A privacy-preserving computation method based on inadvertent random access

Abstract

This invention provides a privacy-preserving computation method based on unintentional random access, which consists of three steps: model initialization, data access, and shuffling and write-back. In the model initialization step, the accessing party, ORAM rules, and storage party are initialized. In the data access step, the accessing party sends read and write requests to the storage party according to the ORAM rules. In the shuffling and write-back step, the storage party periodically performs out-of-order write-back operations on the data according to the ORAM protocol to ensure that the mapping between logical addresses and physical addresses cannot be detected by the storage party and used to infer the content of data blocks. This method can perform privacy-preserving computation for multiple users with high efficiency and high concurrency.

Description

Technical Field

[0001] This invention relates to the field of data security technology, and in particular to a privacy-preserving computation method based on unintentional random access. Background Technology

[0002] With the proliferation of applications on smart devices and the development of cloud computing and big data technologies, servers are accumulating ever-increasing amounts of user data, leading to growing concerns about data privacy. Recent server attacks demonstrate that servers are not entirely trustworthy. Even if server security is guaranteed, servers may still secretly collect user data to obtain valuable information for their own commercial interests. For individuals, privacy breaches can cause significant disruption to their lives. For businesses, data privacy breaches can result in substantial losses, such as business losses, negative reputational damage, and the financial and time costs of data recovery. Therefore, ensuring data privacy is a critical security issue for both individuals and businesses.

[0003] When data storage servers are untrusted, existing research shows that even with encrypted data, when users perform searchable queries on encrypted data, statistical analysis of access patterns generated by user query strings allows servers to correctly identify 80% of query strings, leading to sensitive data leakage. Access patterns refer to the server-side access behavior generated when a user requests access to data blocks stored on a remote server, including: the target data block, the access frequency of each data block, the correlation between data blocks, the access method (random or sequential), and the access request type (read or write).

[0004] Privacy-preserving computation is a method for analyzing and processing sensitive data while protecting user privacy. Its basic idea is to perform computations on data while ensuring data security, producing the same results as computations on unrestricted data. This avoids exposing data to potential attackers while allowing meaningful computation. In privacy-preserving computation, data is typically processed in encrypted form to prevent any unauthorized access. Furthermore, the computation process often employs techniques such as secure multi-party computation to ensure that the results can only be accessed by trusted participants, thus guaranteeing both data privacy and the security of the computation results.

[0005] Unintentional Random Access (ORAM) is a privacy-preserving computing technique designed to hide memory access patterns and protect user data privacy and security. The basic idea of ​​ORAM is to protect user data privacy and security by randomly distributing data in memory, thus hiding memory access patterns while ensuring the correctness of data access and queries. ORAM typically employs special techniques to achieve randomized storage and access of data, such as batch processing, obfuscation, and random proxies. These techniques can guarantee the correctness of data access and queries without revealing any information about the data and prevent any potential attackers from obtaining sensitive information about user data by analyzing memory access patterns. However, traditional ORAM models are designed for low-concurrency scenarios with single users, and suffer from serious efficiency problems in high-concurrency scenarios. Past work has focused on extensive optimizations of the basic model, making the model and system increasingly complex.

[0006] To address the aforementioned problems, this invention proposes a privacy-preserving computation method based on unintentional random access. This method abandons previous models and explores new ones, drawing on the concept of a tree-like path model to propose an algorithm that allows multiple groups of accesses to proceed in parallel, and constructs a new model based on this algorithm. Compared to existing methods, this method enables multiple users to access resources efficiently in parallel, solving the problems of parallel querying and parallel write-back. It boasts excellent concurrency, short response time, and high throughput, making it suitable for privacy-preserving computation in multi-user cloud storage scenarios. Summary of the Invention

[0007] Purpose of the invention: In order to overcome the shortcomings of the existing technology, the present invention provides a privacy-preserving computation method based on unintentional random access, which is used to solve the problems of poor parallel performance and performance bottleneck in the existing ORAM model.

[0008] Technical solution: To achieve the above objectives, the technical solution adopted by this invention is as follows:

[0009] A privacy-preserving computation method based on unintentional random access includes three steps: model initialization, data access, and shuffling and write-back. In the model initialization step, the accessing party, ORAM rules, and storage are initialized. In the data access step, the accessing party sends read and write requests to the storage via ORAM rules. In the shuffling and write-back step, the storage periodically performs out-of-order write-back operations according to the ORAM protocol to ensure that the mapping between logical and physical addresses cannot be detected by the storage and used to infer the data block content. The specific steps are as follows:

[0010] Step 1: Model initialization;

[0011] Initially, each client (accessor) must have its own unique identifier, which must be agreed upon with the server (storage provider). All accessors must agree on a unified address space with the storage provider to prevent out-of-bounds access. Simultaneously, each accessor must be capable of encrypting and decrypting the data it receives; this assumes that all accessors are trustworthy and share the same key.

