• 专利附录
  • 专利说明
  • 权利要求
  • 类似技术
  • 同族专利
  • 引用文献
  • 法律状态
  • 优先权
    • 专利摘要:
    The present invention relates to a method for securely classifying data by a computer platform. A client transmits to the platform its data to be classified in encrypted form by means of a first symmetric key. Similarly, a provider transmits to the platform the parameters of a classification model in encrypted form by means of a second symmetric key. The invention uses a homomorphic cryptosystem defined by a public key and a private key. The platform performs a first transcryption step by decrypting the data to be classified in the homomorphic domain and a second transcryption step by decrypting the parameters of the model in the homomorphic domain. The classification function is then evaluated in the homomorphic domain to provide an encrypted classification result by means of said public key.
    公开号:FR3060165A1
    申请号:FR1662244
    申请日:2016-12-09
    公开日:2018-06-15
    发明作者:Oana STAN；Renaud Sirdey；Sergiu CARPOV
    申请人:Commissariat a lEnergie Atomique CEA；Commissariat a lEnergie Atomique et aux Energies Alternatives CEA；
    IPC主号:
    专利说明:

    Holder (s): COMMISSIONER OF ATOMIC ENERGY AND ALTERNATIVE ENERGIES Public establishment.
    Extension request (s)
    Agent (s): BREVALEX.
    104) SECURE CLASSIFICATION METHOD USING A TRANSCHIPMENT OPERATION.
    FR 3 060 165 - A1 (57) The present invention relates to a method for the secure classification of data by a computer platform. A client transmits to the platform their data to be classified in encrypted form using a first symmetric key. Similarly, a supplier transmits the parameters of a classification model to the platform in encrypted form using a second symmetric key. The invention uses a homomorphic crypto system defined by a public key and a private key. The platform performs a first transciphering step by decrypting the data to be classified in the homomorphic domain and a second transciphering step by deciphering the parameters of the model in the homomorphic domain. The classification function is then evaluated in the homomorphic domain to provide a classification result encrypted using said public key.
    i
    SECURE CLASSIFICATION METHOD USING TRANS-ENCRYPTION OPERATION
    DESCRIPTION
    TECHNICAL AREA
    The present invention relates generally to the field of secure data processing in cloud computing (Cloud Computing).
    PRIOR STATE OF THE ART
    It is more and more common to entrust the processing of data to external IT platforms, located on the "Cloud", that is to say accessible via the Internet. For example, a user can use a cloud-hosted IT platform to classify some of their data.
    By data classification (or classification or data discrimination) is meant a function f from X to C, called a classification model, which with any data x from X associates a class c of C. Alternatively, the classification model can be probabilistic and, in this case, the function f gives for each class c of C, the probability that the data x belongs to the class c.
    The classification model is generally constructed from a set, called a learning set, made up of pairs (%, c) of initial data and corresponding classes. For example, the set X can be made up of N-tuples of medical parameters and the set Y by a duplicate where c is the diagnosis of a pathology and c the absence of this pathology.
    The training data set is often very large. It results in practice from the collection of data from several sources, hereinafter called data providers. The users of the classification service, referred to hereinafter as customers, generally only have low computing and / or memory resources (this is particularly the case when these users are equipped with mobile terminals) and, for this reason, do not can download all of this data to perform the classification operation themselves. Customers must use an IT platform responsible for establishing the model and classifying the data. This data can be for example medical data, energy consumption data, financial data, etc.
    However, the use of a remote IT platform poses the problem of the confidentiality of the data transmitted, for two reasons. First of all, the confidentiality of learning should be preserved, i.e. learning data collected and aggregated from suppliers (for example from hospitals, energy suppliers, banks , insurance companies, etc.) as well as classification models developed from this data (model parameters in particular). In this case, the data of the suppliers and the parameters of the model must be kept confidential vis-à-vis the platform and / or the customers of the classification service. On the other hand, it is necessary to preserve the confidentiality of the classification, that is to say the customer's data intended to be the object of the classification operation, as well as the result of this same classification. It could be, for example, a medical history, the client's energy consumption for a natural person, or the client's financial statement or portfolio for a business.
    The methods of secure classification (privacy-preserving classification) of data, that is to say the classification methods preserving the confidentiality of data, have been the subject of several recent publications.
    The article by R. Bost ef al. entitled “Machine learning classification over encrypted data” published in Cryptology Eprint Archive, Report 1014/331, 2014, notably proposes a secure classification method based on different possible algorithms (classification by hyperplanes, naive Bayes classification, classification by private decision trees) can operate on both clear data and encrypted data. The classification on encrypted data uses cryptosystems such as the quadratic residue cryptosystem of Goldwasser Micali, the Pallier cryptosystem as well as a totally homomorphic cryptosystem (FHE). However, this secure classification method requires the exchange of numerous messages between the parties and therefore leads to a relatively long execution time.
    The article by T. Graepel et ol. entitled "ML confidential: machine learning on encrypted data" published in Cryptology Eprint Archive, Report 2012/323, 2012, describes a machine learning method in which the learning and classification phases are performed on data encrypted by a capped homomorphic encryption or LHE (Levelled Homomorphic Encryption). Different classification algorithms are considered such as classification by hyperplanes or LM (Linear Means) and classification by Fischer's linear discriminant. Homomorphic data encryption is not very suitable for low-resource terminals, the messages containing the encrypted data are large and the execution time particularly long.
