A method, system, server and client for implementing privacy information retrieval

Abstract

The one or more embodiments of the specification provide a method, system, server and client for realizing privacy information retrieval. In the method for realizing privacy information retrieval, a server encrypts a database to obtain a query base and sends the query base to a client; the client and the server use an exchangeable order encryption / decryption algorithm for encryption / decryption performed on the same target; in a retrieval process, the client sends a sensitive field encrypted by itself to the server and obtains the same sensitive field encrypted by the server through interaction with the server; the client searches in the query base according to the sensitive field encrypted by the server to obtain an identification of a matching record and returns the identification to the server; and the server returns a record corresponding to the identification or a value of a field of interest in the record corresponding to the identification in the database to the client.

Description

Technical Field

[0001] The embodiments in this specification belong to the field of privacy computing technology, and in particular relate to a method, system, server and client for implementing privacy information retrieval. Background Technology

[0002] Privacy-preserving computing is a set of technologies that enable data analysis and computation while protecting the data itself from external disclosure, achieving data usability without visibility. Through privacy-preserving computing technologies, the value of data can be transformed and released while fully protecting data and privacy.

[0003] Currently, the mainstream technologies for achieving privacy-preserving computation mainly fall into three categories: the first is cryptography-based privacy computation technology, represented by Secure Multi-Party Computation (SMPC); the second is technology derived from the integration of artificial intelligence and privacy protection technologies, represented by Federated Learning (FL); and the third is confidential computing (CC) technology based on trusted hardware, represented by Trusted Execution Environments (TEEs). In addition, differential privacy (DP) is also included. Differential privacy (DP) actually protects the computation result, not the computation process; while federated learning, secure multi-party computation, and confidential computing protect both the computation process and its intermediate results.

[0004] The first category of secure multi-party computation includes four fundamental technologies: Garbled Circuit (GC), Secret Sharing, Oblivious Transfer, and Homomorphic Encryption (HE). Homomorphic encryption is a special type of encryption algorithm that performs calculations directly on the ciphertext, yielding the same result as calculations based on the decrypted plaintext. It further includes Partially Homomorphic Encryption (PHE) and Fully Homomorphic Encryption (FHE).

[0005] Secure multi-party computation (SMPC) provides privacy protection for input secret data based on its solid security theoretical foundation, thus achieving security in the privacy-preserving computation process. Currently, there are two main implementation technical approaches to SMPC: general-purpose SMPC and problem-specific SMPC. The former can solve various computational problems, but this "universal" approach is usually large and has significant overhead. The latter designs dedicated protocols for specific problems, such as Private Set Intersection (PSI) and Privacy Information Retrieval (PIR), which often achieve computational results at a lower cost than general-purpose SMPC protocols. However, these protocols require careful design by domain experts for specific application scenarios, are generally not applicable to general scenarios, and have high design costs.

[0006] Privacy-preserving set intersection is the process by which participating parties obtain the intersection of their respective data sets without revealing any additional information. Additional information refers to any information beyond the intersection of their data sets. Privacy-preserving set intersection is extremely useful in real-world scenarios, such as data alignment in longitudinal federated learning or friend discovery using contact lists in social media.

[0007] Privacy information retrieval is a method by which a client retrieves information from a database. During the retrieval process, the querying party hides the identifier of the query target, and the data service provider provides matching query results without knowing the specific query target. Summary of the Invention

[0008] The purpose of this specification is to provide a method, system, server, and client for retrieving privacy information, including:

[0009] A method for retrieving privacy information involves the server encrypting a database to obtain a query base and sending the query base to the client; the client and server perform encryption / decryption on the same target using an encryption / decryption algorithm with interchangeable order.

[0010] A single search process includes:

[0011] The client sends a sensitive field that it has encrypted to the server, and obtains the same sensitive field encrypted by the server through interaction with the server;

[0012] The client retrieves the identifier of the matching record from the query base based on the sensitive field encrypted by the server, and returns the identifier to the server.

[0013] The server returns the value of the record corresponding to the identifier in the database, or the value of the field of interest in the corresponding record, to the client.

[0014] A system for retrieving private information includes a server and a client. The client and server perform encryption / decryption on the same target using an encryption / decryption algorithm with an interchangeable order, and:

[0015] The server is configured with a database, and after encrypting the database, a query base is obtained and sent to the client.

[0016] During a search process:

[0017] The client sends a sensitive field encrypted by itself to the server, and obtains the same sensitive field encrypted by the server through interaction with the server; it retrieves the identifier of the matching record in the query base based on the sensitive field encrypted by the server, and returns the identifier to the server;

[0018] The server receives sensitive fields sent by the client, which it has encrypted, and then encrypts them again before returning them to the client; it also receives a search identifier sent by the client; and returns the value of the record corresponding to the identifier / the value of the field of interest in the corresponding record in the database to the client.