[0012] In the ORAM rules section, a random number generating tree (RandomTree) is generated for the address space N. It is a data structure responsible for generating c sets of consecutive disjoint random numbers. Initially, the numbers in the generating tree are randomly arranged.

[0013] c = (2 h′-1 )

[0014] Where c is the number of subtrees in the random number generation tree, also known as the parallelism. h′ is the height of the virtual nodes in the random number generation tree.

[0015] Suppose we need to generate four consecutive sets of disjoint random numbers. First, we construct a binary tree of height h, setting the nodes of its first two levels as dummy nodes. This forms a binary tree with a total height of h. h - Four subtrees with four nodes. Assign a unique number to each node in each of the four subtrees, thus accommodating numbers from (0, 1, 2, ..., 2^4). h The number space is -5). Next, a path is randomly selected from each subtree. The numbers contained in each path form a random number set of length h-2. Since the four paths do not intersect, the four random number sets also have no intersection. If the number of users is too large, the parallelism can be increased by adjusting the number of virtual node layers and increasing the number of subtrees.

[0016] Stash is a cache-like structure where every batch of accesses to the storage in a round is recorded. Before the next round begins, it is shuffled and written back to the storage. Initially, it is empty. ORAM rules also maintain a PosMap, which is responsible for maintaining the relationship between logical addresses and physical addresses. A logical address is the unique identifier for a piece of data by the accessor, and a physical address is the unique identifier for a piece of data by the storage provider. Since the process of ORAM operation involves masking the correlation between these two addresses, the ORAM rules require a PosMap to record the mapping relationship between them. This relationship should be correctly recorded in the initial state.

[0017] The storage device does not require any special initialization operations in its initial state.

[0018] Step 2: Access the data;

[0019] The accessing party sends read and write requests to the storage party through the ORAM rules. Although the accessing party has both read and write requests, "whether the current operation is a read or a write" is one of the things that ORAM needs to cover. Therefore, in the ORAM model, whether it is a read or a write, the complete process of the write request will be run on the storage party.

[0020] Step 2.1 The accessing party initiates the access.

[0021] Access to data x1 and x2 is initiated sequentially by users A and B, respectively. i Let S be the logical address of the target data for the i-th access. After receiving the ORAM rule, it will first generate the actual access sets S1 and S2 using a random number generator tree and the corresponding rules. i This is a set of random numbers generated for the i-th access. Then, PosMap is used to convert the logical addresses in both sets into physical addresses before sending them to the storage provider.

[0022] Step 2.2 The storage provider returns data.

[0023] After receiving the two physical address sets, the storage party reads the data and transmits it back to the Stash in the ORAM rule. The Stash then returns the data to the access party, where the actual access set S′ is... r There are four possible scenarios.

[0024] Before describing the different scenarios and their solutions, let's define the data involved in this process. Assume the parallelism of the random number generation tree is c, and the user initiates the r-th access within this round. Every c accesses is called a round of access, and after each round, a shuffling and update is required. The data the user wants to access is called the target access data, denoted as x. r The set obtained by generating a random number tree is called the random number set, denoted as S. r Assuming all previous accesses have been successfully executed, and the target access data for each access is x... i The set of random numbers for each iteration is S. i The target access data and the random number set will be used to obtain the actual data set to be accessed from the server, which is called the actual access set, denoted as S′. r The following situations may occur:

[0025] (1) The first case is And in every past visit This means that the data to be accessed this time has not appeared in the previous actual access set, and the data to be accessed previously has no intersection with the current random number set. In this case, S is directly set to... r Replace any data in with x r This will give us the actual set of visits, S′.r (if x r ∈S r Then no replacement operation is needed.

[0026] (2) The second case is x r ∈{S′1,S′2,…,S′ r-1},but This indicates that the target data for this access has appeared in the previous actual access set, but the data to be accessed previously and the data to be accessed this time, as well as the generated random number set, have no intersection. In this case, we can directly choose not to put the target data into the actual access set, and instead directly let S′ r =S r This ensures that the actual access set in this round will not overlap with previous sets. Target data not accessed in this round will be retrieved from other data structures. It's important to note that the target access data in this round is the same as the target access data in previous rounds (x...). r =x i This falls into this category.