    The problem underlying the invention is therefore to propose a method for secure classification of data by a remote computer platform which does not have the drawbacks of the prior art, in particular which does not require the sending of a large number of messages or even the sending of long messages to the platform and which consequently makes it possible to obtain a considerably shorter execution time than in the prior art.
    STATEMENT OF THE INVENTION
    The present invention is defined by a method of secure classification of data by a computer platform, comprising:
    a step of sending data to be classified, from at least one client to said computer platform, the data being sent in encrypted form by means of stream encryption using a first symmetric key, associated with the client;
    a step of sending parameters of a classification model, from at least one supplier to said computer platform, the parameters being sent in encrypted form by means of stream encryption using a second symmetric key, associated with the supplier ;
    a first transcryption step in which the data encrypted by the first symmetric key is re-encrypted by the public key of a homomorphic cryptosystem, the data thus re-encrypted being decrypted in the homomorphic domain from the first symmetric key, to obtain said data , encrypted by said public key;
    a second transcryption step in which the parameters encrypted by the second symmetric key are re-encrypted by said public key and then decrypted in the homomorphic domain from the second symmetric key, to obtain said parameters, encrypted by said public key;
    a step of classifying the data by means of a classification function, said classification function operating on the data and the parameters encrypted by the public key, said classification function being evaluated in the homomorphic domain to provide an encrypted classification result by said public key.
    In a first embodiment, prior to the first transcryption step, the first symmetric key is encrypted by the client using the public key and then transmitted thus encrypted to the computer platform, the first transcryption step deciphering in the homomorphic domain the re-encrypted data, using the first symmetric key encrypted by the public key.
    Prior to the first transcryption step, the public key is transmitted by the client to the IT platform and the latter transmits to the client the classification result encrypted by said public key, the client decrypting this result using the private key of said cryptosystem homomorphic to obtain a classification result in clear.
    In this case, preferably, the public key is transmitted by the IT platform to the supplier and, prior to the second transcryption step, the second symmetric key is encrypted by the supplier using said public key and then transmitted thus encrypted to the IT platform. , the second transcryption step deciphering in the homomorphic domain the re-encrypted parameters, by means of the second symmetric key encrypted by the public key.
    According to a second embodiment, prior to the first transcryption step, the public key is transmitted by the supplier to the IT platform and the latter transmits to the supplier the classification result encrypted by said public key, the supplier decrypting this result at using the private key of said homomorphic cryptosystem to obtain a classification result in clear.
    In this case, preferably, the public key is transmitted by the IT platform to the client and, prior to the first transcryption step, the first symmetric key is encrypted by the client using said public key and then transmitted thus encrypted to the IT platform. , the first transciphering step deciphering in the homomorphic domain the re-encrypted data, by means of the first symmetric key encrypted by the public key.
    According to a first classification model, the classification function is a linear function of the data to be classified.
    According to a second example of a classification model, the classification function is a polynomial function of the data to be classified.
    BRIEF DESCRIPTION OF THE DRAWINGS
    Other characteristics and advantages of the invention will appear on reading a preferred embodiment of the invention, made with reference to the attached figures among which:
    Fig. 1 schematically represents a secure classification method according to the general principle of the invention;
    Fig. 2 shows a flowchart of the secure classification method of Fig.l;
    Fig. 3 schematically represents a secure classification method according to a first embodiment of the invention;
    Fig. 4 represents a flowchart of the secure classification method of FIG. 3;
    Fig. 5 schematically represents a secure classification method according to a second embodiment of the invention;
    Fig. 4 represents a flowchart of the secure classification method of FIG. 5.
    DETAILED PRESENTATION OF PARTICULAR EMBODIMENTS
    The idea underlying the invention is to transmit to the platform the data to be classified as well as the parameters of the classification model by encrypting them beforehand by means of symmetric key encryption, then to perform a transcryption of these data and parameters in a homomorphic domain to finally evaluate the classification function in the homomorphic domain, the result of the classification being provided in encrypted form by the public key of the homomorphic cryptosystem. Thus, it is not necessary to encrypt by homomorphic encryption the data to be classified at the customer level and the parameters of the classification model at the supplier level. In addition, the entire evaluation process being carried out in the homomorphic domain by the IT platform, the latter can neither access the data in clear, nor the parameters in clear of the classification model, nor more
    0 clear classification results.
    The secure classification method uses a homomorphic cryptosystem for the stages of transcryption and evaluation of the classification function.
    It is recalled that a homomorphic encryption makes it possible to carry out operations (in practice arithmetic operations of addition or multiplication) on data without ever revealing them. More precisely, a homomorphic encryption is an asymmetric key encryption Enc pk (of public key pk) satisfying the following property:
    : Ω—> Γ
    Dec s , [Enc pk (a) ® Enc pk (h)] = a + b (D where Ω is the space of clear messages (more simply called space of clears) and Γ is the space of encrypted messages (says more simply space of figures), + an additive operation in the space of highlights giving Ω a group structure, © an operation in the space of figures giving Γ a group structure. (Ω, +) in (Γ, ©) is a group homomorphism Dec sk is the decryption function corresponding to Enc pk (where sk is the user's secret key).