[0019] A server for retrieving privacy information, wherein the server and client perform encryption / decryption on the same target using an encryption / decryption algorithm with interchangeable order, and:

[0020] The server is configured with a database, and after encrypting the database, a query base is obtained and sent to the client.

[0021] During a search process:

[0022] The server receives sensitive fields sent by the client, which it has encrypted, and then encrypts them again before returning them to the client; it also receives a search identifier sent by the client; and returns the value of the record corresponding to the identifier / the value of the field of interest in the corresponding record in the database to the client.

[0023] A client for retrieving privacy information, wherein the client and server perform encryption / decryption on the same target using an encryption / decryption algorithm with interchangeable order, and:

[0024] The client is configured with a query base, which is obtained by the server after encrypting the database.

[0025] During a search process:

[0026] The client sends a sensitive field encrypted by itself to the server, and obtains the same sensitive field encrypted by the server through interaction with the server; it retrieves the identifier of the matching record in the query base based on the sensitive field encrypted by the server, and returns the identifier to the server.

[0027] In the above embodiments, by pre-configuring the query base on the client, the client can locate the identifier of the field to be queried in the query base through interaction with the server and the query base without exposing the plaintext of the database. Then, the client can initiate a query to the server based on the identifier, which ensures the privacy protection of the database by the server and supports structured query statements. Attached Figure Description

[0028] To more clearly illustrate the technical solutions of the embodiments in this specification, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0029] Figure 1 This is a flowchart of one embodiment. Detailed Implementation

[0030] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0031] As mentioned earlier, PIR is a method for clients to retrieve information from a database. The PIR scheme was proposed by Chor B et al. in 1995 to address the protection of user query privacy. The main purpose of the PIR scheme is to ensure that queries submitted by users to the database on the server are completed without the leakage of the user's private information; that is, the server is unaware of the specific query information or the retrieved data items during the retrieval process.

[0032] Application scenarios for privacy information retrieval include:

[0033] i. If a patient wants to search for medications to treat their disease through the medical system, and the search is based on the disease name, the medical system will know that the patient may have such a disease, thus compromising the patient's privacy. Searching for private information can avoid this type of leakage.

[0034] ii. During the domain name and trademark application process, users need to submit their domain name or trademark information to the relevant database to check if it already exists, but they do not want the service provider to know their application name so that they can register it first.

[0035] iii. In the securities market, a user wants to query information about a certain stock, but cannot disclose the stock they are interested in to the service provider, thereby affecting the stock price and their own preferences.

[0036] A simple implementation involves the database sending all data to the client, but this fails to protect database security, meaning it cannot guarantee server-side privacy. A PIR that simultaneously guarantees privacy for both the client and the database is called a Symmetrical PIR (SPIR), while one that guarantees privacy for either the client or the database is called an Asymmetrical PIR (APIR). Based on the number of database replicas, PIRs are categorized into multi-replica PIRs and single-replica PIRs. Multi-replica PIR protocols require that multiple database replicas cannot collude, which is difficult to satisfy in real-world scenarios; therefore, single-replica PIRs are more commonly considered. Single-replica PIRs only achieve computational security (CPIR). Most PIR schemes assume the client knows which bit in the database they are retrieving (a single bit). However, in real-world scenarios, clients often search by keyword (without knowing the specific location of the keyword in the database) and expect to retrieve a string (multiple bits). In summary, a practical PIR typically needs to simultaneously satisfy multiple conditions, including symmetry, single copy, key-based retrieval, and string return, while achieving a balance between computational and communication efficiency. These conditions can be met or partially met through cryptographic techniques such as homomorphic encryption, oblivious transfer (OT), and one-way trapdoor functions.

[0037] This specification provides an embodiment of a method for retrieving privacy information.

[0038] In this embodiment, the server can encrypt the database in advance to obtain the query base and send the query base to the client.

[0039] Typically, the server has a local database that clients can query. A typical example of a local server database would be as follows:

[0040] id_0 A 263158 24 anhui id_1 B 223700 25 shanghai id_2 C 193267 30 anhui id_3 D 183456 46 henan id_4 E 193345 34 shandong id_5 F 271156 54 shanghai id_6 G 223455 24 beijing id_7 H 274500 25 zhejiang id_8 I 805591 42 guangdong id_9 J 708947 56 zhejiang

[0041] Table 1. Databases available on the server

[0042] In the example in Table 1 above, there are five fields: ID, Name, Job_number, Age, and Native_place. For example, there are 10 records, from id_0 to id_9, with each row representing one record. Here, id_0, ..., id_9 serve as the identifier for each record in each row.