[0027] (3) The third situation is But x i ∈S r (i = 1, 2, ..., r-1). This indicates that the target access data has not appeared in the previous actual access set, but the previous target access data intersects with the set of random numbers generated this time. The approach to this situation is not to use all the number space to construct the tree, but to reserve some as "candidates." When this situation occurs, the set S is... r Elements that overlap with previously accessed target data are replaced with candidate numbers until no overlapping elements remain. Then, x is used... r Replacing any one of the elements yields S′ r .

[0028] (4) The last case is x r ∈{S′1,S′2,…,S′ r-1}, and x i ∈S r (i = 1, 2, ..., r-1). This indicates that the target access data has appeared in the past actual access set, and the past target access data and the current random number set intersect. In this case, set S needs to be... r Elements that overlap with previously accessed target data are replaced with candidate numbers, without needing to use x. r Replacement operations are performed, and accesses that were not performed are performed in other data structure operations.

[0029] After receiving the data, the accessing party needs to re-encrypt it before writing it back to Stash. This prevents the storage party from cracking the shuffling process. Also, since all accessing parties share the same key, re-encrypting some data in Stash will not affect other users' access to Stash. This concludes one access cycle.

[0030] Step 3: Wash and write back;

[0031] After c accesses in this round are completed, the data in the Stash is full, and the random number generator tree needs to be updated. First, the random number generator tree is updated so that if a new access occurs, the corresponding set of access addresses can be quickly obtained. Simultaneously, the data in the Stash is written back to the server in random order, and the PosMap is updated according to the write-back order to ensure that the next query can correctly find the data address. Furthermore, even if the set of access addresses for the next access is determined before the current round of Stash has completed re-encryption and write-back operations, the vast majority of data in the next access will be data not accessed in the previous round. This ensures high concurrency between rounds.

[0032] Beneficial effects:

[0033] To address the aforementioned problems, this invention proposes a privacy-preserving computation method based on unintentional random access. This method abandons previous models and explores new ones, borrowing the concept of a tree-like path model to propose an algorithm that allows multiple groups of accesses to proceed in parallel, and constructs a new model based on this algorithm. Compared with existing methods, this method enables multiple users to access data simultaneously in a highly efficient parallel manner, solving the problems of parallel querying and parallel write-back, exhibiting good concurrency, short response time, and high throughput. This method is suitable for privacy-preserving computation in multi-user scenarios where the data storage server is untrusted, enabling the analysis and computation of sensitive data while protecting user privacy. Attached Figure Description

[0034] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0035] Figure 1 This is a flowchart of the privacy-preserving computation method based on unintentional random access according to the present invention;

[0036] The accompanying drawings have illustrated specific embodiments of the present invention, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the present disclosure in any way, but rather to illustrate the concept of the invention to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0037] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0038] Figure 1 The flowchart shown is a privacy-preserving computation method based on unintentional random access, including the following steps:

[0039] 100 Model Initialization

[0040] Initially, each client (accessor) must have its own unique identifier, which must be agreed upon with the server (storage provider). All accessors must agree on a unified address space with the storage provider to prevent out-of-bounds access. Simultaneously, each accessor must be capable of encrypting and decrypting the data it receives; this assumes that all accessors are trustworthy and share the same key.

[0041] In the ORAM rules section, a random number generating tree (RandomTree) is generated for the address space N. It is a data structure responsible for generating c sets of consecutive disjoint random numbers. Initially, the numbers in the generating tree are randomly arranged.

[0042] c = (2 h′-1 )

[0043] Where c is the number of subtrees in the random number generation tree, also known as the parallelism. h′ is the height of the virtual nodes in the random number generation tree.

[0044] Suppose the current scenario requires generating four consecutive sets of disjoint random numbers. First, construct a binary tree of height h, setting the nodes of its first two levels as dummy nodes. This forms a binary tree with a total height of h. h - Four subtrees with four nodes. Assign a unique number to each node in each of the four subtrees, thus accommodating numbers from (0, 1, 2, ..., 2^4). hThe number space is -5). Next, a path is randomly selected from each subtree. The numbers contained in each path form a random number set of length h-2. Since the four paths do not intersect, the four random number sets also have no intersection. If the number of users is too large, the parallelism can be increased by adjusting the number of virtual node layers and increasing the number of subtrees.

[0045] Stash is a cache-like structure where every batch of accesses to the storage in a round is recorded. Before the next round begins, it is shuffled and written back to the storage. Initially, it is empty. ORAM rules also maintain a PosMap, which is responsible for maintaining the relationship between logical addresses and physical addresses. A logical address is the unique identifier for a piece of data by the accessor, and a physical address is the unique identifier for a piece of data by the storage provider. Since the process of ORAM operation involves masking the correlation between these two addresses, the ORAM rules require a PosMap to record the mapping relationship between them. This relationship should be correctly recorded in the initial state.

