authentication fingerprint corresponding to the ith bit a two component, wherein if the j-th character in the first character string is 0, the ith bit, the public key, and the j-th pseudo-random string are input into a pre-configured encryption algorithm to generate a ciphertext; if the jth character in the first string is 1 and the jth character in the second string is 0, then 0, the public key, and the jth Pseudo-random string inputting the pre-configured encryption algorithm to generate a ciphertext; if the j-th character in the first string is 1 and the j-th character in the second string is 1, 1. The public key and the j-th pseudo-random string are input to the pre-configured encryption algorithm to generate a ciphertext.
  • the pre-configured encryption algorithm is an encryption algorithm (HE.Enc) in a fully homomorphic encryption algorithm, where i is an integer, greater than or equal to 1, and less than or equal to the total bits of the data to be calculated.
  • the number t; j is an integer greater than or equal to 1, and less than or equal to n.
  • c j HE.Enc(b i , pk, rand j ), wherein the i-th bit is represented by b i .
  • c j HE.Enc(b i , pk, rand j ) indicating that b i is in the pseudo
  • the authentication fingerprint corresponding to the i-th bit includes a second component of the authentication fingerprint of the i-th bit and a first component of the authentication fingerprint of the i-th bit.
  • the full homomorphic message authentication method obtains a message authentication key, and the message authentication key includes: the first character string is a string of 0 and 1 of length n, and the first string is in the first string.
  • the number of 1 is 2n/3
  • the second character string is a character string of 0 and 1 of length n
  • the character at the position corresponding to 1 in the first character string includes n/3 0s, according to
  • the message authentication key randomly inserts 2n/3 random ciphertexts of 0 and 1 in the second component of the authentication fingerprint corresponding to each bit, and Transmitting the data to be calculated, the authentication fingerprint corresponding to each bit, the homomorphic encryption algorithm, and the message authentication key to the server, so that the server calculates the calculation result of the data to be calculated and the authentication fingerprint corresponding to the calculation result.
  • the terminal performs correctness authentication on the calculation result according to the received authentication fingerprint corresponding to the calculation result, and selects the first character string of length n and the number of 1 is 2n/3 and the length is n. And with the first string
  • the character at the corresponding position of 1 includes n/3 zero second strings, which solves the problem that the first character string in the prior art is randomly generated set ⁇ 1, 2, ..., n-1, n ⁇
  • the calculation process of the non-1 or 0 random number is complicated, effectively reducing the complexity and calculation amount of the terminal algorithm, and improving the calculation result. Verify efficiency.
  • Embodiment 3 is a flowchart of Embodiment 3 of the method for authenticating a homomorphic message according to the present invention. As shown in FIG. 3, based on the foregoing Embodiment 1 and Embodiment 2, the specific implementation steps of S104 are:
  • the terminal receives the calculation result returned by the server and corresponds to the calculation result.
  • the authentication fingerprint first needs to obtain the first component of the authentication fingerprint corresponding to the recalculated calculation result for the first component of the corresponding authentication fingerprint that verifies the calculation result.
  • the specific acquisition methods are as follows:
  • the terminal pre-configures a calculation function for calculating the data to be calculated, and the terminal adopts the first component of the t authentication fingerprints corresponding to the t bits of the acquired data to be calculated.
  • the calculation function for calculating the data to be calculated is a hash tree, and the hash tree includes: t inputs, 1 output, and each node in the hash tree is pre-configured security. Hash function.
  • the terminal does not configure a calculation function for calculating data to be calculated, introduces a third-party device for calculation, and configures a calculation function for calculating data to be calculated on the third-party device, and the terminal will
  • the first component of the t authentication fingerprints corresponding to the t bits of the data to be calculated is sent to the third party device, so that the third party device corresponds to the t bits of the received data to be calculated.
  • the first component of the authentication fingerprint is obtained by using a pre-configured calculation function for calculating data to be calculated, acquiring a first component of the recalculated authentication fingerprint corresponding to the calculation result, and receiving the third party device to return The recalculated first result component of the authentication fingerprint corresponding to the calculation result; wherein the calculation function for calculating data to be calculated is a hash tree, and the hash tree includes: t inputs, 1 Outputs, and each node in the hash tree is the secure hash function.
  • the third-party device is a semi-trusted third party (for example, the health authority), the user equipment does not need to know the calculation function for calculating the data to be calculated, and the third-party device does not know the data to be calculated by the terminal, and the guarantee is ensured.
  • the third-party device privacy is ensured.
  • the method for authenticating a homomorphic message obtains a message authentication key,
  • the message authentication key includes: the first character string is a string of 0 and 1 of length n, and the number of 1 in the first string is 2n/3, and the second string is 0 and 1 of length n.
  • the character at a position corresponding to 1 in the first character string includes n/3 zeros, in the process of generating an authentication fingerprint corresponding to each bit of the data to be calculated according to the message authentication key 2n/3 random ciphertexts of 0 and 1 are randomly inserted into the second component of the authentication fingerprint corresponding to each bit, and the data to be calculated, the authentication fingerprint corresponding to each bit, the homomorphic encryption algorithm, and
  • the message authentication key is sent to the server, so that the server calculates the calculation result of the data to be calculated and the authentication fingerprint corresponding to the calculation result, and returns the terminal to the terminal, and the terminal calculates the authentication fingerprint corresponding to the received calculation result.
  • the recalculated authentication fingerprint corresponding to the calculation result is obtained, so as to verify the correctness of the calculation result.
  • the terminal has configured a calculation function for calculating the data to be calculated
  • the terminal calculates by itself. Taking the first component of the authentication fingerprint corresponding to the calculation result, if the calculation function for calculating the data to be calculated is not configured on the terminal, the calculation result is sent to the third-party device, so that the third-party device performs calculation and returns to the The first component of the authentication fingerprint corresponding to the calculated calculation result is compared with the first component of the authentication fingerprint corresponding to the calculation result sent by the received server, and the correctness of the calculation result is verified, and if it is correct, further verification is performed, and the length is selected by n, and the first character string of which the number of 1 is 2n/3 and the length of n, and the character at the position corresponding to 1 in the first character string includes n/3 zeros of the second character string,
  • the prior art solves the problem that the first string is
  • the terminal does not know the inconvenience caused by the calculation function for calculating the data to be calculated, and protects the privacy of the terminal, effectively reduces the complexity and calculation amount of the terminal algorithm, and improves the verification efficiency of the calculation result.
  • Embodiment 4 is a flowchart of Embodiment 4 of the method for authenticating a homomorphic message according to the present invention.
  • the message authentication key further includes a private key. If the first component of the authentication fingerprint corresponding to the received calculation result is equal to the first component of the authentication fingerprint corresponding to the recalculated calculation result, the specific implementation of authenticating the calculation result is continued. The way is:
  • S401 Calculate, according to the private key, n plaintexts corresponding to the n second components of the authentication fingerprint corresponding to the received calculation result.
  • the terminal decrypts each second component of the authentication fingerprint corresponding to the calculation result sent by the received server according to the private key, and obtains n corresponding plaintexts for comparison with the calculation result. .
  • the calculation result sent by the server is e
  • the authentication fingerprint corresponding to the calculation result is The second component of the authentication fingerprint corresponding to the calculation result is Then calling the formula according to the private key sk' Decrypt to get the calculation Corresponding plaintext e j , get all plaintext e 1 ,..., e n .
  • the authentication can be performed as follows:
  • the j-th character in the first character string is 1, and the j-th character in the second character string is 1, it is determined whether the calculation result is equal to the j-th plaintext; if the verification exists If one of the plaintexts is not equal to the calculation result, it is determined that the calculation result is incorrect, the calculation result is discarded, and the correctness verification operation is ended.
  • the j-th character in the first character string is 1, and the j-th character in the second character string is 0, it is determined whether the calculation result is equal to the j-th plaintext; if the verification exists If one of the plaintexts is not equal to the calculation result, it is determined that the calculation result is incorrect, the calculation result is discarded, and the correctness verification operation is ended.
  • the above three steps are a specific operation mode for different characters in the first character string and the second character string in one verification process, and each time a plaintext is verified and the settlement result is the same, then j is incremented by 1, and continues according to the A string and a character of the second string are authenticated.
  • j is an integer, greater than or equal to 1, and less than or equal to n
  • n is a positive integer greater than or equal to 2, that is, the determined length of the first character string and the second character string.
  • the verification is performed according to the plaintext e 1 , . . . , e n obtained by the decryption calculation. If the calculation result e is not discarded during the entire verification process, the calculation is accepted. As a result, the terminal considers that the calculation result returned by the server is correct.
  • the full homomorphic message authentication method obtains a message authentication key, and the message authentication key includes: the first character string is a string of 0 and 1 of length n, and the first string is in the first string.
  • the number of 1 is 2n/3
  • the second character string is a character string of 0 and 1 of length n
  • the character at the position corresponding to 1 in the first character string includes n/3 0s, according to
  • the message authentication key randomly inserts 2n/3 random ciphertexts of 0 and 1 in the second component of the authentication fingerprint corresponding to each bit, and Transmitting the data to be calculated, the authentication fingerprint corresponding to each bit, the homomorphic encryption algorithm, and the message authentication key to the server, so that the server calculates the calculation result of the data to be calculated and the authentication fingerprint corresponding to the calculation result.
  • the terminal obtains the re-calculated authentication fingerprint corresponding to the calculation result according to the received authentication fingerprint corresponding to the calculation result, so as to perform correctness verification on the calculation result, if the terminal has The calculation function for calculating the data to be calculated is configured, and the first component of the authentication fingerprint corresponding to the calculation result is obtained by the terminal itself, and if the calculation function for calculating the data to be calculated is not configured on the terminal,
  • the calculation result is sent to the third-party device, so that the third-party device performs calculation and returns the first component of the authentication fingerprint corresponding to the recalculated calculation result, and compares with the first component of the authentication fingerprint corresponding to the calculation result sent by the received server, Verify the correctness of the calculation result.
  • first character string of length n and 1 number of 2n/3 and a length of n
  • characters at positions corresponding to 1 in the first character string include n/3 0's
  • the second string solves the subset of the prior art in which the first string is a randomly generated set ⁇ 1, 2, ..., n-1, n ⁇ of length n/2, and the authentication corresponding to each bit is calculated.
  • the terminal does not know the calculation function for calculating the data to be calculated. The inconvenience is caused, and the privacy of the terminal is protected.
  • n decryption calculations are required, compared to each of the prior art.
  • the bit must be re-executed n/2 times, and a total of t*(n/2) operations are required to recalculate the second component of the authentication fingerprint corresponding to the calculation result, which effectively reduces the complexity of the algorithm during terminal verification. Calculate the amount and improve the verification efficiency of the calculation results.
  • FIG. 5 is a flowchart of Embodiment 5 of the method for authenticating a homomorphic message according to the present invention. As shown in FIG. 5, this embodiment provides a technical solution for a server-side fully homomorphic message authentication method. The specific steps are as follows:
  • S501 Receive a calculation request sent by the terminal, where the calculation request includes: data to be calculated, an authentication fingerprint corresponding to each bit in the data to be calculated, a homomorphic encryption algorithm, and a message authentication key.
  • S502 Calculate a calculation result of the data to be calculated according to a pre-configured calculation function for calculating data to be calculated and the data to be calculated.
  • the calculation function for calculating the data to be calculated is pre-configured in the server to calculate the calculation result of the data to be calculated sent by the terminal, and the server does not need to return the original data to be calculated to the terminal. Only the corresponding authentication fingerprint is added to the calculation result, so that the terminal verifies the calculation result according to the authentication fingerprint corresponding to the calculation result, and obtains the correct calculation result without having to know the original data to be calculated.
  • the method for authenticating the homomorphic message provided by the embodiment, by receiving the calculation request sent by the terminal, including the message authentication key, the server calculates the calculation result of the data to be calculated according to the pre-configured calculation function for calculating the data to be calculated. And acquiring, according to the message authentication key, the calculation result, and the authentication fingerprint corresponding to each bit of the data to be calculated, the authentication fingerprint corresponding to the calculation result, and returning to the terminal, so that the terminal corresponds to the received calculation result.
  • the authentication fingerprint corrects the calculation result, and solves the problem that the first character string of the message authentication key generated by the terminal in the prior art is a randomly generated set ⁇ 1, 2, ..., The length of n-1,n ⁇ is a subset of n/2.
  • the calculation process of the non-1 or 0 random number is complicated, and the calculation in the terminal verification process is effectively reduced. Quantity, improve the verification efficiency of the terminal's calculation results on the server. .
  • FIG. 6 is a flowchart of Embodiment 6 of the method for authenticating a homomorphic message according to the present invention. As shown in FIG. 6, on the basis of the foregoing embodiment, the specific implementation steps of S502 and S503 are:
  • S601 Acquire the calculation result of the data to be calculated by using the pre-configured calculation function for calculating data to be calculated according to the t bits of the data to be calculated.
  • the calculation result of the data to be calculated is first acquired.
  • the calculation function for calculating data to be calculated is a hash tree, the hash tree includes: t inputs, 1 output, and each node in the hash tree is a pre-configured secure hash The function; t is the total number of bits of the data to be calculated.
  • S602 The first component of the t authentication fingerprints corresponding to the t bits of the data to be calculated is used, and the pre-configured calculation function for calculating data to be calculated is used to obtain the corresponding calculation result.
  • the first component of the authentication fingerprint is used, and the pre-configured calculation function for calculating data to be calculated is used to obtain the corresponding calculation result.
  • the authentication fingerprint corresponding to each bit in the data to be calculated includes a first component and a second component, and then there are a total of t corresponding to the t bits of the data to be calculated.
  • S603 Calculate the ciphertext in the pre-configured fully homomorphic encryption algorithm according to the calculation result, the n second components of the authentication fingerprint corresponding to each bit of the data to be calculated, and the calculation key. a function of acquiring n second components of the authentication fingerprint corresponding to the calculation result.
  • the authentication fingerprint corresponding to the calculation result includes a first component of the authentication fingerprint corresponding to the calculation result and n second components of the authentication fingerprint corresponding to the calculation result, and the server calculates and obtains the to-be-calculated
  • the calculation result of the data and the authentication fingerprint corresponding to the calculation result are sent to the terminal, so that the terminal verifies the correctness of the calculation result according to the authentication fingerprint corresponding to the calculation result, and obtains the correct calculation result.
  • the full homomorphic message authentication method receives the calculation request sent by the terminal, wherein the message authentication key includes the calculation key, and the server calculates the data to be calculated according to the pre-configured calculation function for calculating the data to be calculated. Calculation result, and according to the message authentication key, the calculation result, and the authentication fingerprint meter corresponding to each bit of the data to be calculated Calculating the first component and the second component of the authentication fingerprint corresponding to the calculation result, and returning to the terminal, so that the terminal performs correctness verification on the calculation result according to the received authentication fingerprint corresponding to the calculation result, and the current solution is solved.
  • the first character string of the message authentication key generated by the terminal in the technology is a subset of the randomly generated set ⁇ 1, 2, ..., n-1, n ⁇ having a length of n/2, in which each bit corresponding to each bit is calculated.
  • the problem of complicated calculation process of random numbers other than 1 or 0 effectively reduces the calculation amount in the terminal verification process and improves the verification efficiency of the terminal to the calculation result of the server. .
  • FIG. 7 is a schematic diagram of an example of a calculation function for calculating data to be calculated in the present invention.
  • a calculation function for calculating data to be calculated is shown in FIG.
  • the hash tree includes: t inputs, 1 output, and each node in the hash tree is a pre-configured secure hash function, and the calculation function is specifically illustrated below. application.
  • the calculation function used to calculate the data to be calculated can be represented by g:
  • g can be expressed as ⁇ 0,1 ⁇ t ⁇ 0,1 ⁇ , which is a circuit
  • the safe hash function H is ⁇ 0,1 ⁇ * ⁇ 0,1 ⁇ m hash tree g H Expressed as ⁇ 0,1 ⁇ * ⁇ t ⁇ 0,1 ⁇ m , as shown in Figure 7, the total bit number of the data to be calculated is 6, each node is a safe hash function H, which can be an additive gate Or the multiplication gate circuit, when the server obtains the calculation result of the data to be calculated, each bit of the data to be calculated is respectively input to a different input line, and the final output result obtained is the calculation result e.
  • the input of the input line is respectively input as the input of the first component v i of the authentication fingerprint corresponding to each bit of the data to be calculated (i is greater than or equal to 1, less than or equal to 6)
  • the final output is the first component of the authentication fingerprint corresponding to the calculation result.
  • FIG. 8 is a schematic structural diagram of Embodiment 1 of a full homomorphic message authentication apparatus according to the present invention.
  • the fully homomorphic message authentication apparatus 80 includes: an obtaining module 81, configured to acquire a message authentication key, where the message authentication key includes a public key, a first character string, and a second character string,
  • the first character string is a string of 0 and 1 of length n, and the number of characters in the first string is 1 n/3;
  • the second string is 0 and 1 of length n.
  • a character string, and in the second character string, a character at a position corresponding to a character of 1 in the first character string includes n/3 zeros, where n is an integer greater than or equal to 2;
  • a generating module 82 configured to generate, according to the first input character, the public key, and the pseudo-random string Determining, in the calculated data, one of the n ciphertexts corresponding to the ith bit, the n ciphertext being the second component of the authentication fingerprint corresponding to the ith bit, wherein, if the first string If the jth character is 0, the first input character is the ith bit, or if the jth character in the first string is 1 and the second string is If the jth character is 0, the first input character is 0, or if the jth character in the first string is 1 and the jth character in the second string is The first input character is 1; the authentication fingerprint corresponding to the ith bit further includes a first component; wherein i is an integer, greater than or equal to 1, and less than or equal to the data to be calculated.
  • the total number of bits t, t is greater than or equal to 1; j is an integer, greater than or equal to 1, and less than or equal to n;
  • the transceiver module 83 is configured to send a calculation request to the server, where the calculation request includes: the data to be calculated, an authentication fingerprint corresponding to each bit in the data to be calculated, a pre-configured full homomorphic encryption algorithm, and The message authentication key;
  • the transceiver module 83 is further configured to receive a calculation result of the data to be calculated returned by the server, and an authentication fingerprint corresponding to the calculation result;
  • the processing module 84 is configured to perform correctness authentication on the calculation result according to the authentication fingerprint corresponding to the calculation result received by the transceiver module.
  • the full homomorphic message authentication apparatus obtains a message authentication key by using an obtaining module, where the message authentication key includes: the first character string is a string of 0 and 1 of length n, and the first character is The number of 1s in the string is 2n/3, the second character string is a character string of 0 and 1 of length n, and the character at the position corresponding to 1 in the first character string includes n/3 zeros.
  • the generating module generates an authentication fingerprint corresponding to each bit of the data to be calculated according to the message authentication key, and the transceiver module calculates the data to be calculated, the authentication fingerprint corresponding to each bit, the homomorphic encryption algorithm, and the message authentication key.
  • the server sending to the server, so that the server calculates the calculation result of the data to be calculated and the authentication fingerprint corresponding to the calculation result, and returns the terminal to the terminal, and the processing module performs correctness verification on the calculation result according to the received authentication fingerprint corresponding to the calculation result.
  • the character at the position corresponding to 1 in the first character string includes n/3 zeros, which solves the problem that the first character string in the prior art is a randomly generated set ⁇ 1, 2, ..., n-1, n ⁇ A subset of length n/2, for non-1 or 0 in the process of calculating the authentication fingerprint corresponding to each bit
  • the complexity of the machine number calculation process effectively reduces the complexity and computational complexity of the terminal algorithm.
  • the generating module 82 is specifically configured to:
  • processing module 84 is specifically configured to:
  • the processing module 84 is further configured to: use, according to the obtained first components of the t authentication fingerprints corresponding to t bits of the to-be-calculated data, to calculate data to be calculated. Calculating a function, obtaining a first component of the authentication fingerprint corresponding to the recalculated calculation result;
  • the calculation function for calculating the data to be calculated is a hash tree, and the hash tree includes: t inputs, 1 output, and each node in the hash tree is pre-configured security. what Greek function.
  • the transceiver module 83 is further configured to:
  • a first component of the authentication fingerprint is obtained by using a pre-configured calculation function for calculating data to be calculated, and acquiring a first component of the re-calculated authentication fingerprint corresponding to the calculation result;
  • the calculation function for calculating data to be calculated is a hash tree, and the hash tree includes: t inputs, 1 output, and each node in the hash tree is the security Greek function.
  • the message authentication key further includes a private key
  • the processing module 84 is further configured to:
  • the full-synchronous message authentication apparatus provided in this embodiment is used to perform the technical solution of the method embodiment shown in FIG. 1-7, and the implementation principle and technical effects are similar, and details are not described herein.
  • FIG. 9 is a schematic structural diagram of Embodiment 3 of a full homomorphic message authentication apparatus according to the present invention.
  • the fully homomorphic message authentication apparatus 90 includes: a transceiver module 91, configured to receive a calculation request sent by a terminal, where the calculation request includes: data to be calculated, each of the data to be calculated The authentication fingerprint corresponding to the bit, the homomorphic encryption algorithm, and the message authentication key;
  • the processing module 92 is configured to calculate a calculation result of the data to be calculated according to a pre-configured calculation function for calculating data to be calculated and the data to be calculated;
  • the processing module 92 is further configured to: according to the pre-configured calculation function for calculating data to be calculated, the calculation result of the data to be calculated, and the authentication fingerprint corresponding to each bit in the data to be calculated And the pre-configured fully homomorphic encryption algorithm and the message authentication key, and the authentication fingerprint corresponding to the calculation result is calculated;
  • the transceiver module 91 is further configured to return the calculation result of the data to be calculated and the authentication fingerprint corresponding to the calculation result to the terminal, so that the terminal calculates according to the received As a result, the corresponding authentication fingerprint performs correctness verification on the calculation result.
  • the full homomorphic message authentication apparatus provided in this embodiment is configured to perform the technical solution of the method embodiment shown in FIG. 1-7, and the receiving module receives the calculation request sent by the terminal, where the calculation request includes: data to be calculated, message authentication.
  • a processing module calculates a calculation result of the data to be calculated according to a pre-configured calculation function for calculating data to be calculated, and according to the message authentication key, the calculation result, and each bit of the data to be calculated
  • the authentication fingerprint corresponding to the calculation result is obtained by the corresponding authentication fingerprint, and is returned to the terminal, so that the terminal corrects the calculation result according to the authentication fingerprint corresponding to the received calculation result, and solves the problem in the prior art.
  • a string is a subset of a randomly generated set ⁇ 1, 2, ..., n-1, n ⁇ of length n/2, which is random for non-1 or 0 in the process of calculating the authentication fingerprint corresponding to each bit.
  • the complexity of the number calculation process effectively reduces the complexity and computational complexity of the terminal algorithm.
  • the processing module 92 is specifically configured to:
  • the pre-configured computing function for calculating data to be calculated is a hash tree, the hash tree includes: t inputs, 1 output, and each node in the hash tree is pre- a configured secure hash function; t is the total number of bits of the data to be calculated.
  • the authentication fingerprint corresponding to each bit of the data to be calculated includes a first component and n second components
  • the message authentication key includes a calculation key
  • the processing module 92 is further configured to:
  • the n second components of the authentication fingerprint corresponding to each bit of the data to be calculated, and the calculation key Obtaining n second components of the authentication fingerprint corresponding to the calculation result.
  • the authentication fingerprint corresponding to the calculation result includes the first component of the authentication fingerprint corresponding to the calculation result and the second component of the authentication fingerprint corresponding to the calculation result.
  • the full homomorphic message authentication apparatus provided in this embodiment is used to execute the method shown in FIG. 1-7.
  • the technical solution of the embodiment has similar implementation principles and technical effects, and will not be described herein.
  • the terminal 100 includes a processor 101, a transmitter 102, and a receiver 103.
  • the processor 101 is configured to acquire a message authentication key.
  • the message authentication key includes: a first character string and a second character string, the first character string is a string of 0 and 1 of length n, and the number of 1 in the first string is 2n/3; the second character string is a character string of 0 and 1 of length n, and in the second character string, a character at a position corresponding to 1 in the first character string includes n /3 0; n is an integer greater than or equal to 2:
  • the processor 101 is further configured to separately generate an authentication fingerprint corresponding to each bit in the data to be calculated according to the message authentication key;
  • the sender 102 is configured to send a calculation request to the server, where the calculation request includes: the data to be calculated, an authentication fingerprint corresponding to each bit in the data to be calculated, a pre-configured fully homomorphic encryption algorithm, and a Message authentication key;
  • the receiver 103 is configured to receive a calculation result of the data to be calculated returned by the server, and an authentication fingerprint corresponding to the calculation result;
  • the processor 101 is further configured to perform correctness authentication on the calculation result according to the received authentication fingerprint corresponding to the calculation result.
  • the terminal provided by the embodiment obtains a message authentication key by using a processor, and the message authentication key includes: the first character string is a string of 0 and 1 of length n, and the terminal is The number of 1s in the first character string is 2n/3, the second character string is a character string of 0 and 1 of length n, and the character at a position corresponding to 1 in the first character string includes n/3 0, generating an authentication fingerprint corresponding to each bit of the data to be calculated according to the message authentication key, and the sender encrypts the data to be calculated, the authentication fingerprint corresponding to each bit, the homomorphic encryption algorithm, and the message authentication secret
  • the key is sent to the server, so that the server calculates the calculation result of the data to be calculated and the authentication fingerprint corresponding to the calculation result, and returns the terminal to the terminal, and the processor performs the calculation result according to the authentication fingerprint corresponding to the calculation result received by the receiver.
  • Correctness authentication by selecting the first character string of 0 and 1 of length n, and the number of 1s in the first string is 2n/3, and the second string of 0 and 1 of length n, And in the second string, The character at the position corresponding to 1 in the first character string includes n/3 zeros, and the second component of the authentication fingerprint of each bit of the acquired data to be calculated is inserted into n2/3 0 and 1 secrets.
  • the first string of the prior art is a subset of the randomly generated set ⁇ 1, 2, . . . , n-1, n ⁇ having a length of n/2, and the authentication fingerprint corresponding to each bit is calculated. In the process, the problem of complicated calculation process for non-1 or 0 random numbers effectively reduces the complexity and computational complexity of the terminal algorithm.
  • the message authentication key further includes a public key
  • the processor 101 is specifically configured to:
  • processor 101 is specifically configured to:
  • processor 101
  • the calculation function for calculating the data to be calculated is a hash tree, and the hash tree includes: t inputs, 1 output, and each node in the hash tree is pre-configured security. Hash function.
  • the transmitter 102 is further configured to send the first component of the t authentication fingerprints corresponding to the t bits of the data to be calculated to a third-party device, so that the third-party device is configured according to the received
  • the first component of the t authentication fingerprints corresponding to the t bits of the data to be calculated is a pre-configured calculation function for calculating data to be calculated, and the recalculated authentication fingerprint corresponding to the calculation result is obtained.
  • the receiver 103 is further configured to receive a first component of the authentication fingerprint corresponding to the recalculated calculation result returned by the third-party device;
  • the calculation function for calculating data to be calculated is a hash tree, and the hash tree includes: t inputs, 1 output, and each node in the hash tree is the security Greek function.
  • the message authentication key further includes a private key
  • the processor 101 is further configured to:
  • the terminal provided in this embodiment is used to implement the technical solution of the embodiment shown in FIG. 1 to FIG. 7.
  • the implementation principle and technical effects are similar, and details are not described herein again.
  • FIG. 11 is a schematic structural diagram of a first embodiment of a server according to the present invention.
  • the server 110 includes: a receiver 111, a processor 112, and a transmitter 113.
  • the receiver 111 is configured to receive a calculation request sent by the terminal.
  • the calculation request includes: data to be calculated, an authentication fingerprint corresponding to each bit in the data to be calculated, a homomorphic encryption algorithm, and a message authentication key;
  • the processor 112 is configured to calculate a calculation result of the data to be calculated according to a pre-configured calculation function for calculating data to be calculated and the data to be calculated;
  • the processor 112 is further configured to calculate, according to the pre-configured data, data to be calculated a calculation function, a calculation result of the data to be calculated, an authentication fingerprint corresponding to each bit in the data to be calculated, the pre-configured full homomorphic encryption algorithm and the message authentication key, and calculating the The authentication fingerprint corresponding to the calculation result;
  • the transmitter 113 is configured to return the calculation result of the data to be calculated and the authentication fingerprint corresponding to the calculation result to the terminal, so that the terminal performs the calculation result according to the received authentication fingerprint corresponding to the calculation result. Correctness certification.
  • the server provided by the embodiment receives the calculation request sent by the terminal, including the message authentication key, and the processor calculates the calculation result of the data to be calculated according to the pre-configured calculation function for calculating the data to be calculated, And obtaining, according to the message authentication key, the calculation result, and the authentication fingerprint corresponding to each bit of the data to be calculated, the authentication fingerprint corresponding to the calculation result, and returning the terminal to the terminal through the transmitter, so that the terminal calculates the received As a result, the corresponding authentication fingerprint performs correctness authentication on the calculation result, and selects the first character string of length n and the number of 1 is 2n/3 and the length is n, and is in the first character string.
  • the character at the corresponding position includes n/3 zero second strings, which solves the problem that the length of the set ⁇ 1, 2, ..., n-1, n ⁇ generated by the first character string in the prior art is
  • the subset of n/2 in the process of calculating the authentication fingerprint corresponding to each bit, is complicated for the non-1 or 0 random number calculation process, and effectively reduces the complexity and calculation amount of the terminal algorithm.
  • the processor 112 is specifically configured to:
  • the pre-configured computing function for calculating data to be calculated is a hash tree, the hash tree includes: t inputs, 1 output, and each node in the hash tree is pre- a configured secure hash function; t is the total number of bits of the data to be calculated.
  • the authentication fingerprint corresponding to each bit in the data to be calculated includes a first component and n second components
  • the message authentication key includes a calculation key
  • the processor 112 is specifically configured to:
  • the n second components of the authentication fingerprint corresponding to each bit of the data to be calculated, and the calculation key Obtaining n second components of the authentication fingerprint corresponding to the calculation result.
  • the server provided in this embodiment is used to perform the technical solution of the method embodiment shown in FIG. 1-7, and the implementation principle and technical effects are similar, and details are not described herein again.
  • the processor 101 and the processor 112 may be a central processing unit (Central). Processing Unit (CPU), can also be other general-purpose processors, Digital Signal Processor (DSP), Application Specific Integrated Circuit (ASIC), Field-Programmable Gate Array (Field-Programmable) Gate Array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • the general purpose processor may be a microprocessor or the processor or any conventional processor or the like.
  • the steps of the terminal and the server to implement the method embodiment shown in FIG. 1-7 can be completed by the integrated logic circuit of the hardware in the processor or the instruction in the form of software.
  • the steps of the method disclosed in the embodiments of the present invention may be directly implemented as a hardware processor, or may be performed by a combination of hardware and software modules in the processor.
  • the software module can be located in a conventional storage medium such as random access memory, flash memory, read only memory, programmable read only memory or electrically erasable programmable memory, registers, and the like.
  • the various embodiments in the specification are described in a progressive manner, and the same or similar parts between the various embodiments may be referred to each other, and each embodiment focuses on the differences from the other embodiments.
  • the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment.
  • the device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, ie may be located A place, or it can be distributed to multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the embodiment. Those of ordinary skill in the art can understand and implement without any creative effort.
  • the present invention can be implemented by means of software plus necessary general hardware, and of course, through dedicated hardware. It includes an application specific integrated circuit, a dedicated CPU, a dedicated memory, special components, and the like. In general, functions performed by computer programs can be easily implemented with the corresponding hardware, and the specific hardware structure used to implement the same function can be various, such as analog circuits, digital circuits, or dedicated circuits. Circuits, etc. However, for the purposes of the present invention, software program implementation is a better implementation in more cases.
  • the technical solution of the present invention which is essential or contributes to the prior art, can be embodied in the form of a software product stored in a readable storage medium, such as a floppy disk of a computer.
  • a readable storage medium such as a floppy disk of a computer.
  • U disk mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., including a number of instructions to make a computer device (may be A personal computer, server, or network device, etc.) performs the methods described in various embodiments of the present invention.
  • the full-synchronous message authentication system 120 includes a terminal 121 and a server 122, where
  • the terminal 121 is configured to acquire a message authentication key, where the message authentication key includes: a first character string and a second character string, where the first character string is a string of 0 and 1 of length n, and The number of 1 in the first string is 2n/3; the second string is a string of 0 and 1 of length n, and in the second string, the first string
  • the character at the position corresponding to 1 includes n/3 0's; n is an integer greater than or equal to 2; the ith bit in the data to be calculated is generated according to the first input character, the public key, and the pseudo-random string Determining, by one of the n ciphertexts, the n ciphertexts as a second component of the authentication fingerprint corresponding to the ith bit, wherein, if the jth character in the first string is 0, The first input character is the i-th bit, or, if the j-th character in the first string is 1 and the j-th character in the second string is 0, then The
  • the server 122 is configured to: receive a calculation request sent by the terminal; calculate a calculation result of the data to be calculated according to a pre-configured calculation function for calculating data to be calculated and the data to be calculated; a pre-configured full-homomorphic encryption algorithm for calculating a calculation function of the data to be calculated, a calculation result of the data to be calculated, and an authentication fingerprint corresponding to each bit in the data to be calculated And the message authentication key, the authentication fingerprint corresponding to the calculation result is calculated; the calculation result of the data to be calculated and the authentication fingerprint corresponding to the calculation result are returned to the terminal, so that the terminal receives the The authentication fingerprint corresponding to the calculation result performs correctness verification on the calculation result.
  • the full homomorphic message authentication system obtains a message authentication key through the terminal, and the message authentication key includes: the first string is a string of 0 and 1 of length n. And the number of 1 in the first character string is 2n/3, the second character string is a character string of 0 and 1 of length n, and a character at a position corresponding to 1 in the first character string And including n/3 zeros, generating an authentication fingerprint corresponding to each bit of the data to be calculated according to the message authentication key, and the data to be calculated, the authentication fingerprint corresponding to each bit, the homomorphic encryption algorithm, and the The message authentication key is sent to the server, so that the server calculates the calculation result of the data to be calculated and the authentication fingerprint corresponding to the calculation result, and returns the terminal to the terminal, according to the authentication fingerprint corresponding to the calculation result received by the receiver.
  • the character at the position corresponding to 1 in the first character string includes n/3 0s, and the second component of the authentication fingerprint of each bit of the acquired data to be calculated is inserted into n2/3 0s and 1s.
  • the ciphertext solves the prior art that the first character string is a randomly generated subset of the set ⁇ 1, 2, ..., n-1, n ⁇ having a length of n/2, and the authentication fingerprint corresponding to each bit is calculated. In the process of the calculation of the random number calculation process of non-1 or 0, the complexity and calculation amount of the terminal algorithm are effectively reduced.
  • the terminal 121 is specifically configured to: generate, according to a pre-configured pseudo-random function and a label of an i-th bit in the to-be-calculated data, an authentication fingerprint corresponding to the i-th bit a first component; generating and the to-be-calculated according to the pseudo-random function n pseudo-random strings corresponding to the i-th bit in the data; generating n ciphertexts corresponding to the i-th bit according to the first character string, the second character string, and the n pseudo-random strings a second component of the authentication fingerprint corresponding to the i-th bit, wherein if the j-th character in the first character string is 0, the i-th bit, the public key, and the The j-th pseudo-random string input pre-configured encryption algorithm generates the ciphertext; if the j-th character in the first string is 1 and the j-th character in the second string is 0, And inputting the
  • the terminal 121 is further configured to: obtain a first component of the re-calculated authentication fingerprint corresponding to the calculation result; and compare the received first component of the authentication fingerprint corresponding to the calculation result with the Whether the first component of the authentication fingerprint corresponding to the calculation result is equal; if the first component of the authentication fingerprint corresponding to the received calculation result is the authentication fingerprint corresponding to the recalculated calculation result If the first components are equal, the correctness verification is continued on the calculation result; if the two are not equal, it is determined that the calculation result is incorrect.
  • the terminal 121 is specifically configured to: according to the first component of the t authentication fingerprints corresponding to the t bits of the data to be calculated, use a calculation function for calculating the data to be calculated, and obtain Recalculating the first component of the authentication fingerprint corresponding to the calculation result; or sending the first component of the t authentication fingerprints corresponding to the t bits of the data to be calculated to the third party device, so that the And acquiring, by the third-party device, a pre-configured calculation function for calculating data to be calculated according to the first component of the t authentication fingerprints corresponding to the received t bits of the data to be calculated, and acquiring the recalculated Calculating a first component of the authentication fingerprint corresponding to the result; receiving a first component of the authentication fingerprint corresponding to the recalculated calculation result returned by the third-party device; wherein the calculating the data to be calculated
  • the function is a hash tree, the hash tree includes: t inputs, 1 output, and each node in the hash tree is the secure
  • the terminal 121 is further configured to: respectively calculate, according to the private key, n plaintexts corresponding to the n second components of the authentication fingerprint corresponding to the received calculation result; If all the n plaintexts are the same as the calculation result, it is determined that the calculation result is correct.
  • the server 122 is configured to: obtain, according to the t bits of the data to be calculated, a pre-configured calculation function for calculating data to be calculated, and obtain calculation of the data to be calculated. a result; wherein the pre-configured calculation function for calculating data to be calculated is a hash tree, the hash tree includes: t inputs, 1 output, and each node in the hash tree Is a pre-configured secure hash function; t is the total number of bits of the data to be calculated.
  • the server 122 is further configured to: use the pre-configured data for calculating data to be calculated according to the first components of the t authentication fingerprints corresponding to the t bits of the data to be calculated. Calculating a function, acquiring a first component of the authentication fingerprint corresponding to the calculation result;
  • the n second components of the authentication fingerprint corresponding to each bit of the data to be calculated, and the calculation key Obtaining n second components of the authentication fingerprint corresponding to the calculation result.
  • the device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical. Units can be located in one place or distributed to multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • the connection relationship between the modules indicates that there is a communication connection between them, and specifically, one or more communication buses or signal lines can be realized.
  • a readable storage medium such as a computer floppy disk, a USB flash drive, a removable hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or a compact disk.
  • ROM read-only memory
  • RAM random access memory
  • a number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform the methods described in various embodiments of the present invention.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • Health & Medical Sciences (AREA)
  • Biomedical Technology (AREA)
  • General Health & Medical Sciences (AREA)
  • Biodiversity & Conservation Biology (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Power Engineering (AREA)
  • Collating Specific Patterns (AREA)
  • Measurement Of The Respiration, Hearing Ability, Form, And Blood Characteristics Of Living Organisms (AREA)

