Image encryption retrieval method, device and medium capable of hidden data access

Abstract

The present invention relates to an image encryption retrieval method capable of hiding data access, and in a single cloud architecture, returns all image data whose quasi-Euclidean distance to the encrypted query request is less than or equal to a threshold value T. The present invention first calculates the Euclidean distance between feature vectors in a ciphertext space and compares the size, obtains the first 0 / 1 encrypted sequence, and then performs index encoding on the sequence. After the data user receives the encrypted code, the index set of all target images that meet the query request is obtained through decryption. Finally, the data user executes a private information retrieval protocol based on the index set and the server to obtain a set of all target images that meet the query conditions, thereby hiding the image data access mode during the image retrieval process. Furthermore, the present invention reduces the time overhead of image encryption retrieval by using a Bloom filter for binary search.

Description

Technical Field

[0001] The present disclosure relates to the technical field of data processing, and in particular to an image encryption retrieval method, device and medium capable of hidden data access. Background Art

[0002] Xia et al. proposed a privacy-preserving content-based image encryption retrieval scheme under a single cloud architecture in their journal “EPCBIR: An efficient and privacy-preserving content-based image retrieval scheme in cloud computing”.

[0003] In this technical solution, the method comprises the following steps:

[0004] In the first step, the data user generates a security key set based on the security parameter κ;

[0005] The security key set includes a vector storing bits, two reversible matrices, a set of local sensitive hash functions, a set of security keys for bucket encryption, and a private key for encrypted images;

[0006] In the second step, the data user performs chaotic encryption on the image set to protect the privacy of the image content;

[0007] The third step is to generate an unencrypted dual index structure, including a bottom layer and an upper layer. The bottom layer is a one-to-one mapping between image feature vectors and image labels, and the upper layer is a pre-filtering table constructed based on a local sensitive hash function.

[0008] Encrypting the dual index structure, expanding each feature vector into a new vector, the new vector is composed of the original vector and the square of the Euclidean norm of the original vector;

[0009] Expand the new vector into two random vectors, take values ​​of the two random vectors according to the corresponding bit vectors, and encrypt the two random vectors using a reversible matrix;

[0010] Encrypt the values ​​of the buckets one by one;

[0011] The fourth step is to extract the feature vector of the query image according to the query image, and generate the query trapdoor according to the feature vector;

[0012] The fifth step is to execute the query based on the encrypted index, encrypted image and query trap, obtain the labels of all similar images, send the labels of the first few most similar images, and send the corresponding encrypted images to the data user. The query user decrypts them to obtain the original image, completing the entire privacy-protected image encryption query process.

[0013] In the above scheme, in addition to encrypting the image itself, the data owner also needs to generate and encrypt the image index based on the image feature vector, which involves linear-level matrix operations and incurs a lot of computing overhead. In addition, the server obtains the label of the target image, resulting in the leakage of the image data access pattern. Summary of the invention

[0014] In view of the above-mentioned prior art, the technical problem solved by the present invention is to provide a method for hiding the image data access mode during the image retrieval process and further reduce the operation to a sublinear level.

[0015] In order to solve the above technical problems, the technical solution of the present invention is as follows:

[0016] In a first aspect, the present invention provides an image encryption retrieval method capable of hiding data access, the method comprising the following steps:

[0017] The data user extracts a feature vector from the image to be matched;

[0018] Encrypt each element of the feature vector, the sum of squares of the elements in the feature vector, and the specified encryption threshold using the second public key, and send the three encrypted results as query parameters to the server;

[0019] The server combines the second public key, the operation key, and the data owner's data and uses the three query parameters to obtain the first 0 / 1 encryption sequence;

[0020] The server encrypts the obtained first 0 / 1 encryption sequence using the operation key, sends it to the data user for decryption using the second private key, and receives the decryption result returned by the data user;

[0021] The server performs index encoding based on the first 0 / 1 encryption sequence and the decryption result, and returns the encoding result to the data user;

[0022] The data user receives the encoding result and decodes the encoding result to generate a target index set;

[0023] When a data user inputs an index in the target index set, a corresponding encrypted image encrypted using the first public key is obtained from the server, and the obtained encrypted image is decrypted using the first private key to obtain the original image.

