Method, apparatus, and system for authenticating fully homomorphic message

Patent metadata

Field	Value
Publication number	US-2016119346-A1
Application number	US-201514985883-A
Country	US
Kind code	A1
Filing date	Dec 31, 2015
Priority date	Jun 30, 2014
Publication date	Apr 28, 2016
Grant date	—

Abstract

Embodiments of the present disclosure provide a method, an apparatus, and a system for authenticating a fully homomorphic message, where the method includes: acquiring a message authentication key, where: the message authentication key includes a public key, a first character string, and a second character string; the first character string is a character string that consists of 0 and 1 and has a length of n; the second character string is a character string that consists of 0 and 1 and has a length of n; generating an authentication fingerprint corresponding to each bit of to-be-computed data; sending a computation request to a server; receiving an authentication fingerprint corresponding to the computation result; and performing correctness authentication on the computation result according to the received authentication fingerprint, which effectively reduces an amount of computation in a verification process.

First claim

What is claimed is:

1 . A method for authenticating a fully homomorphic message, wherein the method is applied to a terminal and comprises:
acquiring a message authentication key that comprises a public key, a first character string, and a second character string; the first character string is a character string that consists of 0 and 1 and has a length of n, and a quantity of characters 1 in the first character string is 2n/3; the second character string is a character string that consists of 0 and 1 and has a length of n, and in the second character string, characters at locations corresponding to the character 1 in the first character string comprise character 0 whose quantity is n/3; and n is an integer greater than or equal to 2; generating, according to a first input character, the public key, and a pseudo random string, one of n ciphertexts corresponding to the i th bit of to-be-computed data, and determining that the n ciphertexts are a second component of an authentication fingerprint corresponding to the i th bit, wherein: if the j th character of the first character string is 0, the first input character is the i th bit, or if the j th character of the first character string is 1 and the j th character of the second character string is 0, the first input character is 0, or if the j th character of the first character string is 1 and the j th character of the second character string is 1, the first input character is 1; the authentication fingerprint corresponding to the i th bit further comprises a first component; i is an integer that is greater than or equal to 1 and less than or equal to a total quantity t of bits of the to-be-computed data, wherein t is greater than or equal to 1; and j is an integer that is greater than or equal to 1 and less than or equal to n; sending a computation request to a server comprising the to-be-computed data, an authentication fingerprint corresponding to each bit of the to-be-computed data, a pre-configured fully homomorphic encryption algorithm, and the message authentication key; receiving a computation result of the to-be-computed data and an authentication fingerprint corresponding to the computation result that are returned by the server; and performing correctness authentication on the computation result according to the received authentication fingerprint corresponding to the computation result.

2 . The method according to claim 1 , wherein the authentication fingerprint corresponding to the i th bit is generated by executing the following steps:
generating, according to a pre-configured pseudo random function and a label of the i th bit of the to-be-computed data, the first component of the authentication fingerprint corresponding to the i th bit; generating, according to the pseudo random function, n pseudo random strings corresponding to the i th bit of the to-be-computed data; and generating, according to the first character string, the second character string, and the n pseudo random strings, the n ciphertexts corresponding to the i th bit, wherein the n ciphertexts serve as the second component of the authentication fingerprint corresponding to the i th bit, wherein: the i th bit, the public key, and the j th pseudo random string are input into the pre-configured encryption algorithm to generate a ciphertext if the j th character of the first character string is 0; or 0, the public key, and the j th pseudo random string are input into the pre-configured encryption algorithm to generate a ciphertext if the j th character of the first character string is 1 and the j th character of the second character string is 0; or 1, the public key, and the j th pseudo random string are input into the pre-configured encryption algorithm to generate a ciphertext if the j th character of the first character string is 1 and j th character of the second character string is 1.

3 . The method according to claim 2 , wherein the performing correctness authentication on the computation result according to the received authentication fingerprint corresponding to the computation result comprises:
acquiring a first component of the authentication fingerprint corresponding to the computation result, wherein the first component is obtained by means of recomputation; determining, by means of comparison, whether a first component of the received authentication fingerprint corresponding to the computation result is equal to the first component of the authentication fingerprint corresponding to the computation result, wherein the latter is obtained by means of recomputation; and performing correctness authentication on the computation result if the first component of the received authentication fingerprint corresponding to the computation result is equal to the first component of the authentication fingerprint corresponding to the computation result, wherein the latter is obtained by means of recomputation; or determining that the computation result is incorrect if the two are unequal.

4 . The method according to claim 3 , wherein the acquiring a first component of the authentication fingerprint corresponding to the computation result, wherein the first component is obtained by means of recomputation comprises:
acquiring, according to first components of t authentication fingerprints corresponding to the t bits of the to-be-computed data and by using a computation function used to compute the to-be-computed data, the first component of the authentication fingerprint corresponding to the computation result, wherein the first component is obtained by means of recomputation, wherein the computation function used to compute the to-be-computed data is a hash tree, wherein the hash tree comprises t inputs and one output, and each node in the hash tree is a pre-configured secure hash function.

5 . The method according to claim 3 , wherein the acquiring a first component of the authentication fingerprint corresponding to the computation result, wherein the first component is obtained by means of recomputation comprises:
sending first components of t authentication fingerprints corresponding to the t bits of the to-be-computed data to a third-party device, so that the third-party device acquires, according to the received first components of the t authentication fingerprints corresponding to the t bits of the to-be-computed data and by using a pre-configured computation function used to compute the to-be-computed data, the first component of the authentication fingerprint corresponding to the computation result, wherein the first component is obtained by means of recomputation; and receiving the first component of the authentication fingerprint corresponding to the computation result, wherein the first component is obtained by means of recomputation and returned by the third-party device, and the computation function used to compute the to-be-computed data is a hash tree, wherein the hash tree comprises t inputs and one output, and each node in the hash tree is a secure hash function.

6 . The method according to claim 3 , wherein the message authentication key further comprises a private key, and the continuing performing correctness authentication on the computation result if the first component of the received authentication fingerprint corresponding to the computation result is equal to the first component of the authentication fingerprint corresponding to the computation result, wherein the first component is obtained by means of recomputation comprises:
separately computing, according to the private key, n plaintexts corresponding to n second components of the received authentication fingerprint corresponding to the computation result; and determining that the computation result is correct if the n plaintexts are all the same as the c

Assignees

• Huawei Tech Co Ltd

Inventors

• Chen Wenbin
• Lei Hao
• Yang Qinqin

Classifications

• H04L9/008

  involving homomorphic encryption · CPC title

• H04L9/32

  including means for verifying the identity or authority of a user of the system {or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials} · CPC title

• H04L63/0861

  using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231) · CPC title

• H04L63/0876 Primary

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• H04L63/123

  received data contents, e.g. message integrity · CPC title