    It follows from expression (1) that it is possible to carry out an additive operation between two highlights (a, b} from a corresponding operation between their figures (Enc pk (a), Enc pk (b) ).
    More generally, a homomorphic cipher can be considered as a ring morphism between the clear space (provided with the operations +, x) and the cipher space (provided with the corresponding operations ©, ®). We then have the following properties:
    DeQ (Enc pk (a + b)) = Dec sk (Enc pk (a) © Enc pk (h)) = a + b Dec sk (Enc pk (axb)) = Dec sk (Enc pk (a) ®Enc pk (b)) = axb (2-1) (2-2)
    Using expressions (2-1) and (2-2), it is therefore possible to evaluate any function f, decomposable into elementary operations of addition and multiplication, in the space of the figures and then to decipher the result.
    In these current homomorphic cryptosystems, encryption consists in masking a message with noise. Conversely, decryption consists in removing this noise, which is doable if we know the private key of the cryptosystem but on the other hand extremely difficult if it is unknown. Homomorphic operations naturally maintain this masking or even amplify it. If we represent the aforementioned function f according to a tree decomposition, each node of the tree corresponding to an elementary arithmetic operation, noise is added to each level of the tree. It is therefore clear that if the function f has a significant computational depth (that is to say a large number of levels in the tree representation), the noise level in the evaluation result of the function f increases. When the noise exceeds a threshold (depending on the encryption scheme used), it is no longer guaranteed that the result is still decipherable. When a homomorphic cryptosystem makes it possible to carry out any depth of calculation, it is called entirely homomorphic or FHE (Fully Homomorphic Encryption). Otherwise, it is said to be relatively homomorphic or SHE (Somewhat Homomorphic) or even LHE (Levelled Homomorphic). In the following, we will assume that the homomorphic cryptosystem used is entirely homomorphic or else homomorphic to a sufficient depth to evaluate the classification function. The private key and the public key of a homomorphic cryptosystem will be conventionally denoted sk-HE and pk-HE.
    Transciphering is a cryptographic technique making it possible to pass from data encrypted by a first cryptosystem to the same data encrypted by a second cryptosystem, without going through an intermediate step of decryption in the clear space.
    The present secure classification method makes use of a transcryption which makes it possible to pass from a stream encryption to a homomorphic encryption. It is recalled that a stream encryption is a symmetric key encryption in which the message to
    0 encryption is simply added bit by bit with the key, noted here simply sk. Decryption is carried out like encryption, by simple bit-by-bit addition of the data encrypted with the symmetric key.
    If we denote x a data in clear, [x] the data encrypted by flow encryption, S, and [x] _ he the same data encrypted by homomorphic encryption, EEE, we have the
    5 relation:
    - ([[sk pk-HE, [s £] pk-HE pk-HE (3)
    In other words, it is possible to decrypt in the homomorphic domain (that is to say in the domain of homomorphic ciphers) a piece of data encrypted a first time by stream encryption and a second time by homomorphic encryption. The decryption by flow, S 1 being carried out by a simple addition with the symmetric key, it is understood that this can be carried out in the homomorphic domain by means of the encrypted symmetric key [sÆ] Λ _ Η £ . ·
    We consider below a set of classification service clients, a remote IT platform and a set of classification model providers in the sense defined above. All the customers are noted U 1 , ..., U N and all the suppliers, with N> 1 and M> 1.
    Fig. 1 schematically represents a secure classification method according to the general principle of the invention.
    The IT platform was represented in 100, in 110 the customers of the classification service and in 120 the suppliers of the classification models.
    The platform is considered to be semi-honest, i.e. it is reliable in terms of calculations made but it is not necessarily in terms of confidentiality of the data to be classified and of the parameters of the models. classification.
    Each client U it has a symmetric encryption key, denoted sk ^ by means of which it is capable of performing stream encryption of the data to be classified.
    Similarly, each supplier F jt , has a symmetric key sk 1 . by means of which it is capable of performing a stream encryption of the parameters of its classification model.
    We will also assume that all customers, suppliers and the IT platform share the public key, pk-HE of a homomorphic cyptosystem. In the general embodiment, no assumption is made on the generation or on the distribution of this public key, it may have been transmitted by a client or by a supplier as we will see later. Alternatively, it may have been transmitted by a key server.
    ίο
    However, only the recipient of the classification result having the private key, sk-HE, corresponding to the public key of this cryptosystem, will be able to access it.
    In a first sending step, a client U t who wishes to classify his data, x t , transmits them in encrypted form to the IT platform. The data to be classified generally takes the form of a vector of attributes of given size. The encryption is carried out by flow using a first symmetric key skf, the encrypted data being noted [x,] ^ The first symmetric key skf is shared neither with the platform, nor generally with suppliers and other customers.
    Similarly, in a second sending step, a supplier F. transmits the parameters, p jr of his classification model in encrypted form to the computer platform. The encryption is carried out by flow using a second symmetric key, sk (, associated with the supplier F-, the encrypted parameters being noted Γη.Ί.