Abstract

本发明实施例提供一种全同态消息认证方法、装置及系统，包括：获取消息认证密钥，消息认证密钥包括公钥、第一字符串和第二字符串，第一字符串为长度为n的0和1的字符串，且第一字符串中字符为1的个数为2n/3；第二字符串为长度为n的0和1的字符串，且在第二字符串中，与第一字符串中的为1的字符对应的位置上的字符包括n/3个0，并根据消息认证密钥生成待计算的数据中每个比特对应的认证指纹，向服务器发送计算请求，并接收服务器返回的待计算的数据的计算结果以及计算结果对应的认证指纹，并根据接收到的计算结果对应的认证指纹对计算结果进行正确性认证，有效降低验证过程中的计算量，提高对服务器的计算结果的验证效率。

Description

全同态消息认证方法、装置及系统 技术领域
本发明实施例涉及计算机信息技术领域，尤其涉及一种全同态消息认证方法、装置及系统。
背景技术
全同态加密算法包括一个产生公钥、私钥和计算钥的算法，一个加密算法，一个解密算法和一个密文计算函数，该全同态加密算法主要用于分布式计算的计算结果的认证，即全同态消息认证技术。
目前，全同态消息认证技术的具体实现方式为：终端获取消息认证密钥，该消息认证密钥包括根据上述全同态加密算法获取的公钥、私钥和计算钥，还包括：第一字符串和第二字符串，该第一字符串为随机产生的集合{1，2，…，n-1，n}的长度为n/2的子集，该第二字符串为一个长度为n的0和1组成的随机字符串，其中，n为大于或等于2的整数。终端根据该消息认证密钥上述全同态加密算法中的加密算法生成待计算的数据中每个比特的认证指纹，并将该待计算的数据、该认证指纹、该消息认证密钥以及前述全同态加密算法一起发送给服务器。服务器根据预先配置的用于计算待计算数据的计算函数计算该待计算的数据，获取计算结果；通过预先配置的哈希函数族计算该计算结果的认证指纹的第一分量，并对该消息认证密钥中的第一字符串的每个字符，根据该计算结果、待计算的数据中每个比特的认证指纹和上述计算钥，通过上述全同态加密算法中的密文计算函数进行计算，获取该计算结果的认证指纹的第二分量，最终获取完整的该计算结果的认证指纹，并将该计算结果和该计算结果的认证指纹返回给终端。终端首先根据预先配置的哈希函数族重新计算该计算结果的认证指纹的第一分量，以确认该重新计算的该计算结果的认证指纹的第一分量与服务器返回的认证指纹的第一分量相同；再进行进一步认证，针对待计算数据的第j个比特，终端第一字符串中的第i个字符，根据预先配置的伪随机函数生成伪随机串rand(i，j)；并将0和该rand(i，j)输入上述加密算法获取0在伪随机串rand(i，j)下的加密密文；并根据该加密密文、预 先配置的用于计算待计算数据的计算函数和上述计算钥，通过全同态加密算法中的密文计算函数进行计算，获取该计算结果的认证指纹的第i个第二分量，根据上述方法进行n/2此次计算，获取该计算结果的认证指纹的全部第二分量，然后比较服务器发送来的该计算结果的认证指纹的第二分量与终端获取的该计算结果的认证指纹的第二分量是否相同。若服务器发送来的该计算结果的认证指纹与终端重新计算的该计算结果的认证指纹相同，则确定该计算结果正确。针对待计算数据的每一个比特，都按照上述方法进行计算结果的验证。
但是，由于消息认证密钥中的第一字符串是由长度为n/2的{1，2，…，n-1，n}的子集组成的，因此，在计算待计算数据的每个比特的认证指纹时，计算复杂，且在终端认证服务器返回的计算结果时，需要重新计算计算结果，并需要对待计算数据的每个比特进行n/2次计算，才能获取计算结果对应的认证指纹的第二分量，以与第二认证指纹的第二分量进行对比认证，使得计算量较大，验证效率低。
发明内容
本发明实施例提供一种全同态消息认证方法、装置及系统，有效降低验证过程中的计算量，提高对服务器的计算结果的验证效率。
本发明第一方面提供一种全同态消息认证算法，所述方法应用于终端，包括：
获取消息认证密钥，所述消息认证密钥包括公钥、第一字符串和第二字符串，所述第一字符串为长度为n的0和1的字符串，且所述第一字符串中字符为1的个数为2n/3；所述第二字符串为长度为n的0和1的字符串，且在所述第二字符串中，与所述第一字符串中的为1的字符对应的位置上的字符包括n/3个0，其中，n为大于或等于2的整数；
根据第一输入字符、所述公钥和伪随机串生成待计算的数据中的第i个比特对应的n个密文中的一个，确定所述n个密文为所述第i个比特对应的认证指纹的第二分量，其中，若所述第一字符串中的第j个字符为0，则所述第一输入字符为所述第i个比特，或者，若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为0，则所述第一 输入字符为0，或者，若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为1，则所述第一输入字符为1；所述第i个比特对应的认证指纹还包括第一分量；其中，i为整数，大于或等于1，且小于或等于所述待计算的数据的总比特数t，t大于或等于1；j为整数，大于或等于1，且小于或等于n；
向服务器发送计算请求，所述计算请求包括：所述待计算的数据，所述待计算的数据中的每个比特对应的所述认证指纹、预先配置的全同态加密算法、以及所述消息认证密钥；
接收所述服务器返回的所述待计算的数据的计算结果以及所述计算结果对应的认证指纹，并根据接收到的所述计算结果对应的认证指纹对所述计算结果进行正确性认证。
结合第一方面，在第一方面的第一种可能的实施方式中，所述所述第i个比特对应的认证指纹由以下步骤生成，包括：
根据预先配置的伪随机函数和所述待计算的数据中的第i个比特的标签生成所述第i个比特对应的认证指纹的第一分量；
根据所述伪随机函数生成与所述待计算的数据中的第i个比特对应的n个伪随机串；
根据所述第一字符串、所述第二字符串和所述n个伪随机串生成所述第i个比特对应的n个密文作为所述第i个比特对应的认证指纹的第二分量，其中，若所述第一字符串中的第j个字符为0，则将所述第i个比特、所述公钥和所述第j个伪随机串输入预先配置的加密算法生成一个密文；若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为0，则将0、所述公钥和所述第j个伪随机串输入所述预先配置的加密算法生成一个密文；若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为1，则将1、所述公钥和所述第j个伪随机串输入所述预先配置的加密算法生成一个密文。
结合第一方面或第一方面的第一种可能的实施方式，在第一方面的第二种可能的实施方式中，根据接收到的所述计算结果对应的认证指纹对所述计算结果进行正确性认证，包括：
获取重新计算的所述计算结果对应的认证指纹的第一分量；
比较所述接收到的所述计算结果对应的认证指纹的第一分量与所述重新计算的所述计算结果对应的认证指纹的第一分量是否相等；
若所述接收到的所述计算结果对应的认证指纹的第一分量与所述重新计算的所述计算结果对应的认证指纹的第一分量相等，则继续对所述计算结果进行正确性认证；若二者不相等，则确定所述计算结果不正确。
结合第一方面的第二种可能的实施方式，在第一方面的第三种可能的实施方式中，所述获取重新计算的所述计算结果对应的认证指纹的第一分量，包括：
根据所述待计算的数据的t个比特对应的t个所述认证指纹的第一分量，采用用于计算所述待计算的数据的计算函数，获取重新计算的所述计算结果对应的认证指纹的第一分量；
其中，所述用于计算待计算的数据的计算函数为哈希树，所述哈希树包括：t个输入，1个输出，且所述哈希树中的各个节点均为预先配置的安全哈希函数。
结合第一方面的第二种可能的实施方式，在第一方面的第四种可能的实施方式中，所述获取重新计算所述计算结果对应的认证指纹的第一分量，包括：
将所述待计算数据的t个比特对应的t个所述认证指纹的第一分量发送给第三方设备，以使所述第三方设备根据接收的所述待计算的数据的t个比特对应的t个所述认证指纹的第一分量，采用预先配置的用于计算待计算的数据的计算函数，获取重新计算的所述计算结果对应的认证指纹的第一分量；
接收所述第三方设备返回的所述重新计算的所述计算结果对应的认证指纹的第一分量；
其中，所述用于计算待计算的数据的计算函数为哈希树，所述哈希树包括：t个输入，1个输出，且所述哈希树中的各个节点均为所述安全哈希函数。
结合第一方面的第二至第四种中的任一种可能的实施方式，在第一方面的第五种可能的实施方式中，所述消息认证密钥还包括私钥，所述接收到的所述计算结果对应的认证指纹的第一分量与所述重新计算的所述计算结果对应的认证指纹的第一分量相等，则继续对所述计算结果进 行正确性认证，包括：
根据所述私钥，分别计算所述接收到的所述计算结果对应的认证指纹的n个第二分量对应的n个明文；
若所述n个明文全部与所述计算结果相同，则确定所述计算结果正确。
本发明第二方面提供一种全同态消息认证方法，所述方法应用于服务器，包括：
接收终端发送的计算请求，所述计算请求包括：待计算的数据，所述待计算的数据中的每个比特对应的认证指纹、全同态加密算法、以及消息认证密钥；
根据预先配置的用于计算待计算的数据的计算函数以及所述待计算的数据，计算所述待计算的数据的计算结果；
根据所述预先配置的用于计算待计算的数据的计算函数、所述待计算的数据的计算结果、所述待计算的数据中的每个比特对应的认证指纹，所述预先配置的全同态加密算法以及所述消息认证密钥，计算所述计算结果对应的认证指纹；
将所述待计算的数据的计算结果以及所述计算结果对应的认证指纹返回终端，以供所述终端根据接收到的所述计算结果对应的认证指纹对所述计算结果进行正确性认证。
结合第二方面，在第二方面的第一种可能的实施方式中，所述根据预先配置的用于计算待计算的数据的计算函数以及所述待计算的数据，计算所述待计算的数据的计算结果，包括：
根据所述待计算的数据的t个比特，采用所述预先配置的用于计算待计算的数据的计算函数，获取所述待计算的数据的计算结果；
其中，所述预先配置的用于计算待计算的数据的计算函数为哈希树，所述哈希树包括：t个输入，1个输出，且所述哈希树中的各个节点均为预先配置的安全哈希函数；t为所述待计算的数据的总比特数。
结合第二方面的第一种可能的实施方式，在第二方面的第二种可能的实施方式中，所述待计算的数据中的每个比特对应的认证指纹包括第一分量和n个第二分量，且所述消息认证密钥还包括计算钥，则所述根据 所述预先配置的用于计算待计算的数据的计算函数、所述待计算的数据的计算结果、所述待计算的数据中的每个比特对应的认证指纹，所述预先配置的全同态加密算法以及所述消息认证密钥，计算所述计算结果对应的认证指纹，包括：
根据所述待计算的数据的t个比特对应的t个所述认证指纹的第一分量，采用所述预先配置的用于计算待计算的数据的计算函数，获取所述计算结果对应的认证指纹的第一分量；
根据所述计算结果、所述待计算的数据的每个比特对应的认证指纹的n个第二分量和所述计算钥，采用所述预先配置的全同态加密算法中的密文计算函数，获取所述计算结果对应的认证指纹的n个第二分量。
本发明实施例第三方面提供一种全同态消息认证装置，包括：
获取模块，用于获取消息认证密钥，所述消息认证密钥包括公钥、第一字符串和第二字符串，所述第一字符串为长度为n的0和1的字符串，且所述第一字符串中字符为1的个数为2n/3；所述第二字符串为长度为n的0和1的字符串，且在所述第二字符串中，与所述第一字符串中的为1的字符对应的位置上的字符包括n/3个0，其中，n为大于或等于2的整数；
生成模块，用于根据第一输入字符、所述公钥和伪随机串生成待计算的数据中的第i个比特对应的n个密文中的一个，确定所述n个密文为所述第i个比特对应的认证指纹的第二分量，其中，若所述第一字符串中的第j个字符为0，则所述第一输入字符为所述第i个比特，或者，若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为0，则所述第一输入字符为0，或者，若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为1，则所述第一输入字符为1；所述第i个比特对应的认证指纹还包括第一分量；其中，i为整数，大于或等于1，且小于或等于所述待计算的数据的总比特数t，t大于或等于1；j为整数，大于或等于1，且小于或等于n；
收发模块，用于向服务器发送计算请求，所述计算请求包括：所述待计算的数据，所述待计算的数据中的每个比特对应的所述认证指纹、预先配置的全同态加密算法、以及所述消息认证密钥；
所述收发模块还用于接收所述服务器返回的所述待计算的数据的计算结果以及所述计算结果对应的认证指纹；
处理模块，用于根据所述收发模块接收到的所述计算结果对应的认证指纹对所述计算结果进行正确性认证。
结合第三方面，在第三方面的第一种可能的实施方式中，所述消生成模块具体用于：
根据预先配置的伪随机函数和所述待计算的数据中的第i个比特的标签生成所述第i个比特对应的认证指纹的第一分量；
根据所述伪随机函数生成与所述待计算的数据中的第i个比特对应的n个伪随机串；
根据所述第一字符串、所述第二字符串和所述n个伪随机串生成所述第i个比特对应的n个密文作为所述第i个比特对应的认证指纹的第二分量，其中，若所述第一字符串中的第j个字符为0，则将所述第i个比特、所述公钥和所述第j个伪随机串输入预先配置的加密算法生成一个密文；若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为0，则将0、所述公钥和所述第j个伪随机串输入所述预先配置的加密算法生成一个密文；若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为1，则将1、所述公钥和所述第j个伪随机串输入所述预先配置的加密算法生成一个密文。
结合第三方面和第三方面的第一种可能的实施方式，在第三方面的第二种可能的实施方式中，所述处理模块具体用于：
获取重新计算的所述计算结果对应的认证指纹的第一分量；
比较所述接收到的所述计算结果对应的认证指纹的第一分量与所述重新计算的所述计算结果对应的认证指纹的第一分量是否相等；
若所述接收到的所述计算结果对应的认证指纹的第一分量与所述重新计算的所述计算结果对应的认证指纹的第一分量相等，则继续对所述计算结果进行正确性认证；若二者不相等，则确定所述计算结果不正确。
结合第三方面的第二种可能的实施方式，在第三方面的第三种可能的实施方式中，所述处理模块还用于根据获取的所述待计算的数据的t个 比特对应的t个所述认证指纹的第一分量，采用用于计算待计算的数据的计算函数，获取重新计算的所述计算结果对应的认证指纹的第一分量；
其中，所述用于计算待计算的数据的计算函数为哈希树，所述哈希树包括：t个输入，1个输出，且所述哈希树中的各个节点均为预先配置的安全哈希函数。
结合第三方面的第二种可能的实施方式，在第三方面的第四种可能的实施方式中所述收发模块还用于：
将所述待计算数据的t个比特对应的t个所述认证指纹的第一分量发送给第三方设备，以使所述第三方设备根据接收的所述待计算的数据的t个比特对应的t个所述认证指纹的第一分量，采用预先配置的用于计算待计算的数据的计算函数，获取重新计算的所述计算结果对应的认证指纹的第一分量；
接收所述第三方设备返回的所述重新计算的所述计算结果对应的认证指纹的第一分量；
其中，所述用于计算待计算的数据的计算函数为哈希树，所述哈希树包括：t个输入，1个输出，且所述哈希树中的各个节点均为所述安全哈希函数。
结合第三方面的第二至第四种中的任一种可能的实施方式，在第三方面的第五种可能的实施方式中，所述消息认证密钥还包括私钥，所述处理模块还用于：
根据所述私钥，分别计算所述接收到的所述计算结果对应的认证指纹的n个第二分量对应的n个明文；
判断若所述n个明文全部与所述计算结果相同，则确定所述计算结果正确。
本发明实施例第四方面提供一种全同态消息认证装置，包括：
收发模块，用于接收终端发送的计算请求，所述计算请求包括：待计算的数据，所述待计算的数据中的每个比特对应的认证指纹、全同态加密算法、以及消息认证密钥；
处理模块，用于根据预先配置的用于计算待计算的数据的计算函数以及所述待计算的数据，计算所述待计算的数据的计算结果；
所述处理模块还用于根据所述预先配置的用于计算待计算的数据的计算函数、所述待计算的数据的计算结果、所述待计算的数据中的每个 比特对应的认证指纹，所述预先配置的全同态加密算法以及所述消息认证密钥，计算所述计算结果对应的认证指纹；
所述收发模块还用于将所述待计算的数据的计算结果以及所述计算结果对应的认证指纹返回终端，以供所述终端根据接收到的所述计算结果对应的认证指纹对所述计算结果进行正确性认证。
结合第四方面，在第四方面的第一种可能的实施方式中，所述处理模块具体用于：
根据所述待计算的数据的t个比特，采用所述预先配置的用于计算待计算的数据的计算函数，获取所述待计算的数据的计算结果；
其中，所述预先配置的用于计算待计算的数据的计算函数为哈希树，所述哈希树包括：t个输入，1个输出，且所述哈希树中的各个节点均为预先配置的安全哈希函数；t为所述待计算的数据的总比特数。
结合第四方面的第一种可能的实施方式，在第四方面的第二种可能的实施方式中，所述待计算的数据中的每个比特对应的认证指纹包括第一分量和n个第二分量，且所述消息认证密钥包括计算钥，则所述处理模块还用于：
根据所述待计算的数据的t个比特对应的t个所述认证指纹的第一分量，采用所述预先配置的用于计算待计算的数据的计算函数，获取所述计算结果对应的认证指纹的第一分量；
根据所述计算结果、所述待计算的数据的每个比特对应的认证指纹的n个第二分量和所述计算钥，采用所述预先配置的全同态加密算法中的密文计算函数，获取所述计算结果对应的认证指纹的n个第二分量。
本发明第五方面提供一种全同态消息认证系统，所述系统包括终端和服务器，其中，
所述终端用于获取消息认证密钥，所述消息认证密钥包括：第一字符串和第二字符串，所述第一字符串为长度为n的0和1的字符串，且所述第一字符串中1的个数为2n/3；所述第二字符串为长度为n的0和1的字符串，且在所述第二字符串中，与所述第一字符串中的1对应的位置上的字符包括n/3个0；n为大于或等于2的整数；根据第一输入字符、所述公钥和伪随机串生成待计算的数据中的第i个比特对应的n个密文中的一 个，确定所述n个密文为所述第i个比特对应的认证指纹的第二分量，其中，若所述第一字符串中的第j个字符为0，则所述第一输入字符为所述第i个比特，或者，若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为0，则所述第一输入字符为0，或者，若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为1，则所述第一输入字符为1；所述第i个比特对应的认证指纹还包括第一分量；其中，i为整数，大于或等于1，且小于或等于所述待计算的数据的总比特数t，t大于或等于1；j为整数，大于或等于1，且小于或等于n；向所述服务器发送计算请求，所述计算请求包括：所述待计算的数据，所述待计算的数据中的每个比特对应的认证指纹、预先配置的全同态加密算法以及所述消息认证密钥；接收所述服务器返回的所述待计算的数据的计算结果以及所述计算结果对应的认证指纹；根据接收到的所述计算结果对应的认证指纹对所述计算结果进行正确性认证；