[0024] In the above technical scheme, in order to solve the problem that image encryption retrieval under the unit architecture cannot efficiently hide the data access mode, an image retrieval scheme that can hide the data access mode under the unit architecture is adopted. Under the single cloud image retrieval scheme, this scheme returns all image data whose Euclidean distance to the encrypted query request (encrypted feature vector) is less than or equal to the threshold T, while ensuring the privacy of the result image set (not leaked to the cloud server), thereby hiding the data access mode. In this technical scheme, the server compares and matches the query feature vector and the encrypted feature vector of the original image in combination with the encryption threshold to obtain the first 0 / 1 encrypted sequence. After the server indexes the obtained first 0 / 1 encrypted sequence, it returns the encoded result to the data user, who decodes it to obtain all target index sets that meet the query request. When the data user enters the index in the target index set, the encrypted image data can be obtained, thereby realizing the image encryption retrieval scheme that protects the image data access mode.

[0025] In the method, one implementation of the first public key and the first private key is to generate them through a symmetric encryption algorithm; one implementation of the second public key, the second private key, and the operation key is to generate them through a fully homomorphic encryption algorithm.

[0026] In the method, the first 0 / 1 encryption sequence is used to obtain an image data set less than or equal to the value range T while ensuring that the result image set is not leaked to the cloud server. One way to obtain it is as follows:

[0027] According to the following calculation formula, we can get E2(D′ i ) and the encrypted value of the updated threshold E2(T′):

[0028]

[0029]

[0030] Where: x i，j is the i-th image feature vector x i The j-th element of , i = 1, 2, ..., n, n is the number of images; j = 0, 1, ..., k-1, k is the dimension of the image feature vector; are homomorphic addition and multiplication respectively; E2(q j ) is the element q in the eigenvector q j The encrypted value of q is the feature vector extracted from the image to be matched m, q = [q0, ..., q k-1 ]; is the encrypted value of the sum of squares of the elements in the feature vector q; T is the specified threshold; E2(T) is the encrypted value of the specified threshold; D′ i is the original text of the encrypted space vector; T′ is the original text of the encrypted threshold;

[0031] According to the following comparison criteria, based on E2(D′ i ) and E2(T′), obtain an encrypted sequence of length n, in which the element value is 0, 1 or 1 / 2;

[0032]

[0033] After comparing and matching the obtained encryption sequence with E2(1), a scaling homomorphic operation of multiplying by two is performed to obtain the first 0 / 1 encryption sequence, in which the element value is 0 or 1.

[0034] As a further improvement of the present invention, in the method, the server uses Bloom filters to establish a binary search tree, each Bloom filter represents a layer of the binary search tree, and the time complexity of the data user's check (CHECK) operation is reduced from a linear level to a sublinear level, and the index encoding of the obtained first 0 / 1 encryption sequence is implemented, and the encoding result is sent to the image data user. After the image data user performs a CHECK operation, the index set that satisfies the query request is obtained. The encoding includes the following steps:

[0035] The server establishes a Bloom filter binary search tree based on the decryption result s; the steps for establishing the Bloom filter binary search tree are as follows:

[0036] The number of images in the image set is recorded as n, and the number of Bloom filters t is determined by the following formula:

[0037]

[0038] In the formula: Symbol Indicates rounding up;

[0039] Create t+1 Bloom filters of length l, where:

[0040] m=max(2s,s+2f p )

[0041] Where: η is the number of hash functions; f p Indicates the upper bound of the number of false positives obtained by decoding;

[0042] Let Bloom filter be

[0043] For the kth Bloom filter, randomly select a set of hash functions is the qth hash function in the kth Bloom filter;

[0044] For the kth Bloom filter if The value is equal to will The value of is updated to Otherwise, The value of is updated to Thus, we get t+1 encrypted Bloom filters. Among them, v i is the i-th element in the first 0 / 1 encryption sequence,

[0045] The decoding comprises the following steps:

[0046] The data user performs t+1 encrypted Bloom filters Decryption is performed;

[0047] Create t empty sets, I, I 0 ,…,I t-1 , establish the set It = {2s};

[0048] Starting from k = t, in descending order of the Bloom filter superscript k, k ∈ {1, ..., t}, for each k, for all i ′ ∈ I k , if there exists j such that And the kth Bloom filter If it is greater than 0, insert the value 2i′-1, 2i′ into the set I k-1 Until k = 1, we get I 0 ;

[0049] For i′∈I 0 , if there exists j such that and If i′ is greater than 0, i′ is inserted into set I, which is the target index set.