    The symmetric key sk is not shared with the platform and, generally, neither with customers, nor with other suppliers.
    It is important to note that the order of the first and second sending stages is indifferent. In other words (and this is often the case), the supplier F. first supplies his classification model to the platform before a client transmits a data classification request.
    The IT platform then performs a first and a second transciphering step, the order of these two steps also being indifferent.
    During a first transcryption step, the platform transforms the data encrypted by the symmetric key skf into this same data, encrypted by the public key pk-HE. More precisely, the IT platform again encrypts the encrypted data [xl „using the public key pk-ΕΙΕ, ie [% 1 tU and sk · L sk i J pk-HE then deciphers, in the homomorphic domain, these data thus re-encrypted, from the symmetric key skf, which can be expressed by:
    (4) pk-HE - dec pk-HE, [sk ^ pk-HE where dec (y, K) means the stream decryption operation (identical to the stream encryption operation) of the cipher / using the key κ. It will be understood that the decryption operation is carried out here in the homomorphic domain, without the platform having at any time access to the data in clear, x i .
    Similarly, in a second transcryption step, the platform transforms the parameters encrypted by the symmetric key sk F. in these same parameters encrypted by the public key pk-HE. More specifically, the IT platform again encrypts the parameters already encrypted [j ~ kF using the public key pk-HE, ie
    and then deciphers, in the homomorphic domain, these data thus re-encrypted pk-HE, from the symmetric key sk F , which can be expressed, with the same notation conventions as above, by:
    = dec
    pk-HE, Γ sk F ~
    L J J pk-HE (5)
    It will also be understood that the decryption operation is carried out here in the homomorphic domain, without the platform having at any time access to the parameters in clear, p } .
    Finally, the platform performs a classification operation from the model whose parameters have been supplied by F .. The classification function f is evaluated in the homomorphic domain as follows:
     (6)
    This evaluation is possible insofar as the function f is a linear function or a polynomial function, of the data to be classified.
    As an example of a linear function, we can cite a hyperplane classifier.
    As an example of polynomial (quadratic) classification, one can cite a Gaussian classifier.
    In this example, we assume that the data are represented by attribute vectors, x of dimension Q and that with each class C k , are associated a vector mean value μ ζ (vector of dimension Q) as well as a matrix of covariance Σ λ , positive semi-defined of dimension QxQ. The model is therefore defined by the parameters μ ζ and Σ ζ (or Σ λ ') k -Ϊ,.,., Κ, collectively represented by the vector y.
    The classification function is then given by:
    r = / (x, y) = argmin (/ (x, Cj) k = l, ..., K (7-D with:
    (7-2)
    In other words, the classification function gives the class for which the distance (χ-μ ^) Γ Σ / 1 (χ-μ Λ ) to the representative μ ζ is minimum.
    The function f (x, C A ) in (7-2) comprising only polynomial (quadratic) operations, this can be evaluated in the homomorphic domain. The comparison of the results / (x, C t ) in (7-1) can also be carried out in the homomorphic domain by means of linear expressions. The evaluation of the comparison of the results can be carried out by means of boolean circuits for the operator “>” (larger than) on the binary representations of the encrypted data, as described in the article of
    J. Garay et al. entitled "Practical and secure solutions for integer comparison" published in T. Okamoto and X. Wang, editors, Public Key Cryptography - PKC 2007, volume 4450 of Lecture Notes in Computer Science, pages 330-342. Springer Berlin, Heidelberg, 2007.
    Alternatively, it is possible to use a non-linear and non-polynomial classification function 5 (for example classification by neural network) insofar as such a function can be approximated locally by a polynomial function (Taylor series for example). An example of a secure neural network classification can be found in the article by N. Dowlin et al. titled "CryptoNets: applying neural networks to encrypted data with high throughput and accuracy", available at research.microsoft.com/apps/pubs/default.aspx7id.
    In any event, the classification result is obtained in (6) in encrypted form with the public key of the homomorphic cryptosystem. It can then be decrypted by the entity (customer or supplier for example) holding the corresponding secret key.
    We will further consider a first embodiment in which the result of the classification is transmitted to the client having formed the request and a second embodiment in which this result is transmitted to the supplier whose model was used for this classification.
    Fig. 2 shows a flowchart of the secure classification method of Fig.l.
    0 In a first sending step, 210, a client t /. who wishes to classify his data, x, transmits them in encrypted form, namely [xl „, to the 1 L t IT platform.
    In a second sending step, 220, a supplier transmits the parameters,
    p., of its model in encrypted form, namely Γp. to the IT platform.
    5 In a first transcryption step, 230, the computer platform, encrypts the data already encrypted a second time using the public key pk-HE, either and then decrypts, in the homomorphic domain, these data thus re-encrypted, or Γχ. 1 -dec I% 1 'L il pk-HE l L zJ pk-HE, [sk ^ pk-HE
    In a second transcryption step, 240, the IT platform encrypts the encrypted parameters a second time using the public key pk - HE, i.e.