所述服务器用于：接收终端发送的计算请求；根据预先配置的用于计算待计算的数据的计算函数以及所述待计算的数据，计算所述待计算的数据的计算结果；根据所述预先配置的用于计算待计算的数据的计算函数、所述待计算的数据的计算结果、所述待计算的数据中的每个比特对应的认证指纹，所述预先配置的全同态加密算法以及所述消息认证密钥，计算所述计算结果对应的认证指纹；将所述待计算的数据的计算结果以及所述计算结果对应的认证指纹返回所述终端，以供所述终端根据接收到的所述计算结果对应的认证指纹对所述计算结果进行正确性认证。
结合第五方面，在第五方面的第一种可能的实施方式中，所述终端具体用于：根据预先配置的伪随机函数和所述待计算的数据中的第i个比特的标签生成所述第i个比特对应的认证指纹的第一分量；根据所述伪随机函数生成与所述待计算的数据中的第i个比特对应的n个伪随机串；根据所述第一字符串、所述第二字符串和所述n个伪随机串生成所述第i个比特对应的n个密文作为所述第i个比特对应的认证指纹的第二分量，其中，若所述第一字符串中的第j个字符为0，则将所述第i个比特、所述公钥和所述第j个伪随机串输入预先配置的加密算法生成所述密文；若所述 第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为0，则将0、所述公钥和所述第j个伪随机串输入所述预先配置的加密算法生成所述密文；若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为1，则将1、所述公钥和所述第j个伪随机串输入所述预先配置的加密算法生成所述密文；其中，i为整数，大于或等于1，且小于或等于所述待计算的数据的总比特数t；j为整数，大于或等于1，且小于或等于n。
可见，本发明实施例提供的全同态消息认证方法、装置及系统，在满足安全性验证的前提下，通过选择长度为n的0和1的第一字符串，且所述第一字符串中1的个数为2n/3，以及长度为n的0和1的第二字符串，且在所述第二字符串中，与所述第一字符串中的1对应的位置上的字符包括n/3个0，解决了现有技术中第一字符串为随机产生的集合{1，2，…，n-1，n}的长度为n/2的子集，在计算每个比特对应的认证指纹的过程中对于非1或0的随机数计算过程复杂的问题，有效降低验证过程中的计算量，提高对服务器的计算结果的验证效率。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作一简单地介绍，显而易见地，下面描述中的附图是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1为本发明全同态消息认证方法实施例一的流程图；
图2为本发明全同态消息认证方法实施例二的流程图；
图3为本发明全同态消息认证方法实施例三的流程图；
图4为本发明全同态消息认证方法实施例四的流程图；
图5为本发明全同态消息认证方法实施例五的流程图；
图6为本发明全同态消息认证方法实施例六的流程图；
图7为本发明中用于计算待计算的数据的计算函数的一实例示意图；
图8为本发明全同态消息认证装置实施例一的结构示意图；
图9为本发明全同态消息认证装置实施例三的结构示意图；
图10为本发明终端实施例一的结构示意图；
图11为本发明服务器实施例一的结构示意图；
图12为本发明全同态消息认证系统实施例一的结构示意图。
具体实施方式
为使本发明实施例的目的、技术方案和优点更加清楚，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
图1为本发明全同态消息认证方法实施例一的流程图。本发明实施例提供一种全同态消息认证方法，主要用于分布式环境下，例如云计算环境，即终端需要服务器对指定的待计算的数据，按照一定的计算函数对该待计算的数据进行计算获取计算结果，服务器将该计算结果返回给终端，而服务器跟终端之间不存在信任关系、或者客观上服务器存在恶意、或者受到敌手攻击从而使得该计算结果并非终端需要的，因此终端需要对服务器返回的计算结果进行正确性的验证，本实施例主要提供了在上述过程中终端侧的全同态消息认证方法的技术方案。如图1所示，具体的步骤如下：
S101：获取消息认证密钥，所述消息认证密钥包括公钥、第一字符串和第二字符串，所述第一字符串为长度为n的0和1的字符串，且所述第一字符串中字符为1的个数为2n/3；所述第二字符串为长度为n的0和1的字符串，且在所述第二字符串中，与所述第一字符串中的为1的字符对应的位置上的字符包括n/3个0，其中，n为大于或等于2的整数。
在本实施例中，终端确定随机的安全参数n，n为一个大于或等于2的整数，即第一字符串和第二字符串的长度，然后选择长度为n的第一字符串和第二字符串，该第一字符串和第二字符串中的字符均为0或1，在第一字符串中，包括2n/3个1和n/3个0，并且在第二字符串中，与第一字符串中1的位置对应的2n/3个1位置上分别有n/3个0和n/3个1。例 如：n为9，即第一字符串和第二字符串的长度都为9，第一字符串为{010111011}，其中中包括6个1，第二字符串可以为{100101010}。需要说明的是，本示例中，在第一字符串确定的情况下，第二字符串并非只有一种形式，上述仅是示例，该第二字符串只要满足上述条件即可，即在第二字符串中，与第一字符串中1对应的位置上一半是0，另一半是1。
S102：根据第一输入字符、所述公钥和伪随机串生成待计算的数据中的第i个比特对应的n个密文中的一个，确定所述n个密文为所述第i个比特对应的认证指纹的第二分量，其中，若所述第一字符串中的第j个字符为0，则所述第一输入字符为所述第i个比特，或者，若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为0，则所述第一输入字符为0，或者，若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为1，则所述第一输入字符为1；所述第i个比特对应的认证指纹还包括第一分量；其中，i为整数，大于或等于1，且小于或等于所述待计算的数据的总比特数t，t大于或等于1；j为整数，大于或等于1，且小于或等于n。
在本实施例中，根据所述消息认证密钥，分别生成待计算的数据中的每个比特对应的认证指纹，待计算的数据包括至少一个比特的信息量，对于待计算的数据中的每个比特，都根据所述消息认证密钥生成一个对应的认证指纹。
S103：向服务器发送计算请求，所述计算请求包括：所述待计算的数据，所述待计算的数据中的每个比特对应的认证指纹、预先配置的全同态加密算法以及所述消息认证密钥。
在本实施例中，若该待计算的数据有t个比特，则发送给服务器的计算请求中包括待计算的数据的t个比特对应的t个认证指纹。全同态加密算法包括一个产生公钥、私钥和计算钥的算法，一个加密算法，一个解密算法和一个密文计算函数，主要应用在计算每个比特对应的认证指纹和验证服务器计算结果的运算过程中，为现有算法，在此不多作赘述。
S104：接收所述服务器返回的所述待计算的数据的计算结果以及所述计算结果对应的认证指纹，并根据接收到的所述计算结果对应的认证 指纹对所述计算结果进行正确性认证。
在本实施例中，终端接收服务返回的将计算待计算的数据后获取的计算结果和该计算结果对应的认证指纹，并通过该计算结果对应的认证指纹验证该计算结果是否正确，如果验证该计算结果正确，则接收该计算结果；如果验证该计算结果不正确，则丢弃该计算结果。
本实施例提供的全同态消息认证方法，在满足验证需求的前提下，通过获取消息认证密钥，该消息认证密钥包括：第一字符串为长度为n的0和1的字符串，且所述第一字符串中1的个数为2n/3，第二字符串为长度n的0和1的字符串，且与所述第一字符串中的1对应的位置上的字符包括n/3个0，根据该消息认证密钥生成待计算的数据的每个比特对应的认证指纹，并将待计算的数据、每个比特对应的认证指纹、全同态加密算法以及所述消息认证密钥发送给服务器，以使服务器计算待计算的数据的计算结果和所述计算结果对应的认证指纹并返回终端，终端根据接收到的该计算结果对应的认证指纹对所述计算结果进行正确性认证，通过选择长度为n的0和1的第一字符串，且所述第一字符串中1的个数为2n/3，以及长度为n的0和1的第二字符串，且在所述第二字符串中，与所述第一字符串中的1对应的位置上的字符包括n/3个0，解决了现有技术中第一字符串为随机产生的集合{1，2，…，n-1，n}的长度为n/2的子集，在计算每个比特对应的认证指纹的过程中对于非1或0的随机数计算过程复杂的问题，有效降低终端算法的复杂性和计算量。
进一步地，图2为本发明全同态消息认证方法实施例二的流程图，在上述图1所示实施例的基础上，该消息认证密钥还包括公钥pk、私钥sk'、计算钥evk'、预先配置的安全哈希函数和预先配置的伪随机函数，所述第i个比特对应的认证指纹由以下步骤生成：
S201：根据预先配置的伪随机函数和所述待计算的数据中的第i个比特的标签生成所述第i个比特对应的认证指纹的第一分量。
在本实施例中，该待计算的数据总共有t个比特，预先配置的伪随机函数可以为一个单独的函数(还可以为一个函数族)例如：该伪随机函数为fk，第i个比特的认证指纹的第一分量为vi，将第i个比特的标签τ输入该伪随机函数进行计算获取第i个比特的认证指纹的第一分量，即 vi＝fk(τ)。
另外，在本发明实施例中，待计算的数据中的每个比特都有一个特定标签，这个标签为每个比特的一个标识，类似于一个编号，用来标记这个比特在待处理的数据中的位置。
S202：根据所述伪随机函数生成与所述待计算的数据中的第i个比特对应的n个伪随机串。
在本实施例中，例如：将i和该第i个比特的标签τ输入上述伪随机函数生成n个伪随机串，即randi＝fk(τ,i)，该n个伪随机串可以用rand1,rand2,…,randn来表示，用于在后续计算第i个比特的认证指纹的第二分量的过程中使用。
S203：根据所述第一字符串、所述第二字符串和所述n个伪随机串生成所述第i个比特对应的n个密文作为所述第i个比特对应的认证指纹的第二分量，其中，若所述第一字符串中的第j个字符为0，则将所述第i个比特、所述公钥和所述第j个伪随机串输入预先配置的加密算法生成一个密文；若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为0，则将0、所述公钥和所述第j个伪随机串输入所述预先配置的加密算法生成一个密文；若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为1，则将1、所述公钥和所述第j个伪随机串输入所述预先配置的加密算法生成一个密文。
在本实施例中，该预先配置的加密算法为全同态加密算法中的加密算法(HE.Enc)，i为整数，大于或等于1，且小于或等于所述待计算的数据的总比特数t；j为整数，大于或等于1，且小于或等于n。针对该第i个比特，详细说明第i个比特对应的认证指纹的第二分量的获取方式：
若所述第一字符串中的第j个字符为0，则将所述第i个比特、所述公钥和所述第j个伪随机串输入预先配置的加密算法生成所述密文cj，即cj＝HE.Enc(bi,pk,randj)，其中，用bi表示该第i个比特。
若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为0，则将0、所述公钥和所述第j个伪随机串输入所述预先配置的加密算法生成所述密文cj，即cj＝HE.Enc(0,pk,randj)。
若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为1，则将1、所述公钥和所述伪随机串输入所述预先配置的加密算法生成所述密文cj，即cj＝HE.Enc(1,pk,randj)。
按照上述方式遍历判断第一字符串，获取n个密文作为第i个比特对应的的认证指纹的第二分量，cj＝HE.Enc(bi,pk,randj)表示bi在伪随机串randi下的加密密文，例如：cj＝HE.Enc(1,pk,randj)表示1在伪随机串randj下的加密密文。
所述第i个比特对应的所述认证指纹包括所述第i个比特的认证指纹的第二分量和所述第i个比特的认证指纹的第一分量。(第i个比特对应的所述认证指纹可以表示为θi＝(c1,…cn,vi)。
本实施例提供的全同态消息认证方法，通过获取消息认证密钥，该消息认证密钥包括：第一字符串为长度为n的0和1的字符串，且所述第一字符串中1的个数为2n/3，第二字符串为长度n的0和1的字符串，且与所述第一字符串中的1对应的位置上的字符包括n/3个0，在根据该消息认证密钥生成待计算的数据的每个比特对应的认证指纹过程中，在每个比特对应的认证指纹的第二分量中随机插入2n/3个0和1的的随机密文，并将待计算的数据、每个比特对应的认证指纹、全同态加密算法以及所述消息认证密钥发送给服务器，以使服务器计算待计算的数据的计算结果和所述计算结果对应的认证指纹并返回终端，终端根据接收到的该计算结果对应的认证指纹对所述计算结果进行正确性认证，通过选择长度为n，且1的个数为2n/3的第一字符串和长度为n的，且在与第一字符串中的1对应的位置上的字符包括n/3个0的第二字符串，解决了现有技术中第一字符串为随机产生的集合{1，2，…，n-1，n}的长度为n/2的子集，在计算每个比特对应的认证指纹的过程中对于非1或0的随机数计算过程复杂的问题，有效降低终端算法的复杂性和计算量，提高对计算结果的验证效率。
图3为本发明全同态消息认证方法实施例三的流程图，如图3所示，在上述实施例一以及实施例二的基础上，S104的具体实现步骤为：
S301：获取重新计算的所述计算结果对应的认证指纹的第一分量。
在本实施例中，终端接收到服务器返回的计算结果和计算结果对应 的认证指纹，首先对验证该计算结果的对应的认证指纹的第一分量，需要获取重新计算的计算结果对应的认证指纹的第一分量，具体的获取方式有以下两种：
第一种获取方式，终端预先配置了用于计算待计算的数据的计算函数，则终端根据获取的所述待计算的数据的t个比特对应的t个所述认证指纹的第一分量，采用该用于计算待计算的数据的计算函数，获取重新计算的所述计算结果对应的认证指纹的第一分量；
其中，所述用于计算待计算的数据的计算函数为哈希树，所述哈希树包括：t个输入，1个输出，且所述哈希树中的各个节点均为预先配置的安全哈希函数。
第二种获取方式，终端没有配置用于计算待计算的数据的计算函数，引入第三方设备进行计算，在该第三方设备上配置了用于计算待计算的数据的计算函数，则终端将将所述待计算数据的t个比特对应的t个所述认证指纹的第一分量发送给第三方设备，以使所述第三方设备根据接收的所述待计算的数据的t个比特对应的t个所述认证指纹的第一分量，采用预先配置的用于计算待计算的数据的计算函数，获取重新计算的所述计算结果对应的认证指纹的第一分量，并接收所述第三方设备返回的所述重新计算的所述计算结果对应的认证指纹的第一分量；其中，所述用于计算待计算的数据的计算函数为哈希树，所述哈希树包括：t个输入，1个输出，且所述哈希树中的各个节点均为所述安全哈希函数。
该第三方设备为半可信的第三方(例如：卫生主管部门)用户设备不需要知道用于计算待计算数据的计算函数，并且该第三方设备也不知道终端的待计算的数据，保证了用户设备的隐私。
S302：比较所述接收到的所述计算结果对应的认证指纹的第一分量与所述重新计算的所述计算结果对应的认证指纹的第一分量是否相等。
S303：若所述接收到的所述计算结果对应的认证指纹的第一分量与所述重新计算的所述计算结果对应的认证指纹的第一分量相等，则继续对所述计算结果进行正确性认证；若二者不相等，则确定所述计算结果不正确。
本实施例提供的全同态消息认证方法，通过获取消息认证密钥，该 消息认证密钥包括：第一字符串为长度为n的0和1的字符串，且所述第一字符串中1的个数为2n/3，第二字符串为长度n的0和1的字符串，且与所述第一字符串中的1对应的位置上的字符包括n/3个0，在根据该消息认证密钥生成待计算的数据的每个比特对应的认证指纹过程中，在每个比特对应的认证指纹的第二分量中随机插入2n/3个0和1的的随机密文，并将待计算的数据、每个比特对应的认证指纹、全同态加密算法以及所述消息认证密钥发送给服务器，以使服务器计算待计算的数据的计算结果和所述计算结果对应的认证指纹并返回终端，终端根据接收到的该计算结果对应的认证指纹对所述计算结果，获取重新计算的该计算结果对应的认证指纹，以便对该计算结果进行正确性认证，具体的若终端已配置了用于计算待计算的数据的计算函数，则通过终端自己计算获取该计算结果对应的认证指纹的第一分量，若终端上没有配置用于计算待计算的数据的计算函数，则将该计算结果发送给第三方设备，以使第三方设备进行计算并返回重新计算的计算结果对应的认证指纹的第一分量，与接收的服务器发送的计算结果对应的认证指纹的第一分量进行对比，验证计算结果的正确性，若正确则进行进一步验证，通过选择长度为n，且1的个数为2n/3的第一字符串和长度为n的，且在与第一字符串中的1对应的位置上的字符包括n/3个0的第二字符串，解决了现有技术中第一字符串为随机产生的集合{1，2，…，n-1，n}的长度为n/2的子集，在计算每个比特对应的认证指纹的过程中对于非1或0的随机数计算过程复杂的问题，利用第三方设备进行计算计算结果对应的认证指纹的第一分量，还解决了用于计算待计算的数据的计算函数为商业机密的情况下，终端不知用于计算待计算的数据的计算函数所造成的不便，且保护了终端的隐私，有效降低终端算法的复杂性和计算量，提高对计算结果的验证效率。
图4为本发明全同态消息认证方法实施例四的流程图，如图4所示，在上述图3所示的实施例的基础上，所述消息认证密钥还包括私钥，则所述接收到的所述计算结果对应的认证指纹的第一分量与所述重新计算的所述计算结果对应的认证指纹的第一分量相等，则继续对所述计算结果进行正确性认证的具体实现方式为：
S401：根据所述私钥，分别计算所述接收到的所述计算结果对应的认证指纹的n个第二分量对应的n个明文。
在本实施例中，终端对接收到的服务器发送的计算结果对应的认证指纹的每个第二分量根据所述私钥进行解密计算，获取n个对应的明文，用于与计算结果进行对比判断。
例如：服务器发送的计算结果为e，该计算结果对应的认证指纹为
Figure PCTCN2015072570-appb-000001
其中该计算结果对应的认证指纹的第二分量为