[0043] To enable client-side retrieval without exposing server-side privacy, the server can encrypt the database to obtain the query base. Encryption methods can include RSA (a widely used asymmetric encryption algorithm proposed in 1977 by Ron Rivest, Adi Shamir, and Leonard Adleman) or ECC (Elliptical Curve Cryptography). Specifically, the server can encrypt the data using an RSA private key / ECC private key α, meaning that every field except the ID column (i.e., the data in each cell) is encrypted using the RSA private key / ECC private key α.

[0044] When using the ECC encryption / decryption algorithm, the server can generate and securely store a secret value α, which is the ECC private key. Furthermore, the server can convert the value of the name field into a point on an elliptic curve using a hash function, which can be expressed as Hash(C) or H(C).

[0045] According to the operational properties of scalar multiplication on elliptic curves, given a point P on an elliptic curve and an integer k, it is easy to calculate Q = kP, and the result Q is also a point on the elliptic curve. Conversely, if a pair of points P and Q on the elliptic curve is known, it is difficult to find the value of k in Q = kP that makes the equation true.

[0046] Here, α·H(C) is easily calculated using scalar multiplication on elliptic curves, but knowing the result of α·H(C) and H(C) makes it difficult to deduce the value of α. Given the difficulty in obtaining the value of α, knowing the result of α·H(C) also makes it difficult to know the value of H(C).

[0047] Therefore, the database encrypted by the server using the secret value α is shown below:

[0048] id_0 α·H(A) α·H(263158) α·H(24) α·H(anhui) id_1 α·H(B) α·H(223700) α·H(25) α·H(shanghai) id_2 α·H(C) α·H(193267) α·H(30) α·H(anhui) id_3 α·H(D) α·H(183456) α·H(46) α·H(henan) id_4 α·H(E) α·H(193345) α·H(34) α·H(shandong) id_5 α·H(F) α·H(271156) α·H(54) α·H(shanghai) id_6 α·H(G) α·H(223455) α·H(24) α·H(beijing) id_7 α·H(H) α·H(274500) α·H(25) α·H(zhejiang) id_8 α·H(I) α·H(805591) α·H(42) α·H(guangdong) id_9 α·H(J) α·H(708947) α·H(56) α·H(zhejiang)

[0049] Table 2. Query base encrypted with ECC private key on the server side

[0050] It's important to note that the hash function described above not only converts the original input into a fixed-length, formatted output, but also converts the output into the x-axis coordinate of a point on an elliptic curve. For example, using an elliptic curve like curve25519, any 256-bit data can be used as a valid x-axis coordinate on this elliptic curve. Correspondingly, SHA256 or SHA3-256 can be used, or 256 bits can be truncated from the results of SHA384, SHA512, or SHA3-384, SHA3-512. More broadly, any hash value (not limited to a 256-bit hash result) can be modulo the order of the elliptic curve, and the product of the modulo result and the generator (scalar multiplication) represents a point on that elliptic curve.

[0051] Then, the server can send the query base to the client that needs to perform the retrieval. In one approach, the server can send the query base directly to the client, such as directly to the client's device or to the client's proxy server; in another approach, the server can publish the query base on a Uniform Resource Locator (URL), and the client can then obtain the query base from that URL.

[0052] Correspondingly, the client can receive the query base and store the received query base locally.

[0053] Similarly, when using RSA, the server can generate and securely store a secret value α, which is the RSA private key. Furthermore, the server can convert the value of the name field into a point on an elliptic curve using a hash function, which can be expressed as Hash(C) or H(C).

[0054] Based on the properties of modular exponentiation, given the secret value α, calculate p = g for a large prime number q and a base g. α Mod q is easy; conversely, if p, q, and the base g are known, solving p = g is straightforward. α Finding a value for α that makes the equation true in mod q is difficult. The base g is also called the primitive root.

[0055] Here, (H(C)) is calculated based on simulation operations. α Mod q is easy, but knowing (H(C)) is crucial. α The result modulo q, along with H(C) and q, makes it difficult to deduce the value of α. Given the difficulty in obtaining the value of α, knowing (H(C)) is insufficient. α The result of modulo q also makes it difficult to know the value of H(C). Subsequently, we will use the form (H(C)). αThe expression with mod q omitting mod q is abbreviated as (H(C)). α .