    H, pk-HE and then deciphers, in the homomorphic domain, these parameters thus re-encrypted, ie [j ~ k he = dec pk-HE 'IX
    F j J pk-HE
    Finally, in a data classification step, 250, the computer platform performs a classification operation by evaluating the classification function f in the homomorphic domain, ie
    J pk-HE
    Fig. 3 schematically represents a secure classification method according to a first embodiment of the invention.
    In this embodiment, the decryption of the classification result is carried out by the customer having made the request. To do this, the client sends the platform its homomorphic public key and decrypts the classification result with its corresponding private key.
    For reasons of simplification of the presentation, only the customer U t and the model supplier concerned have been represented in the figure. It is clear, however, for those skilled in the art that, as a general rule, several (M) suppliers can provide different classification models to the platform.
    We denote respectively sk t - HE and pk t - HE, a private key and a public key of a homomorphic cryptosystem. This pair of keys is for example locally generated by the client U i . The latter may also have obtained a public key certificate from a certification authority.
    In this embodiment, the client U t transmits to the computer platform, prior to the first transcryption step, the public key pE-HE, its data to be classified in encrypted form by the first symmetric key, ie as well as the first key symmetric encrypted by the public key, ie Γsk Ί
    LJ pk t -HE
    In parallel, the platform receives from the supplier F } the parameters of the model in encrypted form with the second symmetric key, ie [j ~ kF
    The platform transmits the public key pk t -HE (received from the client U t ) to the supplier F. The latter then returns to the platform the second symmetric key encrypted by the public key, ie [sk ©. This public key is transmitted to the platform before the second transcryption step.
    In the first transcryption step, the IT platform re-encrypts the encrypted data [a;] ^ ,, using the public key pk t -HE which it received from t / ( , then performs the operation for decrypting this data re-encrypted in the homomorphic domain by means of the first symmetric key encrypted by the public key, ie [stf J which it θ also received from U t :
    p ^ -HE - dec
    Dl,
    Apl ^ -HE p ^ -HE (8)
    In the second transcryption step, the IT platform again encrypts the encrypted parameters ΓpA F , using the public key pk-HE that it has
    L Jskj received from U it then performs the decryption operation of these re-encrypted data, that is, in the homomorphic domain, by means of the second symmetric key pk, -HE encrypted by the public key, [sk,, which it has previously received from F.:
    JJ pk t -HE J
    H, p, I = dec 1 J-ipk, -HE
    M, ”-,. · [<]
    - p ^ -HE pk, -HE (9)
    In the classification step, the platform evaluates the classification function as before, that is to say:
    p ^ -HE ph-HE
    (10)
    This classification result is then transmitted to the client U i at the origin of the request. This deciphers the result using its homomorphic private key sk t - HE to obtain the classification result in clear r ... This result relates to the classification of the data of the client U, by the model of the supplier F ,.
    1 day
    According to a variant, the private and public key pair of the homomorphic cryptosystem is always generated locally by the client U t but the public key is distributed by a key server, distinct from U ,, to the platform and to the provider F ,, or even to all suppliers F jr .
    This first embodiment can be illustrated by a use case in which hospitals (suppliers) pool their models on a platform for a risk of organ cancer, with the result of classification two possible classes: benign and malignant. Clients are practitioners who enter their patients' medical data to confirm or deny the risk of cancer. On the one hand, hospitals want to protect the confidentiality of the models sent to the platform and, on the other hand, doctors want to protect the confidentiality of their patient data.
    Fig. 4 represents a flowchart of the secure classification method of FIG. 3.
    This method comprises first of all the first steps of sending 410, 411, 412 from the client to the computer platform.
    More precisely, in 410, the customer £ 71 transmits to the platform the data to be classified, encrypted by means of his symmetric key sk B , ie [xl „.
    1 L t J sk;
    In 411, the client LE transmits the public key pk to the platform ; -HE of a homomorphic cryptosystem. The pair of private key, public key of this cryptosystem was previously generated by the client in question. The private key, sE-HE, and the corresponding public key, pk t -HE, thus generated are thus associated with this client. If necessary, the public key pk t -HE can be transmitted to the platform by a key server.
    In 412, the client U t transmits its symmetric key sk] 1 to the platform, encrypted by the public key pk t - HE.
    It will be noted that the order of steps 410-412 is here of no importance.
    In 415, the IT platform transmits to the supplier F. (or even to all the suppliers) the public key pk t -HE. If necessary, this public key can be transmitted directly by the client itself, or even be transmitted by a key server.
    Steps 420-421 are steps for sending the supplier F. to the IT platform.
    Thus, in 420, the supplier F. transmits the parameters p. of its model, in encrypted form, namely p .Ί.
    L J J skj
    In 421, the supplier F jt having previously received the homomorphic public key pE - HE in 415, encrypts its own symmetric key using the latter and transmits the encrypted result, [sk © to the platform.
    It will be noted that step 420 can intervene in any order in the preceding sequence, only step 421 having to intervene after step 415.