[0046] The storage device does not require any special initialization operations in its initial state.

[0047] PosMap is stored as an array and used on the client side. Stash is also stored on the client side, and logging technology is used to reliably maintain the data for both PosMap and Stash on the client side. RandomTree is implemented in a distributed manner on both the client and server sides. The server-side RandomTree is responsible for confirming the order of all access requests from clients. The client-side RandomTree is responsible for selecting a subtree for each user and generating a random number from the subtree to return to the user.

[0048] 200 access data

[0049] The accessing party sends read and write requests to the storage party through the ORAM rules. Although the accessing party has both read and write requests, "whether the current operation is a read or a write" is one of the things that ORAM needs to cover. Therefore, in the ORAM model, whether it is a read or a write, the complete process of the write request will be run on the storage party.

[0050] 201 Visitor initiated access

[0051] Access to data x1 and x2 is initiated sequentially by users A and B, respectively. i Let S be the logical address of the target data for the i-th access. After receiving the ORAM rule, it will first generate the actual access sets S1 and S2 using a random number generator tree and the corresponding rules. iThis is a set of random numbers generated for the i-th access. Then, PosMap is used to convert the logical addresses in both sets into physical addresses before sending them to the storage provider.

[0052] The client initiates the access, querying the server to determine which subtree of the RandomTree to use in this round. The client then encrypts and stores the logical address of the data to be accessed and the selected path number in the access log. In its response, the server truthfully provides the corresponding subtree number and updates the latest PosMap, access log, and RandomTree log. The client then synchronizes the RandomTree update, selects the corresponding path within that subtree, and calculates the actual access set based on the access log after obtaining the random number set for that path. Simultaneously, the client updates the PosMap using the log and sends the actual access set to the server after address translation. If access to Stash is necessary, the server identifies the client whose data to be stored from all actual access sets sent by the server and initiates the access. If access to Stash is not required, this operation is unnecessary.

[0053] 202 Storage returned data

[0054] After receiving the two physical address sets, the storage device reads the data and transmits it back to the Stash in the ORAM rule. The Stash then returns the data to the accessing device.

[0055] Since A is the first access, it must fall under the first scenario mentioned in step 2.2 of the technical solution. Therefore, S′1 must contain the data corresponding to x1, and the data returned by the storage party to the ORAM rule can be directly sent to the user. B's access occurs after A, so it could fall under any of the scenarios mentioned in step 2.2. If it is scenario (1) or scenario (3), the data returned by the storage party can be directly sent to the user. However, if it is scenario (2) or scenario (4), the actual access set S′2 does not include x2, while x2 appears in S1. Therefore, the ORAM rule can retrieve the data corresponding to x2 in the Stash and send it to the access party along with the data returned by the storage party to the ORAM rule. The access party stores the returned data as part of the Stash according to the rule.

[0056] 300 mixed wash write back

[0057] After each round of access, shuffling and updating operations are required, including shuffling and writing back the Stash, updating the PosMap, and updating the RandomTree. If the client's access is the last access of that round, the server will send the complete Stash for that round to the last user. The last user will determine which paths were used based on the access logs of this round, update the RandomTree and record it in the log, re-encrypt and shuffle the data in the Stash, write it back to the server, update the PosMap according to the shuffling results, and then store the PosMap update log on the server.