[0056] Therefore, the database encrypted by the server using the secret value α is shown below:

[0057] id_0 <![CDATA[(H(A)) α ]]> <![CDATA[(H(263158)) α ]]> <![CDATA[(H(24)) α ]]> <![CDATA[(H(anhui)) α ]]> id_1 <![CDATA[(H(B)) α ]]> <![CDATA[(H(223700)) α ]]> <![CDATA[(H(25)) α ]]> <![CDATA[(H(shanghai)) α ]]> id_2 <![CDATA[(H(C)) α ]]> <![CDATA[(H(193267)) α ]]> <![CDATA[(H(30)) α ]]> <![CDATA[(H(anhui)) α ]]> id_3 <![CDATA[(H(D)) α ]]> <![CDATA[(H(183456)) α ]]> <![CDATA[(H(46)) α ]]> <![CDATA[(H(henan)) α <!-- 5 -->]]> id_4 <![CDATA[(H(H)) α ]]> <![CDATA[(H(193345)) α ]]> <![CDATA[(H(34)) α ]]> <![CDATA[(H(shandong)) α ]]> id_5 <![CDATA[(H(F)) α ]]> <![CDATA[(H(271156)) α ]]> <![CDATA[(H(54)) α ]]> <![CDATA[(H(shanghai)) α ]]> id_6 <![CDATA[(H(G)) α ]]> <![CDATA[(H(223455)) α ]]> <![CDATA[(H(24)) α ]]> <![CDATA[(H(beijing)) α ]]> id_7 <![CDATA[(H(H)) α ]]> <![CDATA[(H(274500)) α ]]> <![CDATA[(H(25)) α ]]> <![CDATA[(H(zhejiang)) α ]]> id_8 <![CDATA[(H(I)) α ]]> <![CDATA[(H(805591)) α ]]> <![CDATA[(H(42)) α ]]> <![CDATA[(H(guangdong)) α ]]> id_9 <![CDATA[(H(J)) α ]]> <![CDATA[(H(708947)) α ]]> <![CDATA[(H(56)) α ]]> <![CDATA[(H(zhejiang)) α ]]>

[0058] Table 2. Query base encrypted with RSA private key on the server side

[0059] Then, the server can send the query base to the client that needs to perform the retrieval. Similarly, the server can send the query base directly to the client, for example, directly to the client's device, or to the client's proxy server; in another approach, the server can publish the query base on a Uniform Resource Locator (URL), and the client can then obtain the query base from that URL.

[0060] Correspondingly, the client can receive the query base and store the received query base locally.

[0061] S110: The client sends a sensitive field that it has encrypted to the server, and obtains the same sensitive field encrypted by the server through interaction with the server.

[0062] For example, a client's search condition might be that the Age field value is 24, and 24 is a sensitive field that the client doesn't want the other end to know. To prevent the server from knowing that the client's search condition is the Age field value 24, the client can encrypt this 24. For example, it can use RSA / ECC private key encryption, and the encryption algorithm used by the client is the same as the encryption algorithm used by the server to generate the query base.

[0063] Specifically, when using RSA private key encryption, the client generates and securely stores its own secret β. Then, the client can encrypt 24 using its own private key β. Specifically, this can be done by encrypting 24 or its hash value. Here, we will use hash encryption of 24 as an example. The case of direct encryption of 24 is similar; the client and server use the same hash algorithm. For example, the client uses the same large prime number q as the modulus as the server. The client can use β to perform RSA encryption on the hash value of 24, obtaining (H(24)). β Therefore, the sensitive field sent by the client to the server can be (H(24)). β Among them, (H(24)) β This represents the ciphertext of the sensitive field's value 24.

[0064] On the other hand, the client can also construct a search statement, encrypt the sensitive fields in the search statement to obtain the privacy fields, replace the sensitive fields with the privacy fields, and send the replaced privacy search statement to the server.

[0065] For example, the client constructs the query statement as select Name where Age=24.

[0066] To protect privacy, specifically to prevent the server from accessing the query condition Age=24, for example, by protecting the 24, the result would be as follows:

[0067] select Name where Age=?

[0068] Where, ? represents the search statement after replacement.

[0069] Specifically, the client can encrypt 24 using an RSA private key. For example, the client can perform a hash calculation on 24 using the same hash function as the server, and then use β to encrypt the hash value of 24 using RSA, resulting in (H(24)). β The query statement sent by the client to the server would be, for example, as follows:

[0070] select Name where Age=(H(24)) β

[0071] As mentioned earlier, (H(24)) β This is encrypted text, which is the content represented by "?" in the above search statement. The server cannot know β and 24 after obtaining it.