    In a first transcryption step, 430, the computer platform again encrypts the encrypted data [a;] ^ ,, using the public key, pk t -HE then performs a decryption of these data thus re-encrypted in the homomorphic domain, let [xl -dec [xl tU L 'hk-HE' J A Apk, -HE L '-Ι / Λ, -ΤΏΐ J
    In a second transcryption step, 440, the computer platform again encrypts the encrypted parameters [j ~ kF , using the public key pE - HE, then performs a decryption of these parameters thus re-encrypted, ie
    pk ^ -HE pk t -HE in the homomorphic domain: [/ , · ©
    The order of steps 430 and 440 is again indifferent. However, step 430 must be carried out after steps 410-412. Similarly, step 440 should be performed after steps 420-421.
    Then, in a data classification step, 450, the computer platform evaluates the classification function in the homomorphic domain, ie 10
    Finally, in 460, the IT platform transmits to the client U t the result of the classification (encrypted by the public key pk t - HE),.
    In 470, the client U it having the corresponding private key sE - HE, decrypts the encrypted classification result Γγ, .Ί to obtain the classification result in
    L ‘J-ipk, -HE clear, r ,.
    y
    Note that the classification result résultatγ. Ί cannot therefore be
    L y Apk-HE deciphered by the other clients.
    Fig. 5 schematically represents a secure classification method 20 according to a second embodiment of the invention.
    In this embodiment, the decryption of the classification result is carried out by the supplier who provided the classification model.
    To do this, the supplier sends its homomorphic public key to the platform and decrypts the classification result with its corresponding private key.
    As in the first embodiment, only the customer LE and the supplier of model F. concerned have been represented in the figure. However, it is clear that several customers and several suppliers can connect to the platform.
    We denote respectively sk } - HE and pE - HE, a private key and a public key of a homomorphic cryptosystem. This pair of keys is for example generated locally by the supplier F. The latter may also have obtained a public key certificate from a certification authority.
    Furthermore, the client EE has, as previously, a first symmetric key sk ^ and the supplier has a second symmetric key sk , for performing stream encryption.
    The supplier F. transmits to the computer platform, prior to the first transcryption step, the public key pk t - HE, the model parameters in encrypted form with the second symmetric key, ie [ρ, ~ kF , as well as the second symmetric key encrypted by the public key, i.e.
    In parallel, the platform receives from the LE client the data to be classified in encrypted form with the first symmetric key, i.e.
    The platform transmits the public key pf-HE previously received from supplier F, to client EE. The latter then returns the first key to the platform
    J 1 symmetric encrypted by the public key, i.e.
    In a first transcryption step, the IT platform again encrypts the data already encrypted [x,] ^, using the public key pk f - HE that it received from F } , then performs the decryption operation of this data re-encrypted in the homomorphic domain by means of the first symmetric key encrypted by the public key, ie λ which it previously received from LE:
    (11) = dec
    In the second transcryption step, the IT platform again encrypts the encrypted parameters Γp. , Using the public key pk.-HE that it has
    L · J -iskj d received from F jt then performs the operation of decrypting this re-encrypted data, ie
    'i -lpk r HE, in the homomorphic domain by means of the second symmetric key encrypted by the public key, Γsk F Ί, which he previously received from F.:
    LJ -lnk.-HE d
    pkj -HE <l = dec [ Pj ~
    (12)
    In the classification step, the platform evaluates the classification function as before, that is to say:
    pk r HE
    (13)
    This classification result is then transmitted to the supplier, who can decrypt the result using his private key sk } - FIE.
    According to a variant, the private and public key pair of the homomorphic cryptosystem is generated locally by the supplier F. but the public key is distributed by a key server, distinct from F ,, to the platform and to the client U, or even to
    J 1 the set of clients Ui-Ι,.,., Ν.
    This second embodiment can be illustrated by a use case in which the manager of an eco-district (supplier) wishes to know the energy consumption profiles of the dwellings (customers) which he manages. The various dwellings securely upload data relating to their energy consumption to the platform. The manager obtains, after secure classification, the energy classes of his customers without being able to access their data in plain text.
    Fig. 6 shows a flowchart of the secure classification method of FIG. 5.
    This method comprises first of all first steps of sending 610, 611, 612 from the supplier to the IT platform.
    More precisely, in 610, the supplier F. transmits the parameters p. of its model, in encrypted form, namely pl F.
    J L J
    In 611, the supplier F. transmits to the platform the public key of a homomorphic cryptosystem. The pair of private key, public key of this cryptosystem was previously generated by the supplier. The private key, sk ^ -HE, and the corresponding public key, pE - HE, thus generated are associated with this provider. If necessary, the public key pE-HE can be transmitted to the platform by a key server.
    In 612, the supplier F. transmits to the platform his symmetric key sk , encrypted by the public key pE-HE.
    Note that the order of steps 610-612 is unimportant.
    In 615, the IT platform transmits to the customer U t (or even all of the
    0 clients) the public key pk t -HE. If necessary, this public key can be transmitted directly by the supplier himself, or even be transmitted by a key server.
    Steps 620-621 are steps for sending the client EE to the IT platform.
    Thus, in 620, the client U t transmits to the computer platform the data to be classified, in encrypted form, namely [%,] ^
    In 621, the client U it having previously received the homomorphic public key pkj - HE in 615, encrypts its symmetric key using the latter and transmits the encrypted result, [sk.v © to the platform.