[0058] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A privacy-preserving computation method based on unintentional random access, characterized in that, Includes the following steps: Step 1: Model initialization steps: Complete the initialization operations for the access side, ORAM rules, and storage side; Step 2: Accessing data: The accessing party sends a read / write request to the storage party according to the ORAM rules; Step 3: Shuffle and Write-back Step: The storage party periodically performs out-of-order write-back operations on the data according to the ORAM protocol to ensure that the correspondence between logical addresses and physical addresses cannot be captured by the storage party and the data block content cannot be inferred through calculation. The model initialization step in step 1 is as follows: In the initial state, each access party must have its own number and reach an agreement with the storage party. All access parties must reach a unified address space with the storage party to avoid accessing outside the scope. At the same time, the access parties must also be able to encrypt and decrypt the data they obtain. Here, it is assumed that all access parties are trustworthy and share the same set of keys. In the ORAM rules section, regarding the address space Generate a random number generation tree (RandomTree), which is responsible for generating the random number generation tree. The data structure of consecutive disjoint random numbers. Initially, the numbers in the spanning tree are randomly arranged. Stash is a cache structure. Every batch of accesses to the storage in a round is recorded in this structure and shuffled and written back to the storage before the next round. It is empty at the beginning. The ORAM rule also maintains PosMap, which is responsible for maintaining the relationship between logical addresses and physical addresses. This relationship has been correctly recorded in the initial state. The storage does not require special initialization operations in the initial state. RandomTree is responsible for generating random numbers. The principle behind a set of disjoint random numbers is as follows: First, construct a tree with a height of Given a binary tree, set its predecessor... The nodes in the layer are virtual nodes, thus forming a shared layer. Nodes Tree, for Each node in the subtree is assigned a unique number, thus accommodating nodes from... Given a number space, we then randomly select a path from each subtree. The numbers contained in each path form a number space of length . A set of random numbers, because The paths do not intersect, therefore The sets of random numbers have no intersection. If the number of users exceeds the number of subtrees, the parallelism can be increased by adjusting the number of virtual node layers and increasing the number of subtrees. The data access step described in step 2 includes the following sub-steps: Step 2.1 Access initiated by the accessing party: Accessing parties A and B initiate access to the data sequentially. and Access, Given the target data logical address for the i-th access, the ORAM rule, upon receiving the data, will first generate the actual access set using a random number generation tree and the corresponding rules. and , The set of random numbers generated for the i-th access is then converted from logical addresses in the two sets to physical addresses using PosMap before being sent to the storage. Step 2.2 Storage returns data: After receiving the two physical address sets, the storage receives the data and transmits it back to the Stash in the ORAM rule. The Stash then returns the data to the accessor, where the actual access set is... There are four scenarios where the receiving party needs to re-encrypt the data before writing it back to the Stash. The actual access set is generated based on whether the data to be accessed this time has appeared in the previous actual access set, and whether there is an intersection between the data to be accessed previously and the current random number set. When the target data to be accessed this time has not appeared in the previous actual access set, not all the number space is used to construct the tree, but some is reserved as a candidate to replace overlapping elements.

2. The privacy-preserving computation method based on unintentional random access according to claim 1, characterized in that, The actual access set The four situations are as follows: Before describing the different scenarios and their solutions, let's define the data involved in this process. Assume the parallelism of the random number generation tree is... Users initiated the first round of this activity. Each visit Each access is called a round of access. After a round of access, a shuffling and update process is required. The data that the user wants to access is called the target access data, denoted as . The set obtained by a random number generator tree is called the random number set, denoted as . Assuming all previous accesses have been successfully executed, the target access data for each access is as follows: The set of random numbers for each iteration is: The target access data and the random number set will be used to obtain the actual data set to be accessed from the server, which is called the actual access set, denoted as . The following situations may occur: (1) The first case is And in every past visit ( This means that the data to be accessed this time has not appeared in the previous actual access set, and the data to be accessed previously has no intersection with the current random number set. In this case, directly... Replace any data in with This will give you the actual set of visits. ,if If so, no replacement operation is needed; (2) The second situation is ,but ( This indicates that the target data for this access has appeared in the previous actual access set, but the data to be accessed previously and the data to be accessed this time, as well as the generated random number set, have no intersection. In this case, the target data is not added to the actual access set; instead, it is directly set to... = This ensures that the actual access set in this round will not overlap with the previous ones, and the target data that is not accessed in this round will be obtained from other data structures. (3) The third situation is ,but ( This indicates that the target access data has not appeared in the previous actual access set, but there is an intersection between the previous target access data and the set of random numbers generated this time. The way to handle this situation is not to use all the number space to construct the tree, but to reserve some as "candidates." When this situation occurs, the set... Elements that overlap with previously accessed target data are replaced with candidate numbers until no overlapping elements remain. Then, [the process continues]. Replacing any one of the elements yields ; (4) The last case is ,and ( This indicates that the target access data has appeared in the past actual access set, and the past target access data and the current random number set have overlap. In this case, the set needs to be... Elements that overlap with previously accessed target data are replaced with candidate numbers, while there is no need to use... Replacement operations are performed, and accesses that were not performed are performed in other data structure operations.

3. The privacy-preserving computation method based on unintentional random access according to claim 1, characterized in that, The aforementioned shuffle and write-back steps are as follows: Waiting for this round After the next access ends, the data in the Stash is full, and the random number generator tree also needs to be updated. First, the random number generator tree is updated so that if a new access comes, the corresponding set of access addresses can be quickly obtained. At the same time, the data in the Stash is written back to the server in random order, and the PosMap is updated according to the writing order to ensure that the next query can correctly find the address of the data. In addition, even if the set of access addresses for the next access has been determined but the Stash has not yet completed the re-encryption and write-back operation in this round, some data in the next access will be data that was not accessed in the previous round. In this way, high concurrency is maintained between rounds.

Images