Authorizable private information retrieval method based on DID

Abstract

The invention belongs to the technical field of privacy protection, and provides a DID-based authorizable private information retrieval method, which comprises the following steps: a receiver and an owning party register to generate a DID and a DID document and upload the DID and the DID document to a block chain, the owning party encrypts the document through a symmetric key to obtain a ciphertext and uploads the ciphertext to a database server, the receiver sends the file information to the owning party, and the owning party sends the file information to the database server. The owner signs the file attribute information of the corresponding file to obtain a signature value, packages the signature value and the DID of the owner into a verifiable voucher, sends the verifiable voucher to the receiver, analyzes the verifiable voucher to obtain a signature value, then executes an OSBE protocol on the signature value among the receiver, the database server and the owner, the receiver obtains a symmetric key, and sends the symmetric key to the database server. And the database server sends the ciphertext to a receiver, and the receiver decrypts the ciphertext through the symmetric key to obtain the file. According to the method, the query privacy requirement is met, and a data retrieval scheme in which access control and a data subject authorization mechanism are unified is provided.

Description

Technical Field

[0001] This invention belongs to the field of privacy protection technology and provides a method for retrieving authorized private information based on DID. Background Technology

[0002] In today's global digital age, user privacy protection has become a core demand in the field of information exchange. When users engage in various activities using information retrieval services, whether it's searching medical records, tracing financial transactions, or other applications, the act of searching itself often carries sensitive attributes. During the process of a user sending a query request to the server, the specific content retrieved may be captured by the server, potentially leading to the risk of sensitive information leakage. Especially in highly sensitive areas such as medical diagnosis and asset allocation, the search behavior is highly likely to become a mapping of user identity characteristics; once this information is leaked, it will have serious consequences for the user.

[0003] To protect user privacy, the Private Information Retrieval (PIR) protocol was developed. In practice, systems using this protocol often combine it with varying degrees of access control and data subject authorization mechanisms. However, traditional access control relies on the query content; the server implements access control by determining whether a user has permission to query records. This approach directly conflicts with the privacy attributes of the query content emphasized by the PIR protocol, failing to effectively protect user privacy. Furthermore, in a distributed environment, multiple parties must obtain data subject authorization when sharing data, making identity management extremely complex. Requiring servers to collect user identity information to advance the identity management process introduces new risks of identity privacy leaks.

[0004] While database servers using proprietary information retrieval protocols can effectively protect user query privacy, in real-world scenarios, these servers still need to adapt to varying levels of access control and efficient identity management mechanisms. Currently, the practice of using proprietary information retrieval protocols to achieve multi-party data sharing in a distributed environment still faces many unresolved issues. On the one hand, traditional access control mechanisms are difficult to integrate organically with proprietary information retrieval protocols, while existing zero-knowledge proof-based solutions suffer from excessive computational overhead, severely impacting system efficiency. On the other hand, the data subject authorization requirements in a distributed environment lead to significant challenges in identity management, and the collection of user identity information by the server undoubtedly poses a risk of identity privacy leaks. Summary of the Invention

[0005] To address the aforementioned technical problems, this invention provides a DID-based authorized private information retrieval method that can satisfy the query privacy requirements of the PIR protocol while providing a data retrieval scheme that organically unifies access control and data subject authorization mechanisms.

[0006] The technical solution of the present invention includes: The recipient and owner register with the DID server to generate a DID and a DID document, and then upload the DID and the DID document to the blockchain.

[0007] The owner encrypts the file using a symmetric key to obtain ciphertext and uploads it to the database server.

[0008] The recipient sends the file information to be retrieved to the owner. The owner signs the file attribute information of the corresponding file as a public message to obtain a signature value. Then, the signature value and the owner's DID are encapsulated into a verifiable credential and sent to the recipient.

[0009] The recipient verifies the owner's identity and the legitimacy of the verifiable credentials through the DID server. After successful verification, the recipient parses the verifiable credentials to obtain the signature value.

[0010] The database server verifies the recipient's identity through the DID server. After successful verification, the OSBE protocol is executed between the recipient, the database server, and the owner on the signature value, and the recipient obtains the symmetric key.

[0011] The database server sends the ciphertext to the recipient, who then decrypts the ciphertext using a symmetric key to obtain the file.

[0012] Furthermore, the method for executing the OSBE protocol is as follows: The receiver calculates X from the signature value and sends X to the database server. The database server calculates Z and Ks from X and sends Ks to the owner. The owner calculates C from Ks and sends C to the database server. The database server then sends Z and C to the receiver. The receiver calculates ks based on Z and the key derivation function, and decrypts C using ks to obtain the final symmetric key. Here, X, Z, Ks, ks, and C are all process parameters.

[0013] Furthermore, prior to DID registration, the owner and recipient generate the necessary signature verification documents for the DID. key pair Generate for the owner Algorithm common parameters Schnorr key pair and symmetric encryption key .

[0014] Furthermore, before the DID and DID document are uploaded to the blockchain, through... The private key is used to sign the DID document.

[0015] Furthermore, the method for obtaining the signature value is as follows: select a random number k, and then calculate e and s to obtain the signature value. The formula is: , , , Where M represents file attribute information.

[0016] Furthermore, the signature value and the owner's DID are encapsulated and then... The private key is used to sign, resulting in a verifiable credential.

[0017] Furthermore, the receiver and the database server transmit encrypted data via the PIR protocol.

[0018] The technical solution provided by the embodiments of the present invention has the following advantages compared with the prior art: The recipient and owner register and generate DID and DID documents through a DID server, then upload the DID and DID documents to the blockchain. The owner encrypts the file using a symmetric key to obtain ciphertext and uploads it to the database server. The recipient sends the file information to be retrieved to the owner, who signs the corresponding file's symmetric key as a public message to obtain a signature value. The signature value, file information, and the owner's DID are then encapsulated into a verifiable credential and sent to the recipient. The recipient verifies the owner's identity and the legitimacy of the verifiable credential through the DID server. After successful verification, the recipient parses the verifiable credential to obtain the signature value. The database server verifies the recipient's identity through the DID server. After successful verification, the OSBE protocol is executed between the recipient, the database server, and the owner on the signature value. The recipient obtains the symmetric key, and the database server sends the ciphertext to the recipient. The recipient decrypts the ciphertext using the symmetric key to obtain the file. Compared to existing technologies, this invention satisfies the query privacy requirements of the PIR protocol while providing a data retrieval solution that organically unifies access control and data subject authorization mechanisms.

[0019] Other advantages, objectives and features of the present invention will become apparent in part from the following description, and in part from those skilled in the art through study and practice of the invention. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a schematic diagram of the overall process of one embodiment of the present invention.

[0022] Figure 2 This is a schematic diagram illustrating the OSBE protocol execution process in one embodiment of the present invention.

[0023] Figure 3 This is a comparison chart of computational overhead during the authorization stage of one embodiment of the present invention. Detailed Implementation

[0024] The following detailed description of a specific embodiment of the present invention is provided in conjunction with the accompanying drawings. However, it should be understood that the scope of protection of the present invention is not limited to the specific embodiment.

[0025] In the description of this invention, it should be understood that the terms "center," "longitudinal," "lateral," "length," "width," "thickness," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," "axial," "radial," and "circumferential" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing the technical solution of this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0026] Definitions: 1. Unintentional Electronic Envelope (OSBE) The Unintentional Electronic Envelope (OSBE) protocol, based on signatures, is commonly used in anonymous communication. Its system parameters depend on the choice of different signature schemes, such as the Schnorr-OSBE scheme and the BLISS-OSBE scheme. The OSBE model consists of a sender S and receivers R1 and R2. R1 possesses the signature Sigu of the public message u (from a CA), while R2 does not. OSBE allows authorized receiver R1 to correctly access the data, while the sender S is unaware of whether receiver R1 has the necessary access rights.

[0027] OSBE system parameter definitions: signature scheme Sig and its corresponding key pair (pk, sk), message u to be signed, signature value Sigu of u, and message to be transmitted. Sigu is only disclosed to R1, and p is only disclosed to S.

[0028] After the system parameters are established, the OSBE scheme includes the following two stages: a) Interaction phase: The sender S, without knowing the identity information of R1 and R2, randomly selects one of R as the receiver and executes the interaction protocol.

[0029] b) Open the envelope: After the information exchange is completed, if R is R1, it can correctly obtain the message because it has the CA's signature Sigu. If R is R2, it cannot correctly obtain the message.

[0030] 2. Decentralized Identifier (DID) A DID is a globally unique string used to represent a DID entity, characterized by its uniqueness, resolvability, and verifiability. Compared to traditional centralized identity management models, DID eliminates the need for third-party institutions, achieving decentralized management of user identity information. Each DID identifier corresponds to a DID document, which is publicly stored on the blockchain.

[0031] The DID identifier consists of three parts, as shown below: , Where `did` represents the identifier of the DID, `dobse` represents the DID method, used to specify the method for parsing and managing the DID, and `exampleIdString` represents a globally unique specific identifier string. Compared to traditional identity management models, decentralized identity management implemented using DID has the following advantages:

[0032] a) Privacy Protection: In decentralized identity management, users can control the personal information they share. They only need to share necessary information, while the rest can be kept confidential, thus protecting user privacy.

[0033] b) Portable Identity Authentication: Decentralized identity management eliminates cumbersome multi-factor authentication protocols, enabling passwordless authentication and allowing users to access digital services more conveniently.

[0034] c) Data sharing: DID identity information can be associated with data, enabling multiple participants in a decentralized environment to share data through authorization.

[0035] In the description of the embodiments of the present invention, unless otherwise stated, "a plurality of" means two or more.

[0036] In the description of the embodiments of the present invention, the parameter configuration is as shown in Table 1: Table 1: System Parameter Table This invention provides a method for retrieving authorized private information based on DID, comprising: Step 1: The recipient and owner register with the DID server to generate a DID and a DID document, and then upload the DID and DID document to the blockchain.

[0037] Specifically: before DID registration, : Required for generating DID document signatures and verification for data owners and data recipients. key pair Generate for data owners Algorithm common parameters Schnorr key pair Symmetric encryption key .

[0038] The principle of SM2 key pair generation is shown in Table 2: Table 2: SM2 Key Pair Generation The Schnorr common parameters and the principles of key pair generation are shown in Table 3: Table 3: Schnorr Common Parameters and Key Pair Generation In the embodiments provided by the present invention, The owner and the recipient provide personally identifiable information and their own... The public key uses a DID server to generate its corresponding DID and DID document, and signs the DID document using its private key. Then, the DID server invokes a smart contract to store it on the blockchain. In other words, before the DID and DID document are uploaded to the blockchain, [the process is as follows:] ... The private key is used to sign the DID document. The specific DID registration method is shown in Table 4:

[0039] Table 4: DID Registration Step 2: The owner transfers file W via a symmetric key. The encrypted text C is then uploaded to the database server, as shown in Table 5.

[0040] Table 5: File Upload Step 3: The recipient sends the file attribute information to be retrieved to the owner. The owner signs the file attribute information of the corresponding file as a public message to obtain a signature value. Then, the signature value and the owner's DID are encapsulated into a verifiable credential and sent to the recipient.

[0041] Specifically: The data receiver sends file attribute information (Attrs) to the data owner, requesting authorization for the corresponding file. The data owner then signs the file attribute information to obtain the corresponding signature value. It then encapsulates the owner's DID into a verifiable credential (VC) and sends it as an authorization certificate to the file recipient.

[0042] The specific process is shown in Table 6: Table 6: Obtaining Authorization Step 4: The recipient verifies the owner's identity and the legitimacy of the verifiable credentials through the DID server. After successful verification, the recipient parses the verifiable credentials to obtain the signature value.

[0043] Specifically: The file recipient sends the Verifiable Token (VC) to the database server. Upon receiving the VC, the database server verifies the signature validity of the VC and the identity of the data owner through the DID server. After successful identity verification, the recipient parses the signature value. .

[0044] Step 5: The database server verifies the recipient's identity through the DID server. After successful verification, the OSBE protocol is executed between the recipient, the database server, and the owner on the signature value, and the recipient obtains the symmetric key.

[0045] Specifically: The receiver calculates X from the signature value and sends X to the database server. The database server calculates Z and Ks from X and sends Ks to the owner. The owner calculates C from Ks and sends C to the database server. The database server then sends Z and C to the receiver. The receiver calculates ks based on Z and the key derivation function, and uses ks to decrypt C to obtain the final symmetric key, where X, Z, Ks, ks, and C are... These are all process parameters, such as Figure 2 As shown.

[0046] The specific algorithm is shown in Table 7: Table 7: OSBE Authorization Interaction Algorithm Step 6: The database server sends the ciphertext to the recipient, who then decrypts the ciphertext using the symmetric key to obtain the file.

[0047] Specifically, the data receiver and the database server execute the PIR protocol, and the receiver ultimately obtains the ciphertext. As shown in Table 8.

[0048] Table 8: Data Retrieval Stage Specifically, the receiver decrypts the ciphertext using a symmetric key to obtain the file shown in Table 9: Table 9: Data Recovery Phase This invention proposes an access control framework for a private information retrieval protocol (PIR) and experimentally evaluates its performance in a single-server PIR protocol. By introducing DID (Distributed Identifier), it solves the identity management and privacy issues when multiple participants share data in a distributed environment, ensuring that user identity privacy is not exposed during data sharing. Addressing the problem that current PIR protocols cannot achieve data subject authorization when multiple participants share data, this invention proposes an authorization algorithm combining DID and OSBE (On-Site Entity Execution), ensuring that the file recipient has obtained authorization from the data subject before performing private information retrieval.

[0049] (1) In the context of distributed data sharing, identity management is simplified and privacy protection is enhanced: By combining decentralized identity (DID), user registration no longer relies on third parties. Identity information is distributed and stored in a blockchain or peer-to-peer network, and users control their identity data autonomously through their private keys. Even if some nodes fail, the identity system can still function, avoiding the single point of vulnerability of centralized institutions. It returns control of identity to the user while improving security, privacy, and efficiency through encryption algorithms and a distributed architecture. Anonymity is also achieved during information retrieval, preventing attackers from linking to a user's true identity through the DID identifier.

[0050] Table 10 shows the time required for the key stages of user registration and verification: Table 10: Time Cost of Identity Registration and Verification Phase (2) Improved performance during the private information retrieval authorization phase: During the file authorization phase, the Dobse scheme and the ASKPIR scheme were compared. Due to the different PIR schemes used, only the computational overhead of the file authorization phase under different message entries was considered, and simulation experiments were conducted, such as... Figure 3 As shown, the number of messages were 200, 400, 600, 800, 1000, and 1200 respectively. The computation time for each scheme was recorded in ms. The experimental results show that the authorization algorithm is superior to the scheme ASKPIR in terms of computational overhead.

[0051] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0052] Although embodiments of the present invention have been disclosed above, they are not limited to the applications listed in the specification and embodiments. It can be applied to various fields suitable for the present invention. Other modifications can be readily implemented by those skilled in the art. Therefore, without departing from the general concept defined by the claims and their equivalents, the present invention is not limited to the specific details and examples shown and described herein.

Claims

1. A method for retrieving authorized private information based on DID, characterized in that, include: The recipient and owner register with the DID server to generate a DID and a DID document, and then upload the DID and the DID document to the blockchain; The owner encrypts the file using a symmetric key to obtain ciphertext and uploads it to the database server; The recipient sends the file information to be retrieved to the owner. The owner signs the file attribute information of the corresponding file as a public message to obtain a signature value. Then, the signature value and the owner's DID are encapsulated into a verifiable credential and sent to the recipient. The recipient verifies the owner's identity and the legitimacy of the verifiable credentials through the DID server. After successful verification, the recipient parses the verifiable credentials to obtain the signature value. The database server verifies the recipient's identity through the DID server. After successful verification, the OSBE protocol is executed on the signature value between the recipient, the database server, and the owner, and the recipient obtains the symmetric key. The database server sends the ciphertext to the recipient, who then decrypts the ciphertext using a symmetric key to obtain the file.

2. The authorized private information retrieval method based on DID as described in claim 1, characterized in that, The method for executing the OSBE protocol is as follows: The receiver calculates X from the signature value and then sends X to the database server; After the database server calculates Z and Ks using X, it sends Ks to the owner. The owner calculates C using Ks and then sends C to the database server; The database server then sends Z and C to the recipient; The receiver calculates ks based on Z and the key derivation function, and then decrypts C using ks to obtain the final symmetric key; X, Z, Ks, ks, and C are all process parameters.

3. The authorized private information retrieval method based on DID as described in claim 1, characterized in that, Before DID registration, the owner and recipient generate the necessary signature verification documents for the DID. key pair Generate for the owner Algorithm common parameters Schnorr key pair and symmetric encryption key .

4. The authorized private information retrieval method based on DID as described in claim 3, characterized in that, Before DID and DID documents are uploaded to the blockchain, through... The private key is used to sign the DID document.

5. The authorized private information retrieval method based on DID as described in claim 4, characterized in that, The method to obtain the signature value is as follows: Choose a random number k, then calculate e and s to obtain the signature value. The formula is: ， ， ， Where M represents file attribute information.

6. The authorized private information retrieval method based on DID as described in claim 4, characterized in that, After encapsulating the signature value and the owner's DID, it is passed through... The private key is used to sign, resulting in a verifiable credential.

7. The authorized private information retrieval method based on DID as described in claim 1, characterized in that, The receiver and the database server transmit encrypted data via the PIR protocol.

Images