    It will be noted that step 620 can intervene in any order in the preceding sequence, only step 621 having to intervene after step 615.
    In a first transcryption step, 630, the computer platform again encrypts the encrypted data [xj ^, using the public key, pE - HE, then performs a decryption of this data thus re-encrypted in the homomorphic domain, ie [x, ] pk, -HE
    - dec sk “
    -ipk - ET L -ipkj-ET
    In a second transcryption step, 640, the computer platform again encrypts the encrypted parameters Γp. , Using the public key pk. -HEY,
    L J J Sk;
    then performs a decryption of these parameters thus re-encrypted, either in the homomorphic domain or [j ~ pk: -HE dec
    M, ir pk: -HE
    H,
    F / - pk: -HE pk, -HE
    The order of steps 630 and 640 is again indifferent. However, step 640 must be carried out after steps 610-612. Similarly, step 630 should be performed after steps 620-621.
    Then, in a data classification step, 650, the computer platform evaluates the classification function in the homomorphic domain, ie h = - / Ή ,,,
    Finally, in 660, the IT platform transmits to the supplier F, the result of the classification (encrypted by the public key pE - HE), pk, -HE
    In 670, the supplier F jr having the corresponding private key, skj - HE, decrypts the encrypted classification result Γγ..Ί to obtain the result of
    LVApE-HE classification in clear, r ..
    It will be noted that the classification result Γγ..Ί cannot in particular not
    L V Apkj-HE be deciphered by other suppliers.
    It has been assumed in the above that the suppliers send the parameters of their classification models to the platform. Alternatively, it could be envisaged that the suppliers transmit learning data, the construction of the classification model then being carried out by the platform in the homomorphic domain.
    权利要求:
    Claims (8)
    [1" id="c-fr-0001]
    1. Method for secure classification of data by an IT platform characterized in that it comprises:
    - A step of sending (210) data to be classified, from at least one client to said computer platform, the data being sent in encrypted form by means of stream encryption using a first symmetric key, associated with the client;
    a step of sending (220) parameters of a classification model, from at least one supplier to said computer platform, the parameters being sent in encrypted form by means of stream encryption using a second symmetric key, associated with the supplier;
    a first transcryption step (230) in which the data encrypted by the first symmetric key is re-encrypted by the public key of a homomorphic cryptosystem, the data thus re-encrypted being decrypted in the homomorphic domain from the first symmetric key, for obtaining said data, encrypted by said public key;
    - a second transcryption step (240) in which the parameters encrypted by the second symmetric key are re-encrypted by said public key and then decrypted in the homomorphic domain from the second symmetric key, to obtain said parameters, encrypted by said public key;
    - a data classification step (250) by means of a classification function, said classification function operating on the data and the parameters encrypted by the public key, said classification function being evaluated in the homomorphic domain to provide a result classification encrypted by said public key.
    [2" id="c-fr-0002]
    2. Secure classification method according to claim 1, characterized in that, prior to the first transcryption step, the first symmetric key is encrypted by the client using the public key and then transmitted thus encrypted to the IT platform, the first transciphering step deciphering in the homomorphic domain the re-encrypted data, by means of the first symmetric key encrypted by the public key.
    [3" id="c-fr-0003]
    3. Classification method according to claim 1 or 2, characterized in that, prior to the first transcryption step, the public key is transmitted by the client to the computer platform and that the latter transmits the encrypted classification result to the client by said public key, the client decrypting this result using the private key of said homomorphic cryptosystem to obtain a classification result in clear.
    [4" id="c-fr-0004]
    4. Secure classification method according to claim 3, characterized in that the public key is transmitted by the IT platform to the supplier and that, prior to the second transcryption step, the second symmetric key is encrypted by the supplier by means of said public key then transmitted in this way encrypted to the IT platform, the second transcryption step deciphering in the homomorphic domain the encrypted parameters, using the second symmetric key encrypted by the public key.
    [5" id="c-fr-0005]
    5. Classification method according to claim 1 or 2, characterized in that, prior to the first transcryption step, the public key is transmitted by the supplier to the IT platform and that the latter transmits to the supplier the encrypted classification result by said public key, the supplier decrypting this result using the private key of said homomorphic cryptosystem to obtain a classification result in clear.
    [6" id="c-fr-0006]
    6. Classification method according to claim 5, characterized in that the public key is transmitted by the IT platform to the client and that, prior to the first transcryption step, the first symmetric key is encrypted by the client using said key then transmitted encrypted to the IT platform, the first step of decryption deciphering in the homomorphic domain the re-encrypted data, using the first symmetric key encrypted by the public key.
    [7" id="c-fr-0007]
    7. Classification method according to one of the preceding claims, characterized in that the classification function is a linear function of the data to be classified.
    [8" id="c-fr-0008]
    8. Classification method according to one of claims 1 to 6, characterized in that the classification function is a polynomial function of the data to be classified.
    S.61067
    1/6
    类似技术:
    公开号 | 公开日 | 专利标题
    EP3535923B1|2020-08-05|Method for secure classification using a transcryption operation
    EP3078155B1|2018-01-03|Method of updating a file tree stored on a storage server
    US9503264B2|2016-11-22|Attribute based encryption using lattices
    EP2002595B1|2012-12-26|Method and system for decipherable searchable encryption
    EP3301617B1|2021-05-19|Methods for secure learning of parameters of a convolutional neural network, and secure classification of input data
    Aono et al.2016|Privacy-preserving logistic regression with distributed data sources via homomorphic encryption
    EP2323306B1|2013-02-20|Secured data transmission method and encryption and decryption system enabling such a transmission
    EP3211823B1|2018-01-03|Method for confidential execution of a program operating on data encrypted by means of homomorphic encryption
    Al-Juaid et al.2019|Combining RSA and audio steganography on personal computers for enhancing security
    US20100172496A1|2010-07-08|Key generating apparatus, encrypting apparatus and decrypting apparatus
    EP2661715A1|2013-11-13|Device and method for online storage, transmission device and method, and receiving device and method
    EP3751468A1|2020-12-16|Method for collaborative learning of an artificial neural network without revealing learning data
    Jeckmans et al.2011|Poster: privacy-preserving profile similarity computation in online social networks
    EP3545641B1|2020-12-30|Searchable encryption method
    Arunkumar et al.2018|Reversible data hiding scheme using modified histogram shifting in encrypted images for bio-medical images
    FR3057122B1|2019-08-16|METHOD AND DEVICE FOR DETECTING INTRUSIONS ON A NETWORK USING A HOMOMORPHIC ENCRYPTION ALGORITHM
    Jyotheeswari et al.2020|Hybrid encryption model for managing the data security in medical internet of things
    Altaee et al.2021|Enhancing cloud computing security by paillier homomorphic encryption
    Poon et al.2018|Privacy-aware search and computation over encrypted data stores
    HUANG et al.2014|Encrypted data sharing with multi-owner based on digital rights management in online social networks
    CA2895189C|2021-01-26|Group signature using a pseudonym
    Ou et al.2019|An efficient privacy-preserving friendship-based recommendation system
    CN108920968B|2022-03-18|File searchable encryption method based on connection keywords
    Ligier2018|Functional encryption applied to privacy-preserving classification: practical use, performances and security
    WO2020217005A1|2020-10-29|Method and system for confidential classification of data
    同族专利:
    公开号 | 公开日
    FR3060165B1|2019-05-24|
    WO2018104686A1|2018-06-14|
    EP3535923A1|2019-09-11|
    US20190334708A1|2019-10-31|
    EP3535923B1|2020-08-05|
    引用文献:
    公开号 | 申请日 | 公开日 | 申请人 | 专利标题
    US20120201378A1|2011-02-03|2012-08-09|Mohamed Nabeel|Efficient, remote, private tree-based classification using cryptographic techniques|FR3086090A1|2018-09-17|2020-03-20|Commissariat A L'energie Atomique Et Aux Energies Alternatives|METHOD FOR CONFIDENTIAL PROCESSING OF LOGS OF AN INFORMATION SYSTEM|
    WO2020240135A1|2019-05-28|2020-12-03|Commissariat A L'energie Atomique Et Aux Energies Alternatives|Method for confidentially processing data of a vehicle|
    EP3751468A1|2019-06-12|2020-12-16|Commissariat à l'énergie atomique et aux énergies alternatives|Method for collaborative learning of an artificial neural network without revealing learning data|
    FR3095537B1|2019-04-23|2021-05-21|Commissariat Energie Atomique|CONFIDENTIAL DATA CLASSIFICATION METHOD AND SYSTEM|
    CN109905412B|2019-04-28|2021-06-01|山东渔翁信息技术股份有限公司|Network data parallel encryption and decryption processing method, device and medium|
    CN111586000B|2020-04-28|2020-12-18|北京物资学院|Full-proxy homomorphic re-encryption transmission system and operation mechanism thereof|
    CN111931243B|2020-10-09|2021-01-19|北京微智信业科技有限公司|Ordering method based on fully homomorphic encryption|
    法律状态:
    2018-01-02| PLFP| Fee payment|Year of fee payment: 2 |
    2018-06-15| PLSC| Search report ready|Effective date: 20180615 |
    2019-12-31| PLFP| Fee payment|Year of fee payment: 4 |
    2020-12-28| PLFP| Fee payment|Year of fee payment: 5 |
    优先权:
    申请号 | 申请日 | 专利标题
    FR1662244|2016-12-09|
    FR1662244A|FR3060165B1|2016-12-09|2016-12-09|SECURE CLASSIFICATION METHOD USING TRANSCHIFFREMENT OPERATION|FR1662244A| FR3060165B1|2016-12-09|2016-12-09|SECURE CLASSIFICATION METHOD USING TRANSCHIFFREMENT OPERATION|
    PCT/FR2017/053479| WO2018104686A1|2016-12-09|2017-12-08|Method for secure classification using a transcryption operation|
    EP17821701.4A| EP3535923B1|2016-12-09|2017-12-08|Method for secure classification using a transcryption operation|
    US16/467,851| US20190334708A1|2016-12-09|2017-12-08|Method for secure classification using a transcryption operation|
    [返回顶部]