[0072] When using ECC private key encryption, the client uses the same elliptic curve as the server, meaning it has the same elliptic curve parameters and generators. The client generates its own secret β and stores it securely. Then, the client can encrypt 24 using its own private key β. Specifically, it can encrypt the hash value of 24, using the same hash algorithm as the server. For example, the client can use β to perform ECC encryption on the hash value of 24, obtaining β·H(24). The sensitive field sent by the client to the server can then be β·H(24), where β·H(24) represents the ciphertext of the sensitive field value 24.

[0073] On the other hand, the client can also construct a search statement, encrypt the sensitive fields in the search statement to obtain the privacy fields, replace the sensitive fields with the privacy fields, and send the replaced privacy search statement to the server.

[0074] For example, the client constructs the query statement as select Name where Age=24.

[0075] To protect privacy, specifically to prevent the server from accessing the query condition Age=24, for example, by protecting the 24, the result would be as follows:

[0076] select Name where Age=?

[0077] Where, ? represents the search statement after replacement.

[0078] Specifically, the client can encrypt 24 using its ECC private key. For example, the client uses the same elliptic curve as the server, meaning it has the same elliptic curve parameters and generators. The client can replace sensitive fields in the search query with its own ECC private key and send the replaced privacy search query to the server. For example, the client generates its own secret β and stores it securely. In addition, the client can perform a hash calculation on 24 using the same hash function as the server, and then use β to perform ECC encryption on the hash value of 24, obtaining β·H(24). The query query sent by the client to the server would be as follows:

[0079] select Name where Age=β·H(24)

[0080] As mentioned earlier, β·H(24) is ciphertext, which is the content represented by "?" in the above search statement. The server cannot know β and 24 after obtaining it.

[0081] The client obtains the same sensitive field encrypted by the server through interaction with the server. This can include the server re-encrypting the sensitive field encrypted by the client using its own key and sending it to the client, and the client decrypting the double-encrypted sensitive field using its own key to obtain the sensitive field encrypted by the server. The core of this content is to find an encryption algorithm that allows for decryption by changing the order of two consecutive encryption operations (encryption by both parties sequentially). According to the cryptographic properties of ECC, both parties agree to use the same elliptic curve, that is, have the same elliptic curve parameters and generators, and each holds keys α and β. The encryption operation is a scalar multiplication operation using α (or β). Regardless of whether α is used first and then β, or vice versa, the encryption result can be decrypted in the same or different orders. Similarly, based on the cryptographic properties of RSA, both parties agree to use the same large prime number q and primitive root g, each holding a private key α and β. The encryption operation involves exponentiation of α (or β) and modulo of q. Regardless of whether α is used first and then β, or vice versa, the encryption result can be decrypted in the same or different orders. In short, the client and server use interchangeable encryption / decryption algorithms for the same target.

[0082] Specifically, the server can receive a privacy search query, encrypt the privacy fields again, and then return them to the client. Alternatively, the server can receive sensitive fields encrypted by the client, encrypt them again using its own key, and then return them to the client. The client then uses its own key to decrypt the double-encrypted sensitive fields to obtain the server-encrypted sensitive fields.

[0083] For example, case 1: The server can receive (H(24)) sent by the client. β .

[0084] The server can re-encrypt the encrypted sensitive fields (i.e., privacy fields) and return the re-encrypted sensitive fields to the client. Specifically, the server can re-encrypt the privacy fields (H(24)). β Encrypt again using your own RSA private key α to obtain ((H(24)) β ) α .

[0085] For example, case 1': The server can receive the privacy search statement sent by the client: select Name whereAge=(H(24)) β In this way, the server can obtain the privacy field (H(24)) from the privacy retrieval statement. β .

[0086] The server can re-encrypt the privacy field and return the re-encrypted privacy field to the client.

[0087] Specifically, the server can handle privacy fields (H(24)). β Encrypt again using your own RSA private key α to obtain ((H(24)) β ) α The specific process is similar to that described above, and will not be repeated here.

[0088] For example, case 2: The server can receive β·H(24) sent by the client.

[0089] The server can encrypt the privacy field again and return the re-encrypted privacy field to the client. Specifically, the server can encrypt the privacy field β·H(24) again using its own ECC private key α to obtain α·β·H(24).

[0090] For example, in case 2': the server can receive the privacy search statement "select Name whereAge=β·H(24)" sent by the client. In this way, the server can obtain the privacy field β·H(24) in the privacy search statement.

[0091] The server can re-encrypt the privacy field and return the re-encrypted privacy field to the client.

[0092] Specifically, the server can re-encrypt the privacy field β·H(24) using its own ECC private key α to obtain α·β·H(24). The specific process is similar to the above, and will not be repeated here.