Figure PCTCN2015072570-appb-000002
则根据所述私钥sk'，调用公式
Figure PCTCN2015072570-appb-000003
进行解密获取计算
Figure PCTCN2015072570-appb-000004
对应的明文ej，获取所有的明文e1,…,en。
S402：若所述n个明文全部与所述计算结果相同，则确定所述计算结果正确。
在本实施例中，从1至n依次判断上述n个明文与上述计算结果是否相等，若存在一个明文与上述计算结果不相同，则认为该计算结果不正确，结束正确性验证操作。具体的，可以通过如下方式进行认证：
若所述第一字符串中的第j个字符是0，则判断所述计算结果与第j个所述明文是否相等，若不相等，则确定所述计算结果不正确，将该计算结果丢弃，并结束正确性验证操作。
若所述第一字符串中第j个字符是1，且所述第二字符串中第j个字符是1，则判断所述计算结果与第j个所述明文是否相等；若验证出存在一个所述明文与所述计算结果不相等时，则确定所述计算结果不正确，将该计算结果丢弃，并结束正确性验证操作。
若所述第一字符串中第j个字符是1，且所述第二字符串中第j个字符是0，则判断所述计算结果与第j个所述明文是否相等；若验证出存在一个所述明文与所述计算结果不相等时，则确定所述计算结果不正确，将该计算结果丢弃，并结束正确性验证操作。
上述三个步骤为一次验证过程中针对第一字符串和第二字符串中的字符不同的一种具体的操作方式，每次验证一个明文与结算结果相同时，则j加1，继续根据第一字符串和第二字符串的字符进行认证。其中，j为整数，大于或等于1，且小于或等于n，n为一个大于等于2的正整数，即确定的第一字符串和第二字符串的长度。
例如：对上述计算结果e，根据通过解密计算获取的明文e1,…,en进行验证，若结合上述其他实施例，在整个验证过程中，没有丢弃所述计算结果e，则接受该计算结果e，终端认为服务器返回的计算结果正确。
本实施例提供的全同态消息认证方法，通过获取消息认证密钥，该消息认证密钥包括：第一字符串为长度为n的0和1的字符串，且所述第一字符串中1的个数为2n/3，第二字符串为长度n的0和1的字符串，且与所述第一字符串中的1对应的位置上的字符包括n/3个0，在根据该消息认证密钥生成待计算的数据的每个比特对应的认证指纹过程中，在每个比特对应的认证指纹的第二分量中随机插入2n/3个0和1的的随机密文，并将待计算的数据、每个比特对应的认证指纹、全同态加密算法以及所述消息认证密钥发送给服务器，以使服务器计算待计算的数据的计算结果和所述计算结果对应的认证指纹并返回终端，终端根据接收到的该计算结果对应的认证指纹对所述计算结果，获取重新计算的该计算结果对应的认证指纹，以便对该计算结果进行正确性认证，具体的若终端已配置了用于计算待计算的数据的计算函数，则通过终端自己计算获取该计算结果对应的认证指纹的第一分量，若终端上没有配置用于计算待计算的数据的计算函数，则将该计算结果发送给第三方设备，以使第三方设备进行计算并返回重新计算的计算结果对应的认证指纹的第一分量，与接收的服务器发送的计算结果对应的认证指纹的第一分量进行对比，验证计算结果的正确性，若正确则进行进一步验证，调用私钥对服务器发送的计算结果对应的认证指纹的第二分量进行解密计算获取t个明文，并与计算结果进行对比，验证所述计算结果的正确性。通过选择长度为n，且1的个数为2n/3的第一字符串和长度为n的，且在与第一字符串中的1对应的位置上的字符包括n/3个0的第二字符串，解决了现有技术中第一字符串为随机产生的集合{1，2，…，n-1，n}的长度为n/2的子集，在计算每个比特对应的认证指纹的过程中对于非1或0的随机数计算过程复杂的问题，还解决了用于计算待计算的数据的计算函数为商业机密的情况下，终端不知用于计算待计算的数据的计算函数所造成的不便，且保护了终端的隐私，另外，在接收到服务器返回的计算结果对应的认证指纹后，总共只需要进行n次解密计算，相较于现有技术中对每个 比特都要重新进行n/2次运算，总共需要t*(n/2)次运算才能重新计算获取到该计算结果对应的认证指纹的第二分量，有效降低终端验证时的算法的复杂性和计算量，提高对计算结果的验证效率。
图5为本发明全同态消息认证方法实施例五的流程图，如图5所示，本实施例提供了服务器侧的全同态消息认证方法的技术方案，具体步骤如下：
S501：接收终端发送的计算请求，所述计算请求包括：待计算的数据，所述待计算的数据中的每个比特对应的认证指纹、全同态加密算法以及消息认证密钥。
S502：根据预先配置的用于计算待计算的数据的计算函数以及所述待计算的数据，计算所述待计算的数据的计算结果。
S503：根据所述预先配置的用于计算待计算的数据的计算函数、所述待计算的数据的计算结果、所述待计算的数据中的每个比特对应的认证指纹，所述预先配置的全同态加密算法以及所述消息认证密钥，计算所述计算结果对应的认证指纹。
S504：将所述待计算的数据的计算结果以及所述计算结果对应的认证指纹返回终端，以供所述终端根据接收到的所述计算结果对应的认证指纹对所述计算结果进行正确性认证。
在本实施例中，服务器中预先配置了用于计算待计算的数据的计算函数，以对终端发送的待计算的数据进行计算获取计算结果，服务器不需要再向终端返回原始的待计算的数据，只是对该计算结果增加一个对应的认证指纹，以便终端根据该计算结果对应的认证指纹对计算结果进行验证，获取正确的计算结果而不必再知道原始待计算的数据。
本实施例提供的全同态消息认证方法，通过接收终端发送的计算请求，其中包括消息认证密钥，服务器根据预先配置的用于计算待计算的数据的计算函数计算待计算的数据的计算结果，并根据该消息认证密钥、该计算结果和待计算的数据的每个比特对应的认证指纹计算获取所述计算结果对应的认证指纹并返回终端，以使终端根据接收到的该计算结果对应的认证指纹对所述计算结果进行正确性认证，解决了现有技术中终端生成的消息认证密钥的第一字符串为随机产生的集合{1，2，…， n-1，n}的长度为n/2的子集，在计算每个比特对应的认证指纹的过程中对于非1或0的随机数计算过程复杂的问题，有效降低终端验证过程中的计算量，提高终端对服务器的计算结果的验证效率。。
图6为本发明全同态消息认证方法实施例六的流程图，如图6所示，在上述实施例的基础上，S502和S503的具体实现步骤为：
S601：根据所述待计算的数据的t个比特，采用所述预先配置的用于计算待计算的数据的计算函数，获取所述待计算的数据的计算结果。
在本实施例中，首先获取待计算的数据的计算结果。所述用于计算待计算的数据的计算函数为哈希树，所述哈希树包括：t个输入，1个输出，且所述哈希树中的各个节点均为预先配置的安全哈希函数；t为所述待计算的数据的总比特数。
S602：根据所述待计算的数据的t个比特对应的t个所述认证指纹的第一分量，采用所述预先配置的用于计算待计算的数据的计算函数，获取所述计算结果对应的认证指纹的第一分量。
在本实施例中，所述待计算的数据中的每个比特对应的认证指纹包括第一分量和第二分量，则对于所述待计算的数据的t个比特来说总共有t个对应的认证指纹，每个认证指纹包括一个第一分量和n个第二分量，且所述消息认证密钥包括计算钥。
S603：根据所述计算结果、所述待计算的数据的每个比特对应的认证指纹的n个第二分量和所述计算钥，采用所述预先配置的全同态加密算法中的密文计算函数，获取所述计算结果对应的认证指纹的n个第二分量。
在本实施例中，所述计算结果对应的认证指纹包括所述计算结果对应的认证指纹的第一分量和所述计算结果对应的认证指纹的n个第二分量，服务器计算获得了待计算的数据的计算结果以及计算结果对应的认证指纹，并发送给终端，以使终端根据计算结果对应的认证指纹对计算结果的正确性进行验证，获取正确的计算结果。
本实施例提供的全同态消息认证方法，通过接收终端发送的计算请求，其中包括消息认证密钥包括计算钥，服务器根据预先配置的用于计算待计算的数据的计算函数计算待计算的数据的计算结果，并根据该消息认证密钥、该计算结果和待计算的数据的每个比特对应的认证指纹计 算获取所述计算结果对应的认证指纹的第一分量和第二分量，并返回终端，以使终端根据接收到的该计算结果对应的认证指纹对所述计算结果进行正确性认证，解决了现有技术中终端生成的消息认证密钥的第一字符串为随机产生的集合{1，2，…，n-1，n}的长度为n/2的子集，在计算每个比特对应的认证指纹的过程中对于非1或0的随机数计算过程复杂的问题，有效降低终端验证过程中的计算量，提高终端对服务器的计算结果的验证效率。。
图7为本发明中用于计算待计算的数据的计算函数的一实例示意图，如图7所示，在上述图1-6所示的技术方案中，用于计算待计算的数据的计算函数为一个为哈希树，所述哈希树包括：t个输入，1个输出，且所述哈希树中的各个节点均为预先配置的安全哈希函数，下面特举例说明该计算函数的应用。可以用g表示该用于计算待计算的数据的计算函数：
在本实例中，g可以表示为{0,1}t→{0,1}，是一个电路，安全哈希函数H为{0,1}*→{0,1}m哈希树gH表示为{{0,1}*}t→{0,1}m，如图7所示，待计算的数据的总比特数位6，每个节点均为安全哈希函数H，可以为加法门或者乘法门电路，服务器获取待计算的数据的计算结果时，将待计算的数据的每个比特分别输入不同的输入线路，获取的最终输出结果为计算结果e。服务器获取计算结果对应的认证指纹的第一分量时，将输入线路的输入分别输入待计算的数据每个比特对应的认证指纹的第一分量vi作为输入(i大于等于1，小于等于6)，最终输出的为计算结果对应的认证指纹的第一分量。终端和第三方设备应用该用于计算待计算的数据的计算函数时，计算方式与服务器相同。
图8为本发明全同态消息认证装置实施例一的结构示意图。如图8所示，该全同态消息认证装置80包括：获取模块81，用于获取消息认证密钥，所述消息认证密钥包括公钥、第一字符串和第二字符串，所述第一字符串为长度为n的0和1的字符串，且所述第一字符串中字符为1的个数为2n/3；所述第二字符串为长度为n的0和1的字符串，且在所述第二字符串中，与所述第一字符串中的为1的字符对应的位置上的字符包括n/3个0，其中，n为大于或等于2的整数；
生成模块82，用于根据第一输入字符、所述公钥和伪随机串生成待 计算的数据中的第i个比特对应的n个密文中的一个，确定所述n个密文为所述第i个比特对应的认证指纹的第二分量，其中，若所述第一字符串中的第j个字符为0，则所述第一输入字符为所述第i个比特，或者，若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为0，则所述第一输入字符为0，或者，若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为1，则所述第一输入字符为1；所述第i个比特对应的认证指纹还包括第一分量；其中，i为整数，大于或等于1，且小于或等于所述待计算的数据的总比特数t，t大于或等于1；j为整数，大于或等于1，且小于或等于n；
收发模块83，用于向服务器发送计算请求，所述计算请求包括：所述待计算的数据，所述待计算的数据中的每个比特对应的认证指纹、预先配置的全同态加密算法以及所述消息认证密钥；
所述收发模块83还用于接收所述服务器返回的所述待计算的数据的计算结果以及所述计算结果对应的认证指纹；
处理模块84，用于根据所述收发模块接收到的所述计算结果对应的认证指纹对所述计算结果进行正确性认证。
本实施例提供的全同态消息认证装置，通过获取模块获取消息认证密钥，该消息认证密钥包括：第一字符串为长度为n的0和1的字符串，且所述第一字符串中1的个数为2n/3，第二字符串为长度n的0和1的字符串，且与所述第一字符串中的1对应的位置上的字符包括n/3个0，生成模块根据该消息认证密钥生成待计算的数据的每个比特对应的认证指纹，收发模块将待计算的数据、每个比特对应的认证指纹、全同态加密算法以及所述消息认证密钥发送给服务器，以使服务器计算待计算的数据的计算结果和所述计算结果对应的认证指纹并返回终端，处理模块根据接收到的该计算结果对应的认证指纹对所述计算结果进行正确性认证，通过选择长度为n的0和1的第一字符串，且所述第一字符串中1的个数为2n/3，以及长度为n的0和1的第二字符串，且在所述第二字符串中，与所述第一字符串中的1对应的位置上的字符包括n/3个0，解决了现有技术中第一字符串为随机产生的集合{1，2，…，n-1，n}的长度为n/2的子集，在计算每个比特对应的认证指纹的过程中对于非1或0的随 机数计算过程复杂的问题，有效降低终端算法的复杂性和计算量。
本发明全同态消息认证装置实施例二中，在上述实施例的基础上，所述生成模块82具体用于：
根据预先配置的伪随机函数和所述待计算的数据中的第i个比特的标签生成所述第i个比特对应的认证指纹的第一分量；
根据所述伪随机函数生成与所述待计算的数据中的第i个比特对应的n个伪随机串；
根据所述第一字符串、所述第二字符串和所述n个伪随机串生成所述第i个比特对应的n个密文作为所述第i个比特对应的认证指纹的第二分量，其中，若所述第一字符串中的第j个字符为0，则将所述第i个比特、所述公钥和所述第j个伪随机串输入预先配置的加密算法生成一个密文；若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为0，则将0、所述公钥和所述第j个伪随机串输入所述预先配置的加密算法生成一个密文；若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为1，则将1、所述公钥和所述第j个伪随机串输入所述预先配置的加密算法生成一个密文。
进一步的，所述处理模块84具体用于：
重新计算所述计算结果对应的认证指纹的第一分量；
比较所述接收到的所述计算结果对应的认证指纹的第一分量与所述重新计算的所述计算结果对应的认证指纹的第一分量是否相等；
若所述接收到的所述计算结果对应的认证指纹的第一分量与所述重新计算的所述计算结果对应的认证指纹的第一分量相等，则继续对所述计算结果进行正确性认证；若二者不相等，则确定所述计算结果不正确。
可选的，所述处理模块84还用于还用于根据获取的所述待计算的数据的t个比特对应的t个所述认证指纹的第一分量，采用用于计算待计算的数据的计算函数，获取重新计算的所述计算结果对应的认证指纹的第一分量；
其中，所述用于计算待计算的数据的计算函数为哈希树，所述哈希树包括：t个输入，1个输出，且所述哈希树中的各个节点均为预先配置的安全哈 希函数。
可选的，所述收发模块83还用于：
将所述待计算数据的t个比特对应的t个所述认证指纹的第一分量发送给第三方设备，以使所述第三方设备根据接收的所述待计算的数据的t个比特对应的t个所述认证指纹的第一分量，采用预先配置的用于计算待计算的数据的计算函数，获取重新计算的所述计算结果对应的认证指纹的第一分量；
接收所述第三方设备返回的所述重新计算的所述计算结果对应的认证指纹的第一分量；
其中，所述用于计算待计算的数据的计算函数为哈希树，所述哈希树包括：t个输入，1个输出，且所述哈希树中的各个节点均为所述安全哈希函数。
进一步的，所述消息认证密钥还包括私钥，所述处理模块84还用于：
根据所述私钥，分别计算所述接收到的所述计算结果对应的认证指纹的n个第二分量对应的n个明文；
判断若所述n个明文全部与所述计算结果相同，则确定所述计算结果正确。
本实施例提供的全同态消息认证装置，用于执行图1-7所示的方法实施例的技术方案，其实现原理和技术效果类似，在此不作赘述。
图9为本发明全同态消息认证装置实施例三的结构示意图。如图9所示，该全同态消息认证装置90包括，收发模块91，用于接收终端发送的计算请求，所述计算请求包括：待计算的数据，所述待计算的数据中的每个比特对应的认证指纹、全同态加密算法以及消息认证密钥；
处理模块92，用于根据预先配置的用于计算待计算的数据的计算函数以及所述待计算的数据，计算所述待计算的数据的计算结果；
所述处理模块92还用于根据所述预先配置的用于计算待计算的数据的计算函数、所述待计算的数据的计算结果、所述待计算的数据中的每个比特对应的认证指纹，所述预先配置的全同态加密算法以及所述消息认证密钥，计算所述计算结果对应的认证指纹；
所述收发模块91还用于将所述待计算的数据的计算结果以及所述计算结果对应的认证指纹返回终端，以供所述终端根据接收到的所述计算 结果对应的认证指纹对所述计算结果进行正确性认证。
本实施例提供的全同态消息认证装置，用于执行图1-7所示的方法实施例的技术方案，通过接收模块接收终端发送的计算请求，计算请求包括：待计算的数据，消息认证密钥；处理模块根据预先配置的用于计算待计算的数据的计算函数计算所述待计算的数据的计算结果，并根据该消息认证密钥、该计算结果和待计算的数据的每个比特对应的认证指纹计算获取所述计算结果对应的认证指纹，并返回给终端，以使终端根据接收到的计算结果对应的认证指纹对所述计算结果进行正确性认证，解决了现有技术中第一字符串为随机产生的集合{1，2，…，n-1，n}的长度为n/2的子集，在计算每个比特对应的认证指纹的过程中对于非1或0的随机数计算过程复杂的问题，有效降低终端算法的复杂性和计算量。
本发明全同态消息认证装置实施例四中，在上述实施例的基础上，所述处理模块92具体用于：
根据所述待计算的数据的t个比特，采用所述预先配置的用于计算待计算的数据的计算函数，获取所述待计算的数据的计算结果；
其中，所述预先配置的用于计算待计算的数据的计算函数为哈希树，所述哈希树包括：t个输入，1个输出，且所述哈希树中的各个节点均为预先配置的安全哈希函数；t为所述待计算的数据的总比特数。
进一步的，所述待计算的数据中的每个比特对应的认证指纹包括第一分量和n个第二分量，且所述消息认证密钥包括计算钥，则所述处理模块92还用于：
根据所述待计算的数据的t个比特对应的t个所述认证指纹的第一分量，采用所述预先配置的用于计算待计算的数据的计算函数，获取所述计算结果对应的认证指纹的第一分量；
根据所述计算结果、所述待计算的数据的每个比特对应的认证指纹的n个第二分量和所述计算钥，采用所述预先配置的全同态加密算法中的密文计算函数，获取所述计算结果对应的认证指纹的n个第二分量。
即计算结果对应的认证指纹包括所述计算结果对应的认证指纹的第一分量和所述计算结果对应的认证指纹的第二分量。
本实施例提供的全同态消息认证装置，用于执行图1-7所示的方法实 施例的技术方案，其实现原理和技术效果类似，在此不作赘述。
图10为本发明终端实施例一的结构示意图，如图10所示，该终端100包括：处理器101、发送器102和接收器103，具体的，处理器101，用于获取消息认证密钥，所述消息认证密钥包括：第一字符串和第二字符串，所述第一字符串为长度为n的0和1的字符串，且所述第一字符串中1的个数为2n/3；所述第二字符串为长度为n的0和1的字符串，且在所述第二字符串中，与所述第一字符串中的1对应的位置上的字符包括n/3个0；n为大于或等于2的整数：