[0050] As a further improvement of the present invention, in the method, the size of the target index set is equal to s+e, where: s is the number of encrypted 1s in the first 0 / 1 encryption sequence, and e is the number of false positives in the decoding process;

[0051] If e>f p , the current query is interrupted and a new query request is initiated; otherwise, f is generated p -e virtual indexes are inserted into the target index set.

[0052] As a further improvement of the present invention, in the method, the step of obtaining the corresponding encrypted image encrypted using the first public key from the server includes the following steps:

[0053] Based on the input index, a second 0 / 1 encryption sequence is generated, and the second 0 / 1 encryption sequence is sent to the server. The server performs scalar multiplication of the second 0 / 1 encryption sequence with the encrypted image set one by one and then homomorphically sums them to obtain the ciphertext encrypted based on the encrypted image corresponding to the index, and returns the ciphertext to the data user for decryption to obtain the corresponding encrypted image. In this process, the data user obtains the encrypted image without leaking the index to the server.

[0054] As a further improvement of the present invention, in the method, the data of the data owner is stored on the server to improve the retrieval efficiency and feedback speed, and the data of the data owner includes:

[0055] Based on the image set M = {m1, ..., m n} The image ciphertext set E1(M) generated using the first public key = {E1(m1), ..., E1(m n )};

[0056] Based on the image set M = {m1, ..., m n}, forming a feature vector set X = {x1, ..., x n};

[0057] The ciphertext obtained by encrypting each element in the n eigenvectors and the sum of the squares of the k elements of each vector using the second public key

[0058] And the second public key and the operation key.

[0059] As a further improvement of the present invention, in the method, the first private key, the second public key, and the second private key are applied for by the data user to the data owner before initiating an encrypted query request to avoid obtaining or leaking privacy information through the server.

[0060] As a further improvement of the present invention, in the method, another method for obtaining a target index set is provided, wherein the encoding comprises the following steps:

[0061] The decryption result of the first 0 / 1 encryption sequence encrypted by the data user is recorded as s;

[0062] The server performs homomorphic scalar multiplication and homomorphic addition operations on s to calculate the power sum of the index

[0063] v i is the i-th element in the first 0 / 1 encryption sequence;

[0064] The server will encrypt the index and set The data user decrypts the data using the second private key and obtains the set {w1, ..., w s}, according to the set {w1,…,w s}Construct a polynomial f(x)=a with roots {x:x∈I} s x s +a s-1 x s-1 +…+a1x+a0;

[0065] in:

[0066]

[0067] The target index set I is constructed by all solutions of the polynomial.

[0068] In a second aspect, the present invention proposes an image encryption retrieval device capable of hidden data access, comprising a memory and a processor, wherein the memory stores a computer program that can be loaded by the processor and execute any of the above methods.

[0069] In a third aspect, the present invention proposes a computer-readable storage medium, characterized in that it stores a computer program that can be loaded by a processor and execute any of the above methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0071] Figure 1 , one Interaction diagram in an embodiment;

[0072] Figure 2 , one A schematic diagram of a method implementation flow in an embodiment. DETAILED DESCRIPTION

[0073] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0074] The terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features.

[0075] In one embodiment of the method of the present invention, the implementation subjects include three, the data owner, the cloud server and the data user, and the interaction between them is as follows: Figure 1 As shown. Obviously, the implementation entities interact with each other. The following introduction is based on the implementation entity and introduces the main operations performed by each implementation entity.