[0093] The server re-encrypts the sensitive field (i.e., the privacy field) that was encrypted by the client using its own key and sends it to the client. The client can then decrypt the double-encrypted privacy field using its own key to obtain the sensitive field encrypted by the server.

[0094] For example, corresponding to cases 1 and 1' above, the client receives ((H(24)) sent by the server. H ) α The power operation has the following property: ((G(24)) β ) α =(H(24)) βα =(H(24)) αβ =((H(24)) α ) β Furthermore, the client can use the inverse of its own key β. Decrypting the sensitive fields after double encryption is as follows:

[0095] In this way, the client obtains the same sensitive field encrypted by the server, namely (H(24)). α .

[0096] Corresponding to cases 2 and 2' above, the client receives α·β·H(24) sent by the server, where the scalar multiplication operation has the following property: α·β·H(24)=β·α·H(24). Furthermore, the client can use the inverse of its own key β, βinverted. -1 Decrypting the sensitive field after double encryption is as follows: β -1 ·α·β·H(24)=β -1 ·β·α·H(24)=α·H(24). In this way, the client also obtains the same sensitive field encrypted by the server, namely α·H(24).

[0097] It should be noted that in RSA, according to Euler's theorem, pk·sk = 1 mod (p-1)·(q-1), where p and q are two large prime numbers, so pk and sk are inverses of each other. Similarly, in ECC, pk = sk*G, where G is a generator on the ECC selected curve, so pk and sk are also inverses of each other.

[0098] S120: The client retrieves the identifier of the matching record from the query base based on the sensitive field encrypted by the server, and returns the identifier to the server.

[0099] After S110 is executed, the client can obtain the same sensitive field encrypted by the server.

[0100] The client can query the query base based on this sensitive field encrypted by the server. For example, after decryption, the client obtains the private field α·H(24) or (H(24)) encrypted by the server. α Therefore, the client can query the query base based on this privacy field, for example, querying Table 1 or Table 2 respectively, and obtain two records in Age containing this privacy field with ID=d_0 and ID=id_6, where ID is the identifier of these two records. Thus, when the client queries the query base based on this privacy field encrypted by the server, and a matching record is found, the identifier of the matching record can be located.

[0101] The client returns the identifier of the matched record to the server, which can include two scenarios.

[0102] One scenario is in S110, where the client constructs a search statement, encrypts sensitive fields within the search statement to obtain private fields, replaces the sensitive fields with the private fields, and sends the replaced private search statement to the server. In this case, the client can directly return the identifier of the matching record to the server.

[0103] Another scenario is in S110, where the client sends the value of a sensitive field, encrypted by itself, to the server. In this case, in S120, the client can construct a search statement, for example, the search statement is:

[0104] select Name where ID=id_0 or ID=id_6

[0105] Thus, in S120, the client can send the constructed search query to the server. This search query contains the identifier of the matching record and indicates that the field of interest is Name, which is the field name immediately following select.

[0106] In other words, in steps S110 and S120, you can choose to send a search query that includes the field of interest in one of the steps.

[0107] S130: The server returns the value of the field of interest in the record corresponding to the identifier in the database to the client.

[0108] Following the example above, after receiving the identifier from the client, the server can search for the record corresponding to the identifier in the database, retrieve the corresponding value from the found record according to the field of interest in S110 or S120, and return the retrieved value of the field of interest to the client. For example, it returns Name=A from the record corresponding to id_0 and Name=G from the record corresponding to id_6, that is, it returns A and G to the client.

[0109] In the above embodiments, by pre-configuring the query base on the client, the client can locate the identifier of the field to be queried in the query base through interaction with the server and the query base without exposing the plaintext of the database. Then, based on the identifier, the client initiates a query to the server to obtain the value of the field of interest in the record corresponding to the identifier. Compared to traditional multi-replica PIR, this obviously eliminates the assumption that multiple replica databases cannot collude, making it more practical. Compared to the traditional single-replica PIR, which only allows bit-level retrieval, this embodiment does not require attention to the specific location (bit position) of the keyword to be retrieved in the database, enabling string queries and supporting Structured Query Language (SQL). In this embodiment, the database remains on the server, while the encrypted query base is configured on the client. This allows the client to locate data based on the query base to obtain the record identifier during retrieval. Furthermore, the encryption of the query base ensures that the client does not obtain the database content, guaranteeing the server's privacy protection of the database. Overall, the database and query base configurations in this embodiment can be referred to as "asymmetric dual replicas" when the database is configured on one server and the query base is configured on one client, and as "asymmetric multiple replicas" when the query base is configured on multiple clients.