所述处理器101还用于根据所述消息认证密钥，分别生成待计算的数据中的每个比特对应的认证指纹；
发送器102用于向服务器发送计算请求，所述计算请求包括：所述待计算的数据，所述待计算的数据中的每个比特对应的认证指纹、预先配置的全同态加密算法以及所述消息认证密钥；
接收器103用于接收所述服务器返回的所述待计算的数据的计算结果以及所述计算结果对应的认证指纹；
所述处理器101还用于根据接收到的所述计算结果对应的认证指纹对所述计算结果进行正确性认证。
本实施例提供的终端，在满足验证需求的前提下，通过处理器获取消息认证密钥，该消息认证密钥包括：第一字符串为长度为n的0和1的字符串，且所述第一字符串中1的个数为2n/3，第二字符串为长度n的0和1的字符串，且与所述第一字符串中的1对应的位置上的字符包括n/3个0，根据该消息认证密钥生成待计算的数据的每个比特对应的认证指纹，发送器将待计算的数据、每个比特对应的认证指纹、全同态加密算法以及所述消息认证密钥发送给服务器，以使服务器计算待计算的数据的计算结果和所述计算结果对应的认证指纹并返回终端，处理器根据接收器接收到的该计算结果对应的认证指纹对所述计算结果进行正确性认证，通过选择长度为n的0和1的第一字符串，且所述第一字符串中1的个数为2n/3，以及长度为n的0和1的第二字符串，且在所述第二字符串中，与所述第一字符串中的1对应的位置上的字符包括n/3个0，获取的待计算的数据的每个比特的认证指纹的第二分量中插入n2/3个0和1的密 文，解决了现有技术中第一字符串为随机产生的集合{1，2，…，n-1，n}的长度为n/2的子集，在计算每个比特对应的认证指纹的过程中对于非1或0的随机数计算过程复杂的问题，有效降低终端算法的复杂性和计算量。
在本发明终端的实施例二中，在上述实施例的基础上，所述消息认证密钥还包括公钥，则所述处理器101具体用于：
根据预先配置的伪随机函数和所述待计算的数据中的第i个比特的标签生成所述第i个比特对应的认证指纹的第一分量；
根据所述伪随机函数生成与所述待计算的数据中的第i个比特对应的n个伪随机串；
根据所述第一字符串、所述第二字符串和所述n个伪随机串生成所述第i个比特对应的n个密文作为所述第i个比特对应的认证指纹的第二分量，其中，若所述第一字符串中的第j个字符为0，则将所述第i个比特、所述公钥和所述第j个伪随机串输入预先配置的加密算法生成所述密文；若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为0，则将0、所述公钥和所述第j个伪随机串输入所述预先配置的加密算法生成所述密文；若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为1，则将1、所述公钥和所述第j个伪随机串输入所述预先配置的加密算法生成所述密文；
其中，i为整数，大于或等于1，且小于或等于所述待计算的数据的总比特数t；j为整数，大于或等于1，且小于或等于n。
进一步的，所述处理器101具体用于：
获取重新计算的所述计算结果对应的认证指纹的第一分量；
比较所述接收到的所述计算结果对应的认证指纹的第一分量与所述重新计算的所述计算结果对应的认证指纹的第一分量是否相等；
若所述接收到的所述计算结果对应的认证指纹的第一分量与所述重新计算的所述计算结果对应的认证指纹的第一分量相等，则继续对所述计算结果进行正确性认证；若二者不相等，则确定所述计算结果不正确。
进一步的，所述处理器101：
根据所述待计算的数据的t个比特对应的t个所述认证指纹的第一分量，采用用于计算所述待计算的数据的计算函数，获取重新计算的所述计算结果对应的认证指纹的第一分量；
其中，所述用于计算待计算的数据的计算函数为哈希树，所述哈希树包括：t个输入，1个输出，且所述哈希树中的各个节点均为预先配置的安全哈希函数。
可选的，所述发送器102还用于将所述待计算数据的t个比特对应的t个所述认证指纹的第一分量发送给第三方设备，以使所述第三方设备根据接收的所述待计算的数据的t个比特对应的t个所述认证指纹的第一分量，采用预先配置的用于计算待计算的数据的计算函数，获取重新计算的所述计算结果对应的认证指纹的第一分量
所述接收器103还用于接收所述第三方设备返回的所述重新计算的所述计算结果对应的认证指纹的第一分量；
其中，所述用于计算待计算的数据的计算函数为哈希树，所述哈希树包括：t个输入，1个输出，且所述哈希树中的各个节点均为所述安全哈希函数。
可选的，所述消息认证密钥还包括私钥，所述处理器101还用于：
根据所述私钥，分别计算所述接收到的所述计算结果对应的认证指纹的n个第二分量对应的n个明文；
判断若所述n个明文全部与所述计算结果相同，则确定所述计算结果正确。
本实施例提供的终端，用于执行图1至图7所示的实施例的技术方案，其实现原理和技术效果类似，在此不再赘述。
图11为本发明服务器实施例一的结构示意图，如图所示，该服务器110包括：接收器111、处理器112和发送器113，具体的，接收器111用于接收终端发送的计算请求，所述计算请求包括：待计算的数据，所述待计算的数据中的每个比特对应的认证指纹、全同态加密算法以及消息认证密钥；
处理器112用于根据预先配置的用于计算待计算的数据的计算函数以及所述待计算的数据，计算所述待计算的数据的计算结果；
所述处理器112还用于根据所述预先配置的用于计算待计算的数据的 计算函数、所述待计算的数据的计算结果、所述待计算的数据中的每个比特对应的认证指纹，所述预先配置的全同态加密算法以及所述消息认证密钥，计算所述计算结果对应的认证指纹；
发送器113用于将所述待计算的数据的计算结果以及所述计算结果对应的认证指纹返回终端，以供所述终端根据接收到的所述计算结果对应的认证指纹对所述计算结果进行正确性认证。
本实施例提供的服务器，通过接收器接收终端发送的计算请求，其中包括消息认证密钥，处理器根据预先配置的用于计算待计算的数据的计算函数计算待计算的数据的计算结果，，并根据该消息认证密钥、该计算结果和待计算的数据的每个比特对应的认证指纹计算获取所述计算结果对应的认证指纹并通过发送器返回终端，以使终端根据接收到的该计算结果对应的认证指纹对所述计算结果进行正确性认证，通过选择长度为n，且1的个数为2n/3的第一字符串和长度为n的，且在与第一字符串中的1对应的位置上的字符包括n/3个0的第二字符串，解决了现有技术中第一字符串为随机产生的集合{1，2，…，n-1，n}的长度为n/2的子集，在计算每个比特对应的认证指纹的过程中对于非1或0的随机数计算过程复杂的问题，有效降低终端算法的复杂性和计算量。
在本发明服务器的实施例二中，在上述实施例的基础上，所述处理器112具体用于：
根据所述待计算的数据的t个比特，采用所述预先配置的用于计算待计算的数据的计算函数，获取所述待计算的数据的计算结果；
其中，所述预先配置的用于计算待计算的数据的计算函数为哈希树，所述哈希树包括：t个输入，1个输出，且所述哈希树中的各个节点均为预先配置的安全哈希函数；t为所述待计算的数据的总比特数。
进一步的，所述待计算的数据中的每个比特对应的认证指纹包括第一分量和n个第二分量，且所述消息认证密钥包括计算钥，则所述处理器112具体用于：
根据所述待计算的数据的t个比特对应的t个所述认证指纹的第一分量，采用所述预先配置的用于计算待计算的数据的计算函数，获取所述计算结果对应的认证指纹的第一分量；
根据所述计算结果、所述待计算的数据的每个比特对应的认证指纹的n个第二分量和所述计算钥，采用所述预先配置的全同态加密算法中的密文计算函数，获取所述计算结果对应的认证指纹的n个第二分量。
本实施例提供的服务器，用于执行图1-7所示的方法实施例的技术方案，其实现原理和技术效果类似，在此不再赘述。
另外，在上述终端的实施例一和实施例二以及服务器的实施例一和实施例二中，应理解，在本发明实施例中，该处理器101和处理器112可以是中央处理单元(Central Processing Unit，简称CPU)，还可以是其他通用处理器、数字信号处理器(Digital Signal Processor，简称DSP)、专用集成电路(Application Specific Integrated Circuit，简称ASIC)、现成可编程门阵列(Field－Programmable Gate Array，简称FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
在实现过程中，终端和服务器实现图1-7所示的方法实施例的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。结合本发明实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。
本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于装置实施例而言，由于其基本相似于方法实施例，所以描述得比较简单，相关之处参见方法实施例的部分说明即可。以上所描述的装置实施例仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。本领域普通技术人员在不付出创造性劳动的情况下，即可以理解并实施。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到本发明可借助软件加必需的通用硬件的方式来实现，当然也可以通过专用硬件 包括专用集成电路、专用CPU、专用存储器、专用元器件等来实现。一般情况下，凡由计算机程序完成的功能都可以很容易地用相应的硬件来实现，而且，用来实现同一功能的具体硬件结构也可以是多种多样的，例如模拟电路、数字电路或专用电路等。但是，对本发明而言更多情况下软件程序实现是更佳的实施方式。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在可读取的存储介质中，如计算机的软盘，U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例所述的方法。
图12为本发明全同态消息认证系统实施例一的结构示意图，如图12所示，该全同态消息认证系统120包括终端121和服务器122，其中，
所述终端121用于获取消息认证密钥，所述消息认证密钥包括：第一字符串和第二字符串，所述第一字符串为长度为n的0和1的字符串，且所述第一字符串中1的个数为2n/3；所述第二字符串为长度为n的0和1的字符串，且在所述第二字符串中，与所述第一字符串中的1对应的位置上的字符包括n/3个0；n为大于或等于2的整数；根据第一输入字符、所述公钥和伪随机串生成待计算的数据中的第i个比特对应的n个密文中的一个，确定所述n个密文为所述第i个比特对应的认证指纹的第二分量，其中，若所述第一字符串中的第j个字符为0，则所述第一输入字符为所述第i个比特，或者，若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为0，则所述第一输入字符为0，或者，若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为1，则所述第一输入字符为1；所述第i个比特对应的认证指纹还包括第一分量；其中，i为整数，大于或等于1，且小于或等于所述待计算的数据的总比特数t，t大于或等于1；j为整数，大于或等于1，且小于或等于n；向所述服务器发送计算请求，所述计算请求包括：所述待计算的数据，所述待计算的数据中的每个比特对应的认证指纹、预先配置的全同态加密算法以及所述消息认证密钥；接收所述服务器返回的所述待计算的数据的计算结果以及所述计算结果对应的认证指纹；根据接收到的所 述计算结果对应的认证指纹对所述计算结果进行正确性认证；
所述服务器122用于：接收终端发送的计算请求；根据预先配置的用于计算待计算的数据的计算函数以及所述待计算的数据，计算所述待计算的数据的计算结果；根据所述预先配置的用于计算待计算的数据的计算函数、所述待计算的数据的计算结果、所述待计算的数据中的每个比特对应的认证指纹，所述预先配置的全同态加密算法以及所述消息认证密钥，计算所述计算结果对应的认证指纹；将所述待计算的数据的计算结果以及所述计算结果对应的认证指纹返回所述终端，以供所述终端根据接收到的所述计算结果对应的认证指纹对所述计算结果进行正确性认证。
本实施例提供的全同态消息认证系统，在满足验证需求的前提下，通过终端获取消息认证密钥，该消息认证密钥包括：第一字符串为长度为n的0和1的字符串，且所述第一字符串中1的个数为2n/3，第二字符串为长度n的0和1的字符串，且与所述第一字符串中的1对应的位置上的字符包括n/3个0，根据该消息认证密钥生成待计算的数据的每个比特对应的认证指纹，并将待计算的数据、每个比特对应的认证指纹、全同态加密算法以及所述消息认证密钥发送给服务器，以使服务器计算待计算的数据的计算结果和所述计算结果对应的认证指纹并返回终端，根据接收器接收到的该计算结果对应的认证指纹对所述计算结果进行正确性认证，通过选择长度为n的0和1的第一字符串，且所述第一字符串中1的个数为2n/3，以及长度为n的0和1的第二字符串，且在所述第二字符串中，与所述第一字符串中的1对应的位置上的字符包括n/3个0，获取的待计算的数据的每个比特的认证指纹的第二分量中插入n2/3个0和1的密文，解决了现有技术中第一字符串为随机产生的集合{1，2，…，n-1，n}的长度为n/2的子集，在计算每个比特对应的认证指纹的过程中对于非1或0的随机数计算过程复杂的问题，有效降低终端算法的复杂性和计算量。
在上述实施例的基础上，所述终端121具体用于：根据预先配置的伪随机函数和所述待计算的数据中的第i个比特的标签生成所述第i个比特对应的认证指纹的第一分量；根据所述伪随机函数生成与所述待计算的 数据中的第i个比特对应的n个伪随机串；根据所述第一字符串、所述第二字符串和所述n个伪随机串生成所述第i个比特对应的n个密文作为所述第i个比特对应的认证指纹的第二分量，其中，若所述第一字符串中的第j个字符为0，则将所述第i个比特、所述公钥和所述第j个伪随机串输入预先配置的加密算法生成所述密文；若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为0，则将0、所述公钥和所述第j个伪随机串输入所述预先配置的加密算法生成所述密文；若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为1，则将1、所述公钥和所述第j个伪随机串输入所述预先配置的加密算法生成所述密文；其中，i为整数，大于或等于1，且小于或等于所述待计算的数据的总比特数t；j为整数，大于或等于1，且小于或等于n。
可选的，所述终端121还用于：获取重新计算的所述计算结果对应的认证指纹的第一分量；比较所述接收到的所述计算结果对应的认证指纹的第一分量与所述重新计算的所述计算结果对应的认证指纹的第一分量是否相等；若所述接收到的所述计算结果对应的认证指纹的第一分量与所述重新计算的所述计算结果对应的认证指纹的第一分量相等，则继续对所述计算结果进行正确性认证；若二者不相等，则确定所述计算结果不正确。
可选的，所述终端121具体用于根据所述待计算的数据的t个比特对应的t个所述认证指纹的第一分量，采用用于计算所述待计算的数据的计算函数，获取重新计算的所述计算结果对应的认证指纹的第一分量；或者，将所述待计算数据的t个比特对应的t个所述认证指纹的第一分量发送给第三方设备，以使所述第三方设备根据接收的所述待计算的数据的t个比特对应的t个所述认证指纹的第一分量，采用预先配置的用于计算待计算的数据的计算函数，获取重新计算的所述计算结果对应的认证指纹的第一分量；接收所述第三方设备返回的所述重新计算的所述计算结果对应的认证指纹的第一分量；其中，所述用于计算待计算的数据的计算函数为哈希树，所述哈希树包括：t个输入，1个输出，且所述哈希树中的各个节点均为所述安全哈希函数。
可选的，所述终端121还用于：根据所述私钥，分别计算所述接收到的所述计算结果对应的认证指纹的n个第二分量对应的n个明文；若所述 n个明文全部与所述计算结果相同，则确定所述计算结果正确。
可选的，所述服务器122具体用于：根据所述待计算的数据的t个比特，采用所述预先配置的用于计算待计算的数据的计算函数，获取所述待计算的数据的计算结果；其中，所述预先配置的用于计算待计算的数据的计算函数为哈希树，所述哈希树包括：t个输入，1个输出，且所述哈希树中的各个节点均为预先配置的安全哈希函数；t为所述待计算的数据的总比特数。
可选的，所述服务器122还用于：根据所述待计算的数据的t个比特对应的t个所述认证指纹的第一分量，采用所述预先配置的用于计算待计算的数据的计算函数，获取所述计算结果对应的认证指纹的第一分量；
根据所述计算结果、所述待计算的数据的每个比特对应的认证指纹的n个第二分量和所述计算钥，采用所述预先配置的全同态加密算法中的密文计算函数，获取所述计算结果对应的认证指纹的n个第二分量。
上述实施例提供的全同态消息认证系统，用于执行图1-7任一所示的方法实施例的技术方案，其实现原理和技术效果类似，在此不再赘述。
需说明的是，以上所描述的装置实施例仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。另外，本发明提供的装置实施例附图中，模块之间的连接关系表示它们之间具有通信连接，具体可以实现为一条或多条通信总线或信号线。本领域普通技术人员在不付出创造性劳动的情况下，即可以理解并实施。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到本发明可借助软件加必需的通用硬件的方式来实现，当然也可以通过专用硬件包括专用集成电路、专用CPU、专用存储器、专用元器件等来实现。一般情况下，凡由计算机程序完成的功能都可以很容易地用相应的硬件来实现，而且，用来实现同一功能的具体硬件结构也可以是多种多样的，例如模拟电路、数字电路或专用电路等。但是，对本发明而言更多情况下软件程序实现是更佳的实施方式。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储 在可读取的存储介质中，如计算机的软盘，U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例所述的方法。
最后应说明的是：以上各实施例仅用以说明本发明的技术方案，而非对其限制；尽管参照前述各实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分或者全部技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本发明各实施例技术方案的范围。