[0076] (1) Data Owner

[0077] The data owner first generates the public and private key pair of the encryption algorithm through public parameters, including:

[0078] (I) generating a first public-private key pair for image encryption, including a first public key and a first private key;

[0079] (II) Generate a second public-private key pair for encrypting the image feature vector, including a second public key, a second private key, and a calculation key.

[0080] In the current implementation, the first public-private key pair is generated using a symmetric encryption algorithm, so the public key and private key are the same, denoted as {sk1}. The second public-private key pair is generated using a fully homomorphic encryption algorithm (CKKS), denoted as {pk2, evk, sk2}, where: pk2 is the second public key; evk (evaluation key) is the operation key used by the server to perform homomorphic operations on encrypted data; sk2 is the second private key.

[0081] (1.1) Let the image set of the data owner be M = {m1, ..., m n}, use sk1 to encrypt the image set one by one, and get the ciphertext set E1(M) = {E1(m1), ..., E1(m n )}, n is the number of elements in the image set.

[0082] (1.2) From the image set M = {m1, ..., m n} to extract n k-dimensional feature vectors to form a feature vector set X = {x1, ..., x n}, for each x i , x i ={x i1 , x i2 , …, x ik}, i∈{1,…,n}.

[0083] (1.3) Encrypt the elements in the feature vector set one by one, encrypt the sum of the squares of the k elements that make up each feature vector, and upload them to the server together with the second public key and the operation key. The uploaded content is as follows:

[0084]

[0085] (2) Server

[0086] (2.1) Receive the following content from the data owner:

[0087] (2.1.1) Image ciphertext set: Based on the image set M = {m1, ..., m n} The image ciphertext set E1(M) generated using the first key = {E1(m1), ..., E1(m n )};

[0088] (2.1.2) Feature vector ciphertext set: Based on the image set M = {m1, ..., m n}, forming a feature vector set X = {x1, ..., x n}, for each x i , x i ={x i1 , x i2 , …, x ik}, i∈{1,…,n}. The ciphertext is obtained by encrypting each element in the n eigenvectors and the sum of the squares of the k elements of each vector using the second public key pk2

[0089] (2.1.3) Second public key and operation key.

[0090] (2.2) Receive the following content from data users:

[0091] Extract the feature vector q from the matching image m, q = [q0, ..., q k-1 ]. Use the second public key pk2 to encrypt the feature vector element by element as the encrypted query request, and use the second public key pk2 to encrypt the sum of the squares of each element of the vector, and upload it to the server together with the encryption threshold specified by the data user, that is:

[0092]

[0093] (2.3) In the ciphertext space, calculate the encrypted query request {E2(q0),…,E2(q k-1 )} and the set of eigenvectors X = [x1,…,x n The encrypted space vector distance E2(D′) of each eigenvector in i). The calculation formula is as follows:

[0094]

[0095] Accordingly, calculate E2(D′ i ) Compare the encryption threshold E2(T′) of size:

[0096]

[0097] (2.4) Using the ciphertext comparison method under homomorphic encryption, E2(D′ i ), E2(T′), the comparison criteria are as follows:

[0098]

[0099] For the above comparison criteria, since the server cannot know the original text, direct comparison cannot be performed. In one implementation, the ciphertext of the present invention has the fully homomorphic property, and the approximate calculation of the approximate polynomial is realized by directly calculating the homomorphic multiplication and homomorphic addition on the ciphertext to obtain the ciphertext of the comparison result.

[0100] Therefore, using the scaling operation of the CKKS encryption scheme, T′, D′ can be scaled to the interval [0, 1], and its size is set according to the actual situation, so as to obtain an encrypted sequence of length n

[0101]

[0102]

[0103]

[0104] Where: This means that the polynomial operation on the left side of the symbol is the polynomial approximation of the polynomial operation on the right side, and μ is a real number greater than 0. Function f n The function expression is:

[0105]

[0106] By using the above comparison algorithm, an encrypted sequence with element values ​​consisting of 0, 1 / 2, and 1 and a length of n is obtained. The element set in the encrypted sequence is recorded as:

[0107]