[0110] In the above embodiments, the client can initiate a query for fields of interest using SQL query statements, such as the Name field to be queried in the `select Name...` statement. This exposes the client's fields of interest to some extent. Alternatively, the client can query records that meet certain conditions, i.e., the entire row of data that meets the conditions. This protects the client's privacy, but requires the server to return the entire record, which exposes the server's entire row of data to some extent. For example, in S110 / S120, a retrieval statement like "select *where Age=?" or "select *where ID=id_0 or ID=id_6" can be used. In this case, the server can return records for rows id_0 and id_6, as shown below:

[0111] id_0 A 263158 24 anhui

[0112] id_6 G 223455 24 beijing

[0113] In addition, to ensure the security of the transmission process, the server can encrypt and return the value of the record corresponding to the identifier / the field of interest in the corresponding record in the database to the client. For example, the server can use a symmetric key negotiated with the client to encrypt the value of the record corresponding to the identifier / the field of interest in the corresponding record in the database before returning it to the client, or it can use the public key from the client's asymmetric key to encrypt the value of the record corresponding to the identifier / the field of interest in the corresponding record in the database before returning it to the client. Thus, the client can decrypt it using its own private key, or a digital envelope method can be used, etc.

[0114] The following describes a system embodiment for implementing privacy information retrieval, comprising a server and a client. The client and server perform encryption / decryption on the same target using an encryption / decryption algorithm with interchangeable order, and:

[0115] The server is configured with a database, and after encrypting the database, a query base is obtained and sent to the client.

[0116] During a search process:

[0117] The client sends a sensitive field encrypted by itself to the server, and obtains the same sensitive field encrypted by the server through interaction with the server; it retrieves the identifier of the matching record in the query base based on the sensitive field encrypted by the server, and returns the identifier to the server;

[0118] The server receives sensitive fields sent by the client, which it has encrypted, and then encrypts them again before returning them to the client; it also receives a search identifier sent by the client; and returns the value of the record corresponding to the identifier / the value of the field of interest in the corresponding record in the database to the client.

[0119] The following describes a server-side embodiment for implementing privacy information retrieval, wherein the server and client perform encryption / decryption on the same target using an encryption / decryption algorithm with interchangeable order, and:

[0120] The server is configured with a database, and after encrypting the database, a query base is obtained and sent to the client.

[0121] During a search process:

[0122] The server receives sensitive fields sent by the client, which it has encrypted, and then encrypts them again before returning them to the client; it also receives a search identifier sent by the client; and returns the value of the record corresponding to the identifier / the value of the field of interest in the corresponding record in the database to the client.

[0123] The following describes a client embodiment for implementing privacy information retrieval, wherein the client and server perform encryption / decryption on the same target using an encryption / decryption algorithm with interchangeable order, and:

[0124] The client is configured with a query base, which is obtained by the server after encrypting the database.

[0125] During a search process:

[0126] The client sends a sensitive field encrypted by itself to the server, and obtains the same sensitive field encrypted by the server through interaction with the server; it retrieves the identifier of the matching record in the query base based on the sensitive field encrypted by the server, and returns the identifier to the server.

[0127] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0128] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0129] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or physical entities, or by products with certain functions. A typical implementation device is a server system. Of course, this specification does not exclude the possibility that, with the future development of computer technology, the computer implementing the functions of the above embodiments may be, for example, a personal computer, a laptop computer, an in-vehicle human-machine interaction device, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or any combination of these devices.

[0130] While one or more embodiments of this specification provide the operational steps of the methods described in the embodiments or flowcharts, more or fewer operational steps may be included based on conventional or non-inventive means. The order of steps listed in the embodiments is merely one possible order of execution among many steps and does not represent the only possible order. In actual device or end product execution, the methods shown in the embodiments or drawings may be executed sequentially or in parallel (e.g., in a parallel processor or multi-threaded processing environment, or even a distributed data processing environment). The terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, product, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, product, or apparatus. Without further limitations, the presence of other identical or equivalent elements in the process, method, product, or apparatus that includes the elements is not excluded. For example, the use of terms such as "first," "second," etc., is to denote names and does not indicate any particular order.

[0131] For ease of description, the above devices are described in terms of function, divided into various modules. Of course, when implementing one or more of these specifications, the functions of each module can be implemented in one or more software and / or hardware components, or a module that performs the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between devices or units, and may be electrical, mechanical, or other forms.

[0132] This specification is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0133] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0134] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0135] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0136] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0137] Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can store information using any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage, graphene storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0138] Those skilled in the art will understand that one or more embodiments of this specification can be provided as a method, system, or computer program product. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0139] One or more embodiments of this specification can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a particular task or implement a particular abstract data type. One or more embodiments of this specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In a distributed computing environment, program modules can reside in local and remote computer storage media, including storage devices.