Claims (20)

  1. 一种全同态消息认证方法，其特征在于，所述方法应用于终端，包括：
    获取消息认证密钥，所述消息认证密钥包括公钥、第一字符串和第二字符串，所述第一字符串为长度为n的0和1的字符串，且所述第一字符串中字符为1的个数为2n/3；所述第二字符串为长度为n的0和1的字符串，且在所述第二字符串中，与所述第一字符串中的为1的字符对应的位置上的字符包括n/3个0，其中，n为大于或等于2的整数；
    根据第一输入字符、所述公钥和伪随机串生成待计算的数据中的第i个比特对应的n个密文中的一个，确定所述n个密文为所述第i个比特对应的认证指纹的第二分量，其中，若所述第一字符串中的第j个字符为0，则所述第一输入字符为所述第i个比特，或者，若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为0，则所述第一输入字符为0，或者，若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为1，则所述第一输入字符为1；所述第i个比特对应的认证指纹还包括第一分量；其中，i为整数，大于或等于1，且小于或等于所述待计算的数据的总比特数t，t大于或等于1；j为整数，大于或等于1，且小于或等于n；
    向服务器发送计算请求，所述计算请求包括：所述待计算的数据，所述待计算的数据中的每个比特对应的认证指纹、预先配置的全同态加密算法以及所述消息认证密钥；
    接收所述服务器返回的所述待计算的数据的计算结果以及所述计算结果对应的认证指纹；
    根据接收到的所述计算结果对应的认证指纹对所述计算结果进行正确性认证。
  2. 根据权利要求1所述的方法，其特征在于，所述第i个比特对应的认证指纹由以下步骤生成，包括：
    根据预先配置的伪随机函数和所述待计算的数据中的第i个比特的标签生成所述第i个比特对应的认证指纹的第一分量；
    根据所述伪随机函数生成与所述待计算的数据中的第i个比特对应的 n个伪随机串；
    根据所述第一字符串、所述第二字符串和所述n个伪随机串生成所述第i个比特对应的n个密文作为所述第i个比特对应的认证指纹的第二分量，其中，若所述第一字符串中的第j个字符为0，则将所述第i个比特、所述公钥和所述第j个伪随机串输入预先配置的加密算法生成一个密文；若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为0，则将0、所述公钥和所述第j个伪随机串输入所述预先配置的加密算法生成一个密文；若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为1，则将1、所述公钥和所述第j个伪随机串输入所述预先配置的加密算法生成一个密文。
  3. 根据权利要求2所述的方法，其特征在于，根据接收到的所述计算结果对应的认证指纹对所述计算结果进行正确性认证，包括：
    获取重新计算的所述计算结果对应的认证指纹的第一分量；
    比较所述接收到的所述计算结果对应的认证指纹的第一分量与所述重新计算的所述计算结果对应的认证指纹的第一分量是否相等；
    若所述接收到的所述计算结果对应的认证指纹的第一分量与所述重新计算的所述计算结果对应的认证指纹的第一分量相等，则继续对所述计算结果进行正确性认证；若二者不相等，则确定所述计算结果不正确。
  4. 根据权利要求3所述的方法，其特征在于，所述获取重新计算的所述计算结果对应的认证指纹的第一分量，包括：
    根据所述待计算的数据的t个比特对应的t个所述认证指纹的第一分量，采用用于计算所述待计算的数据的计算函数，获取重新计算的所述计算结果对应的认证指纹的第一分量；
    其中，所述用于计算待计算的数据的计算函数为哈希树，所述哈希树包括：t个输入，1个输出，且所述哈希树中的各个节点均为预先配置的安全哈希函数。
  5. 根据权利要求3所述的方法，其特征在于，所述获取重新计算的所述计算结果对应的认证指纹的第一分量，包括：
    将所述待计算数据的t个比特对应的t个所述认证指纹的第一分量发送给 第三方设备，以使所述第三方设备根据接收的所述待计算的数据的t个比特对应的t个所述认证指纹的第一分量，采用预先配置的用于计算待计算的数据的计算函数，获取重新计算的所述计算结果对应的认证指纹的第一分量；
    接收所述第三方设备返回的所述重新计算的所述计算结果对应的认证指纹的第一分量；
    其中，所述用于计算待计算的数据的计算函数为哈希树，所述哈希树包括：t个输入，1个输出，且所述哈希树中的各个节点均为所述安全哈希函数。
  6. 根据权利要求3至5任一所述的方法，其特征在于，所述消息认证密钥还包括私钥，所述接收到的所述计算结果对应的认证指纹的第一分量与所述重新计算的所述计算结果对应的认证指纹的第一分量相等，则继续对所述计算结果进行正确性认证，包括：
    根据所述私钥，分别计算所述接收到的所述计算结果对应的认证指纹的n个第二分量对应的n个明文；
    若所述n个明文全部与所述计算结果相同，则确定所述计算结果正确。
  7. 一种全同态消息认证方法，其特征在于，所述方法应用于服务器，包括：
    接收终端发送的计算请求，所述计算请求包括：待计算的数据，所述待计算的数据中的每个比特对应的认证指纹、预先配置的全同态加密算法以及消息认证密钥；
    根据预先配置的用于计算待计算的数据的计算函数以及所述待计算的数据，计算所述待计算的数据的计算结果；
    根据所述预先配置的用于计算待计算的数据的计算函数、所述待计算的数据的计算结果、所述待计算的数据中的每个比特对应的认证指纹，所述预先配置的全同态加密算法以及所述消息认证密钥，计算所述计算结果对应的认证指纹；
    将所述待计算的数据的计算结果以及所述计算结果对应的认证指纹返回所述终端，以供所述终端根据接收到的所述计算结果对应的认证指纹对所述计算结果进行正确性认证。
  8. 根据权利要求7所述的方法，其特征在于，所述根据预先配置的 用于计算待计算的数据的计算函数以及所述待计算的数据，计算所述待计算的数据的计算结果，包括：
    根据所述待计算的数据的t个比特，采用所述预先配置的用于计算待计算的数据的计算函数，获取所述待计算的数据的计算结果；
    其中，所述预先配置的用于计算待计算的数据的计算函数为哈希树，所述哈希树包括：t个输入，1个输出，且所述哈希树中的各个节点均为预先配置的安全哈希函数；t为所述待计算的数据的总比特数。
  9. 根据权利要求8所述的方法，其特征在于，所述待计算的数据中的每个比特对应的认证指纹包括第一分量和n个第二分量，且所述消息认证密钥包括计算钥，则所述根据所述预先配置的用于计算待计算的数据的计算函数、所述待计算的数据的计算结果、所述待计算的数据中的每个比特对应的认证指纹，所述预先配置的全同态加密算法以及所述消息认证密钥，计算所述计算结果对应的认证指纹，包括：
    根据所述待计算的数据的t个比特对应的t个所述认证指纹的第一分量，采用所述预先配置的用于计算待计算的数据的计算函数，获取所述计算结果对应的认证指纹的第一分量；
    根据所述计算结果、所述待计算的数据的每个比特对应的认证指纹的n个第二分量和所述计算钥，采用所述预先配置的全同态加密算法中的密文计算函数，获取所述计算结果对应的认证指纹的n个第二分量。
  10. 一种全同态消息认证装置，其特征在于，包括：
    获取模块，用于获取消息认证密钥，所述消息认证密钥包括公钥、第一字符串和第二字符串，所述第一字符串为长度为n的0和1的字符串，且所述第一字符串中字符为1的个数为2n/3；所述第二字符串为长度为n的0和1的字符串，且在所述第二字符串中，与所述第一字符串中的为1的字符对应的位置上的字符包括n/3个0，其中，n为大于或等于2的整数；
    生成模块，用于根据第一输入字符、所述公钥和伪随机串生成待计算的数据中的第i个比特对应的n个密文中的一个，确定所述n个密文为所述第i个比特对应的认证指纹的第二分量，其中，若所述第一字符串中的第j个字符为0，则所述第一输入字符为所述第i个比特，或者，若所 述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为0，则所述第一输入字符为0，或者，若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为1，则所述第一输入字符为1；所述第i个比特对应的认证指纹还包括第一分量；其中，i为整数，大于或等于1，且小于或等于所述待计算的数据的总比特数t，t大于或等于1；j为整数，大于或等于1，且小于或等于n；
    收发模块，用于向服务器发送计算请求，所述计算请求包括：所述待计算的数据，所述待计算的数据中的每个比特对应的认证指纹、预先配置的全同态加密算法以及所述消息认证密钥；
    所述收发模块还用于接收所述服务器返回的所述待计算的数据的计算结果以及所述计算结果对应的认证指纹；
    处理模块，用于根据所述收发模块接收到的所述计算结果对应的认证指纹对所述计算结果进行正确性认证。
  11. 根据权利要求10所述的装置，其特征在于，所述生成模块具体用于：
    根据预先配置的伪随机函数和所述待计算的数据中的第i个比特的标签生成所述第i个比特对应的认证指纹的第一分量；
    根据所述伪随机函数生成与所述待计算的数据中的第i个比特对应的n个伪随机串；
    根据所述第一字符串、所述第二字符串和所述n个伪随机串生成所述第i个比特对应的n个密文作为所述第i个比特对应的认证指纹的第二分量，其中，若所述第一字符串中的第j个字符为0，则将所述第i个比特、所述公钥和所述第j个伪随机串输入预先配置的加密算法生成一个密文；若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为0，则将0、所述公钥和所述第j个伪随机串输入所述预先配置的加密算法生成一个密文；若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为1，则将1、所述公钥和所述第j个伪随机串输入所述预先配置的加密算法生成一个密文。
  12. 根据权利要求10或11所述的装置，其特征在于，所述处理模块具体用于：
    获取重新计算的所述计算结果对应的认证指纹的第一分量；
    比较所述接收到的所述计算结果对应的认证指纹的第一分量与所述重新计算的所述计算结果对应的认证指纹的第一分量是否相等；
    若所述接收到的所述计算结果对应的认证指纹的第一分量与所述重新计算的所述计算结果对应的认证指纹的第一分量相等，则继续对所述计算结果进行正确性认证；若二者不相等，则确定所述计算结果不正确。
  13. 根据权利要求12所述的装置，其特征在于，所述处理模块还用于根据获取的所述待计算的数据的t个比特对应的t个所述认证指纹的第一分量，采用用于计算待计算的数据的计算函数，获取重新计算的所述计算结果对应的认证指纹的第一分量；
    其中，所述用于计算待计算的数据的计算函数为哈希树，所述哈希树包括：t个输入，1个输出，且所述哈希树中的各个节点均为预先配置的安全哈希函数。
  14. 根据权利要求12所述的装置，其特征在于，所述收发模块还用于：
    将所述待计算数据的t个比特对应的t个所述认证指纹的第一分量发送给第三方设备，以使所述第三方设备根据接收的所述待计算的数据的t个比特对应的t个所述认证指纹的第一分量，采用预先配置的用于计算待计算的数据的计算函数，获取重新计算的所述计算结果对应的认证指纹的第一分量；
    接收所述第三方设备返回的所述重新计算的所述计算结果对应的认证指纹的第一分量；
    其中，所述用于计算待计算的数据的计算函数为哈希树，所述哈希树包括：t个输入，1个输出，且所述哈希树中的各个节点均为所述安全哈希函数。
  15. 根据权利要求12至14任一所述的装置，其特征在于，所述消息认证密钥还包括私钥，所述处理模块还用于：
    根据所述私钥，分别计算所述接收到的所述计算结果对应的认证指纹的n个第二分量对应的n个明文；
    判断若所述n个明文全部与所述计算结果相同，则确定所述计算结果正确。
  16. 一种全同态消息认证装置，其特征在于，包括：
    收发模块，用于接收终端发送的计算请求，所述计算请求包括：待计算的数据，所述待计算的数据中的每个比特对应的认证指纹、全同态加密算法以及消息认证密钥；
    处理模块，用于根据预先配置的用于计算待计算的数据的计算函数以及所述待计算的数据，计算所述待计算的数据的计算结果；
    所述处理模块还用于根据所述预先配置的用于计算待计算的数据的计算函数、所述待计算的数据的计算结果、所述待计算的数据中的每个比特对应的认证指纹，所述预先配置的全同态加密算法以及所述消息认证密钥，计算所述计算结果对应的认证指纹；
    所述收发模块还用于将所述待计算的数据的计算结果以及所述计算结果对应的认证指纹返回所述终端，以供所述终端根据接收到的所述计算结果对应的认证指纹对所述计算结果进行正确性认证。
  17. 根据权利要求16所述的装置，其特征在于，所述处理模块具体用于：
    根据所述待计算的数据的t个比特，采用所述预先配置的用于计算待计算的数据的计算函数，获取所述待计算的数据的计算结果；
    其中，所述预先配置的用于计算待计算的数据的计算函数为哈希树，所述哈希树包括：t个输入，1个输出，且所述哈希树中的各个节点均为预先配置的安全哈希函数；t为所述待计算的数据的总比特数。
  18. 根据权利要求17所述的装置，其特征在于，所述待计算的数据中的每个比特对应的认证指纹包括第一分量和n个第二分量，且所述消息认证密钥包括计算钥，则所述处理模块还用于：
    根据所述待计算的数据的t个比特对应的t个所述认证指纹的第一分量，采用所述预先配置的用于计算待计算的数据的计算函数，获取所述计算结果对应的认证指纹的第一分量；
    根据所述计算结果、所述待计算的数据的每个比特对应的认证指纹的n个第二分量和所述计算钥，采用所述预先配置的全同态加密算法中的密文计算函数，获取所述计算结果对应的认证指纹的n个第二分量。
  19. 一种全同态消息认证系统，其特征在于，所述系统包括终端和服务 器，其中，
    所述终端用于获取消息认证密钥，所述消息认证密钥包括：第一字符串和第二字符串，所述第一字符串为长度为n的0和1的字符串，且所述第一字符串中1的个数为2n/3；所述第二字符串为长度为n的0和1的字符串，且在所述第二字符串中，与所述第一字符串中的1对应的位置上的字符包括n/3个0；n为大于或等于2的整数；根据第一输入字符、所述公钥和伪随机串生成待计算的数据中的第i个比特对应的n个密文中的一个，确定所述n个密文为所述第i个比特对应的认证指纹的第二分量，其中，若所述第一字符串中的第j个字符为0，则所述第一输入字符为所述第i个比特，或者，若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为0，则所述第一输入字符为0，或者，若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为1，则所述第一输入字符为1；所述第i个比特对应的认证指纹还包括第一分量；其中，i为整数，大于或等于1，且小于或等于所述待计算的数据的总比特数t，t大于或等于1；j为整数，大于或等于1，且小于或等于n；向所述服务器发送计算请求，所述计算请求包括：所述待计算的数据，所述待计算的数据中的每个比特对应的认证指纹、预先配置的全同态加密算法以及所述消息认证密钥；接收所述服务器返回的所述待计算的数据的计算结果以及所述计算结果对应的认证指纹；根据接收到的所述计算结果对应的认证指纹对所述计算结果进行正确性认证；
    所述服务器用于：接收终端发送的计算请求；根据预先配置的用于计算待计算的数据的计算函数以及所述待计算的数据，计算所述待计算的数据的计算结果；根据所述预先配置的用于计算待计算的数据的计算函数、所述待计算的数据的计算结果、所述待计算的数据中的每个比特对应的认证指纹，所述预先配置的全同态加密算法以及所述消息认证密钥，计算所述计算结果对应的认证指纹；将所述待计算的数据的计算结果以及所述计算结果对应的认证指纹返回所述终端，以供所述终端根据接收到的所述计算结果对应的认证指纹对所述计算结果进行正确性认证。
  20. 根据权利要求19所述的系统，其特征在于，所述终端具体用 于：根据预先配置的伪随机函数和所述待计算的数据中的第i个比特的标签生成所述第i个比特对应的认证指纹的第一分量；根据所述伪随机函数生成与所述待计算的数据中的第i个比特对应的n个伪随机串；根据所述第一字符串、所述第二字符串和所述n个伪随机串生成所述第i个比特对应的n个密文作为所述第i个比特对应的认证指纹的第二分量，其中，若所述第一字符串中的第j个字符为0，则将所述第i个比特、所述公钥和所述第j个伪随机串输入预先配置的加密算法生成所述密文；若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为0，则将0、所述公钥和所述第j个伪随机串输入所述预先配置的加密算法生成所述密文；若所述第一字符串中的第j个字符为1并且所述第二个字符串中的第j个字符为1，则将1、所述公钥和所述第j个伪随机串输入所述预先配置的加密算法生成所述密文；其中，i为整数，大于或等于1，且小于或等于所述待计算的数据的总比特数t；j为整数，大于或等于1，且小于或等于n。
PCT/CN2015/072570 2014-06-30 2015-02-09 全同态消息认证方法、装置及系统 WO2016000453A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP15775600.8A EP3163792B1 (en) 2014-06-30 2015-02-09 Fully homomorphic message authentication method, device and system
US14/985,883 US10009343B2 (en) 2014-06-30 2015-12-31 Method, apparatus, and system for authenticating fully homomorphic message