[0108] If the sequence is converted into the first 0 / 1 encrypted sequence of length n, whose element values ​​are 0 or 1, index encoding can be easily performed, thereby reducing the time complexity of the data user check (CHECK) operation from the linear level to the sublinear level. The following operation can be performed to convert the encrypted sequence whose element values ​​are 0, 1 / 2, 1 into the encrypted sequence whose element values ​​are 0 and 1:

[0109] Will Compare the ciphertext with E2(1), that is, E2(comp(v i , 1)), and then multiply by two to perform a scaling homomorphic operation, the set can be transformed from Updated to {E2(v i )|v i =0or1, i=1, ..., n}, the sequence formed by the elements in the updated element set is the first 0 / 1 encryption sequence;

[0110] (2.5) index encoding the first 0 / 1 encryption sequence;

[0111] The index coding used in one embodiment of the present invention has four parameters: (n, s, c, f p ), n is the size of the image set uploaded by the data owner, s is the number of non-zero plaintexts in the first 0 / 1 encryption sequence, c corresponds to the dimension of the output code, and f p The upper bound of the number of false positives corresponding to the decoding output is the set value. The false positive refers to the data user mistakenly judging an index that is not in the correct target index set as being in the set during decoding; the false negative is the opposite. A correct index encoding scheme allows very few false positives but does not allow false negatives.

[0112] In the above process, the index encoding algorithm is as follows:

[0113] The number of Bloom filters t is determined according to the following formula:

[0114]

[0115] In the formula: Symbol Indicates rounding up.

[0116] The server initializes t+1 encrypted Bloom filters of length l, where:

[0117] m=max(2s,s+2f p )

[0118] Where: η is the number of hash functions; f p Indicates the upper bound of the number of false positives in the decoded output. The percentage of false positives is calculated by the following formula:

[0119]

[0120] It can be seen from the above formula that the proportion of false positives can be adjusted, for example, by increasing the length l of the Bloom filter to reduce the proportion of false positives. The Bloom filter is denoted as:

[0121]

[0122] And randomly select a set of hash functions for each Bloom filter:

[0123]

[0124] For each Bloom filter, perform the following operations: for all i∈{1,…,n},q∈{1,…,η},let if equal Just order Otherwise, let Finally, output t+1 encrypted Bloom filters In the current implementation, by establishing a Bloom filter binary search tree, the CHECK operation of the data user on the Bloom filter is reduced to a sublinear level.

[0125] For the convenience of explanation, let the first 0 / 1 encryption sequence be I, and use superscript to represent the set number:

[0126]

[0127] For I k-1 ,have:

[0128]

[0129] Assume that the size of the image set uploaded by the data owner is 32, 32 = 2 5 , so the number of index sets that need to be constructed is 5. The target index set that needs to be encoded is I = {1, 14, 16}, and the elements in I are the indexes of the images, so there are the following index sets:

[0130] I 4 ={1};I 3 ={1,2};I 2 ={1,4};I 1 ={1,7,8};I 0 ={1, 14, 16}

[0131] The cloud server inserts the five index sets into the five Bloom filters in the order of increasing superscript k. The data user uses the private key corresponding to the second public key to decrypt the ciphertexts of the five Bloom filters one by one and then performs the CHECK operation in the order of decreasing superscript k, that is, the order of CHECKing the index sets is I. 4 , I 3 , I 2 , I 1 , I 0 .

[0132] I 4 , I 3 , I 2 , I 1 , I 0 Each of the five sets corresponds to a Bloom filter into which elements of each set are inserted. Data users do not know in advance which elements are in each Bloom filter. 4 For example, the conditions that data users need to meet to obtain collection elements are:

[0133] And the maximum element value (n) in the I set is 32

[0134] So we can get I 4 The specific set conditions that should be met are:

[0135]

[0136] According to the relationship that the set should satisfy:

[0137]

[0138] in: For I k All elements in .

[0139] You can get I 3 The collection conditions that should be met are:

[0140]

[0141] After that, the data user only needs to apply the Bloom filter B 3 Perform 1, 2, 3, 4 CHECKs to get set I 3 All elements. And so on, finally the target index set I is obtained. Through this implementation, the number of CHECKs performed by data users can be reduced.

[0142] (3) Data Users

[0143] (3.1) The data user applies for query and access control permissions from the data owner, and the data owner sends the query permission {pk2} and access control permission {sk1, sk2} to the data user.

[0144] (3.2) The data user extracts the feature vector q from the matching image m, q = [q0, ..., q k-1 ]. Use the public key pk2 to encrypt the feature vector element by element as the encrypted query request, and use the public key pk2 to encrypt the square sum of each element of the vector, and upload it to the server together with the encryption threshold specified by the data user. The content to be uploaded is as follows:

[0145]

[0146] (3.3) After the server compares and matches the uploaded content, it obtains a 0 / 1 encryption sequence, where the 0 / 1 encryption sequence is the first 0 / 1 encryption sequence. The server homomorphically adds the first 0 / 1 encryption sequence to obtain the ciphertext The server will ciphertext Send it to the data user. The data user receives the ciphertext The decryption is performed and the decrypted result s is returned to the server, where the decrypted result s represents the sparsity, corresponding to the number of non-zero plaintexts in the first 0 / 1 encryption sequence.

[0147] (3.4) After the server encodes the first 0 / 1 encryption sequence through index encoding based on the decryption result s, the server sends the encoding result to the data user. The data user receives the encoding result and decodes it to obtain the target index set. The decoding operation of the data user is as follows:

[0148] After the data user decrypts the Bloom filter binary search tree, he first initializes t empty sets, I, I 0 ,…,I t-1 , and then initialize a set I t ={2s}; one by one in the order of decreasing superscript k of Bloom filter B, for all i′∈I k , k∈[0,t].

[0149] If there is a hash value of i′, it corresponds to the j+1th position in a single Bloom filter (a hash table), that is: Make If it is greater than 0, insert the value 2i′-1, 2i′ into the set I k-1 In this way, we can loop from k=t to k=1 to obtain the set I 0 , for i′∈I 0 , if it exists Make If i′ is greater than 0, insert i′ into set I and finally output the target index set I.

[0150] The size of the target index set I is equal to s+e, where s is the number of encrypted 1s in the first 0 / 1 encryption sequence, and e is the number of false positives in the decoding process. To prevent the server from obtaining other privacy information from the size of I, the data user should determine e and f p If e>f p , the data user interrupts the query and re-initiates the query request. Otherwise, the data user will generate f p -e virtual indexes are inserted into the set I, thereby obtaining the final index set I′.

[0151] (3.5) Based on the PIR protocol, the data user uses the properties of scalar multiplication and additive homomorphism of the fully homomorphic encryption algorithm, and uses the BFV scheme to encrypt based on the index r, r∈I′ to generate the second 0 / 1 encryption sequence. In the second 0 / 1 encryption sequence, except for the encryption of index position r being 1, the rest are all encryption of 0.

[0152] The data user sends the second 0 / 1 encryption sequence to the server. The server has a data set E1(M)={E1(m1),...,E1(m n )}. The server performs scalar multiplication on the second 0 / 1 encryption sequence and its own data set one by one, and then sums them homomorphically. The ciphertext content obtained is E1(m i ), namely E BFV (E1(m i )). By using the PIR protocol for image query, the index location can be avoided from being leaked to the server.

[0153] Data users obtain E BFV (E1(m i )), the first decryption yields E1(m i ), the second decryption Dec(E1(m i ), sk1), thereby obtaining the original image data m i Through the PIR protocol, private information retrieval is performed. After the data user enters the index, the data user can obtain the encrypted image in the server dataset and will not disclose the index to the server, thus achieving privacy protection for image data access.

[0154] Summarize the implementation process of the method in the above implementation mode, combined with Figure 2 The method of the present invention mainly includes the following aspects when implemented:

[0155] The data owner of the image generates two sets of public and private key pairs, one set of encrypted images, and one set of encrypted image feature vectors;

[0156] The data owner encrypts the image and its feature vector and sends them to the cloud server;

[0157] The data user encrypts the feature vector of the image to be queried and uses it as part of the query request parameters to initiate an encrypted query request to the cloud server;

[0158] The server matches the query request parameters with the encrypted image feature vector of the data owner to obtain a 0 / 1 encryption sequence, where the 0 / 1 encryption sequence is the first 0 / 1 encryption sequence;

[0159] The server performs index encoding based on the first 0 / 1 encryption sequence and sends the encoding result to the data user;

[0160] The target index set is obtained by decoding by the data user;

[0161] The data user inputs the index in the target index set and executes the PIR protocol to obtain the encrypted image;

[0162] The data user decrypts the encrypted image to obtain the original image.

[0163] In the above implementation process, the target index set is obtained, in another implementation, by using the application of Newton's identity in polynomial roots.

[0164] The first 0 / 1 encrypted sequence is homomorphically added to obtain the ciphertext, which is sent to the data user for decryption, and the decryption result s is received, where s is the number of encryptions with 1;

[0165] Perform homomorphic scalar multiplication and homomorphic addition operations on s, computing the sum of indices to powers

[0166] v i is the i-th element in the first 0 / 1 encryption sequence;

[0167] Encrypting index powers and collections The data is sent to the data user for decryption. The data user uses the set {w1, ..., w s}Construct a polynomial with roots {x:x∈I}:

[0168] f(x)=a s x s +a s-1 x s-1 +…+a1x+a0

[0169] in:

[0170]

[0171] All solutions of this polynomial constitute the target index set I.

[0172] Through the description of the above implementation modes, those skilled in the art can clearly understand that the present disclosure can be implemented by means of software plus necessary general hardware, and of course can also be implemented by special hardware including special integrated circuits, special CPUs, special memories, special components, etc. In general, all functions performed by computer programs can be easily implemented by corresponding hardware, and the specific hardware structures used to implement the same function can also be various, such as analog circuits, digital circuits or special circuits, etc. However, for the present disclosure, software program implementation is a better implementation mode in most cases.

Claims

1. An image encryption retrieval method capable of hiding data access, characterized in that: The method comprises the following steps: extracting a feature vector from an image to be matched by a data user; Encrypt each element of the feature vector, the sum of squares of the elements in the feature vector, and the specified encryption threshold using the second public key, and send the three encrypted results as query parameters to the server; The server combines the second public key, the operation key, and the data owner's data and uses the three query parameters to obtain the first 0 / 1 encryption sequence; The server encrypts the obtained first 0 / 1 encryption sequence using the operation key, sends it to the data user for decryption using the second private key, and receives the decryption result returned by the data user; The server performs index encoding based on the first 0 / 1 encryption sequence and the decryption result, and returns the encoding result to the data user; The data user receives the encoding result and decodes the encoding result to generate a target index set; When a data user inputs an index in the target index set, a corresponding encrypted image encrypted using the first public key is obtained from the server, and the obtained encrypted image is decrypted using the first private key to obtain the original image.

2. The method according to claim 1, characterized in that: The first public key and the first private key are generated by a symmetric encryption algorithm; the second public key, the second private key, and the operation key are generated by a fully homomorphic encryption algorithm.

3. The method according to claim 2, characterized in that The first 0 / 1 encryption sequence is obtained by the following steps: According to the following calculation, we can get E2(D i ′) and the encrypted value of the updated threshold E2(T′): Where: x i,j is the i-th image feature vector x i The j-th element of , i = 1, 2, ..., n, n is the number of images; j = 0, 1, ..., k-1, k is the dimension of the image feature vector; are homomorphic addition and multiplication respectively; E2(q j ) is the element q in the eigenvector q j The encrypted value of q is the feature vector extracted from the image to be matched m, q=[q0,…,q k-1 ]; is the encrypted value of the sum of the squares of the elements in the eigenvector q; T is the specified threshold; E2(T) is the encrypted value of the specified threshold; D i ′ is the original text of the encrypted space vector distance; T′ is the original text of the encrypted threshold; According to the following comparison criteria, based on E2(D i ′) and E2(T′), obtain an encrypted sequence of length n, in which the element value is 0, 1 or 1 / 2; After comparing and matching the obtained encryption sequence with E2(1), a scaling homomorphic operation of multiplying by two is performed to obtain the first 0 / 1 encryption sequence, in which the element value is 0 or 1.

4. The method according to claim 1, characterized in that: The index encoding comprises the following steps: The decryption result of the first 0 / 1 encryption sequence encrypted by the data user is recorded as s; The server builds a Bloom filter binary search tree based on the decryption result s; The steps for establishing the Bloom filter binary search tree are as follows: The number of images in the image set is recorded as n, and the number of Bloom filters t is determined by the following formula: In the formula: Symbol Indicates rounding up; Create t+1 Bloom filters of length l, where: Where: η is the number of hash functions; f p Indicates the upper bound of the number of false positives obtained by decoding; Let Bloom filter be k∈{1,…,t}; For the kth Bloom filter, randomly select a set of hash functions is the qth hash function in the kth Bloom filter; For the kth Bloom filter if The value is equal to will The value of is updated to Otherwise, The value of is updated to Thus, we get t+1 encrypted Bloom filters. Among them, v i is the i-th element in the first 0 / 1 encryption sequence, i∈{1,…,n},q∈{1,…,η}; Index decoding includes the following steps: The data user performs t+1 encrypted Bloom filters Decryption is performed; Create t empty sets, I, I 0 ,…,I t-1 , establish set I t ={2s}; Starting from k = t, in descending order of the Bloom filter superscript k, k ∈ {1, ..., t}, for each k, for all i ′ ∈ I k , if there exists j such that And the kth Bloom filter If it is greater than 0, insert the value 2i′-1, 2i′ into the set I k -1 Until k = 1, we get I 0 ; For i′∈I 0 , if there exists j such that and If it is greater than 0, i′ is inserted into set i, and set I is the target index set.

5. The method according to claim 4, characterized in that The size of the target index set is equal to s+e, where: s is the number of encrypted 1s in the first 0 / 1 encryption sequence, and e is the number of false positives during the decoding process; If e>f p , the current query is interrupted and a new query request is initiated; otherwise, f is generated p -e virtual indexes are inserted into the target index set.

6. The method according to claim 1, characterized in that The step of obtaining the corresponding encrypted image encrypted using the first public key from the server comprises the following steps: Based on the input index, a second 0 / 1 encryption sequence is generated, and the second 0 / 1 encryption sequence is sent to the server. The server performs scalar multiplication of the second 0 / 1 encryption sequence with the encrypted image set one by one, and then homomorphically sums them to obtain the ciphertext encrypted based on the encrypted image corresponding to the index, and returns the ciphertext to the data user for decryption to obtain the corresponding encrypted image.

7. The method according to claim 1, characterized in that The data of the data owner is stored on the server, and the data of the data owner includes: Based on the image set M = {m1,…,m n }The image ciphertext set E1(M) generated using the first public key = {E1(m1),…,E1(m n )}; Based on the image set M = {m1,…,m n }, forming a feature vector set X = {x1,…,x n }; The ciphertext E2(x i )={E2(x i,1 ),…,E2(x i,k )}, i={1,…,n}; And the second public key and the operation key.

8. The method according to claim 1, characterized in that The encoding comprises the following steps: The decryption result of the first 0 / 1 encryption sequence encrypted by the data user is recorded as s; The server performs homomorphic scalar multiplication and homomorphic addition operations on s to calculate the power sum of the index j∈{1,…,s},i∈{1,…,n},v i is the i-th element in the first 0 / 1 encryption sequence; The server will encrypt the index and set The data user decrypts the data using the second private key and obtains the set {w1,…,w s }, according to the set {w1,…,w s }Construct a polynomial f(x)=a with roots {x:x∈I} s x s +a s-1 x s-1 +…+a1x+a0; in: The target index set I is constructed by all solutions of the polynomial.

9. An image encryption retrieval device capable of hiding data access, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program that can be loaded by the processor and executes the method according to any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that: A computer program is stored which can be loaded by a processor and execute the method according to any one of claims 1 to 8.

Images