[0140] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, system embodiments are basically similar to method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments. In the description of this specification, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this specification. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described can be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0141] The above description is merely an embodiment of one or more embodiments of this specification and is not intended to limit the scope of this specification. Various modifications and variations can be made to the one or more embodiments of this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims.

Claims

1. A method for retrieving privacy information, wherein the server encrypts the database to obtain a query base and sends the query base to the client; the client and server perform encryption / decryption on the same target using an encryption / decryption algorithm with interchangeable order; A single search process includes: The client sends a sensitive field that it has encrypted to the server, and obtains the same sensitive field encrypted by the server through interaction with the server; The client retrieves the identifier of the matching record from the query base based on the sensitive field encrypted by the server, and returns the identifier to the server. The server returns the record corresponding to the identifier in the database, or the value of the field of interest in the corresponding record, to the client. The client obtains the same sensitive field encrypted by the server through interaction with the server, including: The server uses its own key to re-encrypt the sensitive field encrypted by the client and sends it to the client. The client uses its own key to decrypt the sensitive field after the two encryptions to obtain the sensitive field encrypted by the server.

2. The method as described in claim 1, wherein the client sends the sensitive field encrypted by itself to the server, comprising: The client sends the values ​​of sensitive fields, which it has encrypted, to the server.

3. The method as described in claim 1, wherein the client sends the sensitive field encrypted by itself to the server, comprising: The client constructs a search statement, encrypts the sensitive fields in the search statement to obtain the privacy fields, replaces the sensitive fields with the privacy fields, and sends the replaced privacy search statement to the server.

4. The method as described in claim 2, wherein the client returns the identifier to the server, comprising: The client constructs a search statement and sends the constructed search statement to the server. The search statement contains the identifier of the matching record.

5. The method as described in claim 3 or 4, wherein the search statement may or may not include the field of interest.

6. The method according to any one of claims 1-4, wherein the server returns the value of the record corresponding to the identifier or the value of the field of interest in the corresponding record to the client, comprising: The server encrypts and returns the value of the record corresponding to the identifier or the value of the field of interest in the corresponding record to the client.

7. A system for retrieving privacy information, comprising a server and a client, wherein the client and server perform encryption / decryption on the same target using an encryption / decryption algorithm with interchangeable order, and: The server is configured with a database, and after encrypting the database, a query base is obtained and sent to the client. During a search process: The client sends a sensitive field encrypted by itself to the server, and obtains the same sensitive field encrypted by the server through interaction with the server; it retrieves the identifier of the matching record in the query base based on the sensitive field encrypted by the server, and returns the identifier to the server; The server receives sensitive fields sent by the client, which it has encrypted, and then encrypts them again before returning them to the client; it also receives a search identifier sent by the client; and returns the record corresponding to the identifier or the value of the field of interest in the corresponding record from the database to the client. in, The client obtains the same sensitive field encrypted by the server through interaction with the server, including: The server uses its own key to re-encrypt the sensitive field encrypted by the client and sends it to the client. The client uses its own key to decrypt the sensitive field after the two encryptions to obtain the sensitive field encrypted by the server.

8. A server for retrieving privacy information, wherein the server and client perform encryption / decryption on the same target using an encryption / decryption algorithm with interchangeable order, and: The server is configured with a database, and after encrypting the database, a query base is obtained and sent to the client. During a search process: The server receives a sensitive field encrypted by itself sent by the client, and then re-encrypts the sensitive field encrypted by the client using its own key before returning it to the client. The client then uses its own key to decrypt the sensitive field encrypted twice to obtain the sensitive field encrypted by the server. The server also receives a search identifier sent by the client and returns the record corresponding to the identifier or the value of the field of interest in the corresponding record to the client.

9. A client for retrieving privacy information, wherein the client and server perform encryption / decryption on the same target using an encryption / decryption algorithm with interchangeable order, and: The client is configured with a query base, which is obtained by the server after encrypting the database. During a search process: The client sends a sensitive field encrypted by itself to the server, and obtains the same sensitive field encrypted by the server through interaction with the server; it retrieves the identifier of the matching record in the query base based on the sensitive field encrypted by the server, and returns the identifier to the server; in, The client obtains the same sensitive field encrypted by the server through interaction with the server, including: The server uses its own key to re-encrypt the sensitive field encrypted by the client and sends it to the client. The client uses its own key to decrypt the sensitive field after the two encryptions to obtain the sensitive field encrypted by the server.

Images