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410309571.3A CN105337736B (zh) 2014-06-30 2014-06-30 全同态消息认证方法、装置及系统
CN201410309571.3 2014-06-30

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US14/985,883 Continuation US10009343B2 (en) 2014-06-30 2015-12-31 Method, apparatus, and system for authenticating fully homomorphic message

Publications (1)

Publication Number Publication Date
WO2016000453A1 true WO2016000453A1 (zh) 2016-01-07

Family

ID=55018404

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/072570 WO2016000453A1 (zh) 2014-06-30 2015-02-09 全同态消息认证方法、装置及系统

Country Status (4)

Country Link
US (1) US10009343B2 (zh)
EP (1) EP3163792B1 (zh)
CN (1) CN105337736B (zh)
WO (1) WO2016000453A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109413506A (zh) * 2018-09-30 2019-03-01 武汉斗鱼网络科技有限公司 一种弹幕数据的校验方法、装置、终端及存储介质
US20210081807A1 (en) * 2019-09-17 2021-03-18 Sap Se Non-Interactive Private Decision Tree Evaluation

Families Citing this family (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170293913A1 (en) * 2016-04-12 2017-10-12 The Governing Council Of The University Of Toronto System and methods for validating and performing operations on homomorphically encrypted data
IT201600105253A1 (it) * 2016-10-19 2018-04-19 Torino Politecnico Dispositivo e metodi per l'autenticazione di unn apparato d'utente
US11777729B2 (en) 2017-01-20 2023-10-03 Enveil, Inc. Secure analytics using term generation and homomorphic encryption
US10728018B2 (en) 2017-01-20 2020-07-28 Enveil, Inc. Secure probabilistic analytics using homomorphic encryption
US10721057B2 (en) 2017-01-20 2020-07-21 Enveil, Inc. Dynamic channels in secure queries and analytics
US11196541B2 (en) 2017-01-20 2021-12-07 Enveil, Inc. Secure machine learning analytics using homomorphic encryption
US11507683B2 (en) 2017-01-20 2022-11-22 Enveil, Inc. Query processing with adaptive risk decisioning
US10873568B2 (en) 2017-01-20 2020-12-22 Enveil, Inc. Secure analytics using homomorphic and injective format-preserving encryption and an encrypted analytics matrix
EP3503456A1 (en) * 2017-12-19 2019-06-26 Koninklijke Philips N.V. Homomorphic encryption for password authentication
CN110661610B (zh) * 2018-06-29 2020-11-03 创新先进技术有限公司 安全多方计算协议的输入获取方法和装置
US10902133B2 (en) 2018-10-25 2021-01-26 Enveil, Inc. Computational operations in enclave computing environments
US10817262B2 (en) 2018-11-08 2020-10-27 Enveil, Inc. Reduced and pipelined hardware architecture for Montgomery Modular Multiplication
US10554637B1 (en) * 2019-05-01 2020-02-04 Cyberark Software Ltd. Secure and reconstructible distribution of data among network resources
US11601258B2 (en) 2020-10-08 2023-03-07 Enveil, Inc. Selector derived encryption systems and methods
CN112182660B (zh) * 2020-10-28 2024-09-20 深圳前海微众银行股份有限公司 一种数据排序方法及装置

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102012980A (zh) * 2010-11-16 2011-04-13 中国科学技术大学苏州研究院 基于同态加密系统的文本信息隐藏安全检测方法
CN102082665A (zh) * 2009-11-30 2011-06-01 中国移动通信集团公司 一种eap认证中的标识认证方法、系统和设备
CN103475472A (zh) * 2013-07-22 2013-12-25 浙江万里学院 环lwe上ntru型的全同态加密方法

Family Cites Families (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2009076669A1 (en) 2007-12-13 2009-06-18 Massachusetts Institute Of Technology Private data processing
US8630422B2 (en) 2009-11-10 2014-01-14 International Business Machines Corporation Fully homomorphic encryption method based on a bootstrappable encryption scheme, computer program and apparatus
US8861716B2 (en) 2010-03-30 2014-10-14 International Business Machines Corporation Efficient homomorphic encryption scheme for bilinear forms
US8903083B2 (en) 2010-08-16 2014-12-02 International Business Machines Corporation Fast evaluation of many polynomials with small coefficients on the same point
JP2012049679A (ja) 2010-08-25 2012-03-08 Sony Corp 端末装置、サーバ、データ処理システム、データ処理方法、及びプログラム
WO2013080204A1 (en) * 2011-11-28 2013-06-06 Porticor Ltd. Methods and devices for securing keys for a non-secured, distributed environment with applications to virtualization and cloud-computing security and management
US8667288B2 (en) * 2012-05-29 2014-03-04 Robert Bosch Gmbh System and method for message verification in broadcast and multicast networks
WO2014016795A2 (en) * 2012-07-26 2014-01-30 Nds Limited Method and system for homomorphicly randomizing an input
JP2014126865A (ja) * 2012-12-27 2014-07-07 Fujitsu Ltd 暗号処理装置および方法
EP2719149B1 (en) * 2013-04-05 2015-09-16 Nec Corporation Method and system for modifying an authenticated and/or encrypted message
JP2014209677A (ja) * 2013-04-16 2014-11-06 株式会社東芝 データ管理装置、電力使用量計算システム、データ管理方法、及びデータ管理プログラム
US10163370B2 (en) * 2013-07-18 2018-12-25 Nippon Telegraph And Telephone Corporation Decoding apparatus, decoding capability providing apparatus, method thereof and program
US10037544B2 (en) * 2013-12-18 2018-07-31 Intel Corporation Technologies for collecting advertising statistics in a privacy sensitive manner
US9264407B2 (en) * 2014-04-03 2016-02-16 Palo Alto Research Center Incorporated Computer-implemented system and method for establishing distributed secret shares in a private data aggregation scheme
US10148291B2 (en) * 2014-04-24 2018-12-04 University Of Maryland, College Park Practical dynamic proofs of retrievability with multiple buffers
US20150365227A1 (en) * 2014-06-11 2015-12-17 International Business Machines Corporation Shared security utility appliance for secure application and data processing

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102082665A (zh) * 2009-11-30 2011-06-01 中国移动通信集团公司 一种eap认证中的标识认证方法、系统和设备
CN102012980A (zh) * 2010-11-16 2011-04-13 中国科学技术大学苏州研究院 基于同态加密系统的文本信息隐藏安全检测方法
CN103475472A (zh) * 2013-07-22 2013-12-25 浙江万里学院 环lwe上ntru型的全同态加密方法

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109413506A (zh) * 2018-09-30 2019-03-01 武汉斗鱼网络科技有限公司 一种弹幕数据的校验方法、装置、终端及存储介质
CN109413506B (zh) * 2018-09-30 2021-06-11 武汉斗鱼网络科技有限公司 一种弹幕数据的校验方法、装置、终端及存储介质
US20210081807A1 (en) * 2019-09-17 2021-03-18 Sap Se Non-Interactive Private Decision Tree Evaluation
US12106227B2 (en) * 2019-09-17 2024-10-01 Sap Se Non-interactive private decision tree evaluation

Also Published As

Publication number Publication date
CN105337736A (zh) 2016-02-17
CN105337736B (zh) 2018-10-30
EP3163792A4 (en) 2018-02-28
EP3163792B1 (en) 2019-08-28
US10009343B2 (en) 2018-06-26
US20160119346A1 (en) 2016-04-28
EP3163792A1 (en) 2017-05-03

Similar Documents

Publication Publication Date Title
WO2016000453A1 (zh) 全同态消息认证方法、装置及系统
CN108111301B (zh) 基于后量子密钥交换实现ssh协议的方法及其系统
US11082224B2 (en) Location aware cryptography
JP6221014B1 (ja) 安全な共有鍵共有システム及び方法
WO2018046009A1 (zh) 一种区块链身份系统
US8331568B2 (en) Efficient distribution of computation in key agreement
CN115549887A (zh) 用于信息的安全交换的公共秘密的确定和层级确定性密钥
WO2022120699A1 (zh) 单向代理重加密方法、装置、电子设备及系统
US20110314284A1 (en) Method for securing transmission data and security system for implementing the same
CN115580396B (zh) 匿踪查询系统及匿踪查询方法
CN103414559B (zh) 一种云计算环境下的基于类ibe系统的身份认证方法
CN109309566B (zh) 一种认证方法、装置、系统、设备及存储介质
KR102432356B1 (ko) 키 생성 장치 및 방법, 암호화 장치 및 방법
CN115065457B (zh) 数据查询方法及装置
KR20170053063A (ko) 일회용 개인키 기반 전자 서명과 동형 암호를 이용한 패스워드 기반 사용자 인증 방법
KR102103179B1 (ko) 블록체인 오라클에서의 프라이버시 보호를 위한 영지식 증명 시스템 및 그 방법
WO2018076798A1 (zh) 一种传输数据的方法和装置
US20170085387A1 (en) Signature generation and verification system
CN111565108B (zh) 签名处理方法、装置及系统
JPWO2016199507A1 (ja) 鍵交換方法、鍵交換システム、鍵配送装置、通信装置、およびプログラム
CN106534077B (zh) 一种基于对称密码的可认证的代理重加密系统及方法
CN115412365B (zh) 基于多层加密的数据隐私保护方法
CN116155598A (zh) 多服务器架构下的认证方法及系统
TWI599909B (zh) Electronic signature verification system
CN114398658A (zh) 数据处理方法及设备

Legal Events

Date Code Title Description
REEP Request for entry into the european phase

Ref document number: 2015775600

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2015775600

Country of ref document: EP

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15775600

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE