Method, device and equipment for concealed query and storage medium

Abstract

The application discloses a method and device for anonymous query, equipment and storage medium, and relates to the technical field of computer and Internet. The method comprises the following steps: receiving a first ciphertext, wherein the first ciphertext is generated by encrypting an ID corresponding to a data set based on a service end; calculating a first feedback parameter based on a query ID and the first ciphertext, and sending the first feedback parameter to the service end, wherein the first feedback parameter is used for determining whether there is an ID matching the query ID in the ID corresponding to the data set; receiving a second ciphertext from the service end, wherein the second ciphertext is generated by encrypting data in the data set based on the service end in the case that there is an ID matching the query ID in the ID corresponding to the data set; and extracting query data from the second ciphertext according to the query ID. The application can be applied to cloud technology, artificial intelligence, intelligent transportation and the like. The application can support the service end to actively perceive whether the query ID matches while keeping the security of the anonymous query.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of computers and Internet, and particularly relate to a method and device for anonymous query, equipment and storage medium. BACKGROUND

[0002] Anonymous query, also known as private information retrieval, is a query method used to protect the privacy of users on public network platforms. When a user searches information on a database, the user will use a certain method (such as an encryption algorithm) to prevent the server (such as a database server) from knowing the relevant information of the user's query statement, thereby protecting the user's query privacy.

[0003] In the related art, after the anonymous query is completed, the querying party (i.e., the client) needs to synchronize the information of whether the query ID matches to the queried party (i.e., the server), and the queried party settles based on the information. However, the above information has the risk of error (such as the querying party modifying the information), which easily leads to settlement error of the queried party, and the anti-risk ability of the queried party is not high. SUMMARY

[0004] Embodiments of the present application provide a method and device for anonymous query, equipment and storage medium, which can support the server to actively perceive whether the query ID matches without leaking the query ID and other data in the data set, thereby realizing the improvement of the anti-risk ability of the server while maintaining the security of the anonymous query, and further reducing the risk of economic loss of the server caused by the malpractice of the client. The technical solution is as follows:

[0005] According to an aspect of an embodiment of the present application, a method for anonymous query is provided, the method comprising:

[0006] sending an anonymous query request to a server; wherein the server corresponds to a data set stored therein;

[0007] receiving a first ciphertext from the server, the first ciphertext being generated by encrypting an identity number ID corresponding to data in the data set;

[0008] based on the query ID and the first ciphertext, calculating a first feedback parameter, and sending the first feedback parameter to the server; wherein the first feedback parameter is used to determine whether there is an ID matching the query ID in the ID corresponding to the data set;

[0009] receiving a second ciphertext from the server, the second ciphertext being generated by encrypting data in the data set by the server under the condition that there is an ID matching the query ID in the ID corresponding to the data set according to the first feedback parameter;

[0010] extract the query data corresponding to the query ID from the second ciphertext according to the query ID.

[0011] According to an aspect of an embodiment of the present application, there is provided a method for privacy-preserving query, the method comprising:

[0012] in response to receiving a privacy-preserving query request from a client, generating first ciphertext based on identity identification number (ID) corresponding to data in a data set, and sending the first ciphertext to the client;

[0013] receiving a first feedback parameter from the client, the first feedback parameter being generated by the client based on a query ID and the first ciphertext, the first feedback parameter being used to determine whether there is an ID matching the query ID in the ID corresponding to the data set;

[0014] in a case where the first feedback parameter satisfies a first condition, encrypting the data in the data set to generate second ciphertext, and sending the second ciphertext to the client; wherein the first condition is used to indicate that there is an ID matching the query ID in the ID corresponding to the data set.

[0015] According to an aspect of an embodiment of the present application, there is provided a device for privacy-preserving query, the device comprising:

[0016] a request sending module configured to send a privacy-preserving query request to a server; wherein the server corresponds to a data set stored therein;

[0017] a ciphertext receiving module configured to receive first ciphertext from the server, the first ciphertext being generated based on identity identification number (ID) corresponding to data in the data set;

[0018] a parameter calculating module configured to calculate a first feedback parameter based on a query ID and the first ciphertext, and send the first feedback parameter to the server; wherein the first feedback parameter is used to determine whether there is an ID matching the query ID in the ID corresponding to the data set;

[0019] the ciphertext receiving module is further configured to receive second ciphertext from the server, the second ciphertext being generated by the server based on the data in the data set in a case where the first feedback parameter determines that there is an ID matching the query ID in the ID corresponding to the data set;

[0020] a data extracting module configured to extract query data corresponding to the query ID from the second ciphertext according to the query ID.

[0021] According to an aspect of the embodiments of the present application, an anonymous query device is provided, the device comprising:

[0022] a ciphertext generation module configured to, in response to receiving an anonymous query request from a client, generate first ciphertext based on identity identification numbers (IDs) corresponding to data in a data set, and send the first ciphertext to the client;

[0023] a parameter receiving module configured to receive a first feedback parameter from the client, the first feedback parameter being generated by the client based on a query ID and the first ciphertext, and the first feedback parameter being used to determine whether there is an ID matching the query ID in the IDs corresponding to the data set;

[0024] the ciphertext generation module is further configured to, in a case where the first feedback parameter satisfies a first condition, encrypt the data in the data set to generate second ciphertext, and send the second ciphertext to the client; wherein the first condition is used to indicate that there is an ID matching the query ID in the IDs corresponding to the data set

[0025] According to an aspect of the embodiments of the present application, a computer device is provided, the computer device comprising a processor and a memory, the memory storing a computer program, the computer program being loaded and executed by the processor to implement the above-mentioned anonymous query method.

[0026] The computer device is a terminal device or a server.

[0027] According to an aspect of the embodiments of the present application, a computer readable storage medium is provided, the readable storage medium storing a computer program, the computer program being loaded and executed by a processor to implement the above-mentioned anonymous query method.

[0028] According to an aspect of the embodiments of the present application, a computer program product or computer program is provided, the computer program product or computer program comprising computer instructions stored in a computer readable storage medium. The processor of the computer device reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions to make the computer device execute the above-mentioned anonymous query method.

[0029] The technical solutions provided by the embodiments of the present application can include the following beneficial effects:

[0030] In the process of the anonymous query, the client first encrypts the generated first ciphertext based on the ID corresponding to the data set and the query ID, calculates a first feedback parameter for determining whether there is an ID matching the query ID in the ID corresponding to the data set, and then the server determines whether there is an ID matching the query ID in the ID corresponding to the data set based on the first feedback parameter, so that the server can actively perceive whether the query ID is matched, without passively obtaining the information from the client, thereby improving the anti-risk ability of the server, and avoiding the risk of economic loss of the server caused by the evil of the client.

[0031] In addition, the server generates a second ciphertext based on data encryption in the data set when it is determined that there is an ID matching the query ID in the ID corresponding to the data set, and the client extracts the query data corresponding to the query ID from the second ciphertext according to the query ID, so that the query ID and the data in the data set are not disclosed, thereby maintaining the security of the anonymous query. BRIEF DESCRIPTION OF DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0033] Figure 1 is a schematic diagram of the scheme implementation environment provided by an embodiment of the present application;

[0034] Figure 2 is a flowchart of the anonymous query method provided by an embodiment of the present application;

[0035] Figure 3 is a flowchart of the method for obtaining the first feedback parameter provided by an embodiment of the present application;

[0036] Figure 4 is a flowchart of the method for extracting the query data provided by an embodiment of the present application;

[0037] Figure 5 is a flowchart of the anonymous query method provided by another embodiment of the present application;

[0038] Figure 6 is a flowchart of the method for generating the first ciphertext provided by an embodiment of the present application;

[0039] Figure 7 is a block diagram of the anonymous query device provided by an embodiment of the present application;

[0040] Figure 8is a block diagram of the anonymized query device provided by another embodiment of the present application;

[0041] Figure 9 is a block diagram of the anonymized query device provided by another embodiment of the present application;

[0042] Figure 10 is a block diagram of the anonymized query device provided by another embodiment of the present application;

[0043] Figure 11 is a structural block diagram of the computer device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solutions and advantages of the present application clearer, the embodiments of the present application will be further described in detail below with reference to the drawings.

[0045] Before the embodiments of the present application are introduced and explained, the related terms involved in the present application will be explained and described first.

[0046] 1. PIR: Private Information Retrieval, which is also called private information retrieval.

[0047] 2. Host: the server in the anonymized query, that is, the party providing data, which is also called the queried party. For example, the Host can be a server for providing data (such as marketing data, product data, financial data, knowledge data, etc.), which can also be a third-party platform or a background server of a third-party platform, and the embodiments of the present application do not limit this.

[0048] 3. Guest: the client in the anonymized query, that is, the party initiating the query, which is also called the querying party. For example, the Guest can be a client with an anonymized query function, and a user can perform anonymized query through the client.

[0049] 4. Online PIR: in each online anonymized query process, the client decrypts the encrypted data from the server, and then extracts the query data corresponding to the query ID from the decrypted data according to the query ID.

[0050] 5. Elliptic Curve-based EIGamal Homomorphic Encryption: Elliptic Curve Group Plaintext Space n is the order of (that is, n represents the size of , and n is a prime number, generally a 256-bit prime number), represents an integer between 0 and n.

[0051] 1) Encryption algorithm parameters: G (first generator), H (second generator) and the discrete logarithm of G and H is unknown (i.e. solving α, β such that α·G = H and β·H = G is computationally difficult).

[0052] 2) Key pair generation: private key public key The public key is public and the private key is secret.

[0053] 3) Encryption: input plaintext random parameter and public key PK, output ciphertext where C0 = r·G, C1 = r·PK + m·H.

[0054] 4) Decryption: let ciphertext C1-sk·C0 = m·H is calculated using the private key sk, and then the plaintext is recovered by exhaustive search

[0055] Under the DDH (Decisional Diffie-Hellman) security assumption, the ciphertext of the homomorphic encryption algorithm is indistinguishable from a random element of In the decryption process, the plaintext m is recovered by m·H, which is essentially a discrete logarithm problem. When the plaintext is too large (e.g. more than 2 64 ), it is difficult to recover the plaintext. Alternatively, an embodiment of the present application can select an ed25519 elliptic curve, and the ciphertext length of the elliptic curve-based ElGamal homomorphic encryption is 64 bytes.

[0056] Please refer to Figure 1 which shows a schematic diagram of a scheme implementation environment provided by an embodiment of the present application. The implementation environment can include a client 10 and a server 20.

[0057] Client 10 refers to the client in the anonymous query. For example, Client 10 can refer to the client in an online anonymous query, through which users can perform online anonymous queries. Client 10 can also refer to the client of a target application, which can be an application with anonymous query functionality, such as a query application, marketing application, identity verification application, anti-fraud application, financial application, shopping application, game application, social application, interactive entertainment application, etc. The target application corresponding to Client 10 can be installed and run on a terminal, which can be an electronic device such as a mobile phone, tablet computer, game console, multimedia playback device, PC (Personal Computer), or in-vehicle terminal. Optionally, the target application has encryption and decryption capabilities; for example, the client of the target application can encrypt and decrypt data, IDs, etc.

[0058] Server 20 refers to the server in the hidden query. For example, server 20 can refer to the server in an online hidden query, and server 20 can be used to provide data (such as marketing data, product data, financial data, knowledge data, etc.) for the online hidden query. Server 20 can refer to the backend server corresponding to the aforementioned client 10, or it can refer to a third-party platform, or it can refer to the backend server of a third-party platform; this embodiment of the application does not limit this. The third-party platform can be a platform such as an information query, identity verification, social networking, entertainment, shopping, or gaming platform. The backend server can be a single server, a server cluster consisting of multiple servers, or a cloud computing service center. Optionally, server 20 is equipped with a database for storing the aforementioned data. Server 20 has encryption and decryption capabilities; for example, server 20 can encrypt and decrypt data, IDs, etc.

[0059] Client 10 and server 20 can communicate with each other via a network. This network can be a wired network or a wireless network.

[0060] In one example, such as Figure 1 As shown, client 10 has a query ID (i.e. Figure 1 In the dataset {id1), server 20 has a dataset {(id0, data0), (id1, data1), (id2, data2), ...}.

[0061] Client 10 sends a hidden query request to server 20 to initiate an online hidden query.

[0062] The service end 20, after receiving the anonymous query request, constructs a zero polynomial according to the ID set corresponding to the data set: {id0, id1, id2,...}, and then can encrypt the coefficients of the zero polynomial by using a homomorphic encryption algorithm (such as an ElGamal homomorphic encryption algorithm based on an elliptic curve) to obtain a first ciphertext, and sends the first ciphertext to the client 10. The encryption of the coefficients of the zero polynomial is to protect the query ID of the client 10 from being leaked, and is also used to determine whether the query ID is in the ID set: {id0, id1, id2,...}.

[0063] The client 10, after receiving the first ciphertext, homomorphically calculates a first feedback parameter according to the query ID and the first ciphertext, and the first feedback parameter is used to determine whether there is an ID matching the query ID in the ID corresponding to the data set of the service end 20. The client 10 sends the first feedback parameter to the service end 20.

[0064] The service end 20, after receiving the first feedback parameter, determines whether there is an ID matching the query ID in the ID corresponding to the data set according to the first feedback parameter. In the case where there is an ID matching the query ID in the ID corresponding to the data set, the service end 20 encrypts the data in the data set by using a symmetric encryption algorithm to obtain a second ciphertext, and sends the second ciphertext to the client 10.

[0065] The client 10 extracts the query data corresponding to the query ID (i.e., data1 in Figure 1 ) from the second ciphertext according to the query ID.

[0066] Optionally, in the case where there is no ID matching the query ID in the ID corresponding to the data set, the service end 20 sends protocol termination information to the client 10 to indicate that the current online anonymous query is ended.

[0067] Exemplarily, taking the risk control scene as an example, in the process of evaluating the credit level of a user, a company wants to query the credit information (such as loss of credit information, multi-head lending, etc.) of the user on a platform. By using the technical solution provided in the embodiments of the present application, the data of the platform can be protected without being exported from the database, and only intermediate encrypted parameters are exchanged, so that the privacy information of the non-query user is protected. At the same time, the platform cannot perceive the query ID of the company, and the privacy information of the user is protected.

[0068] During the whole online anonymous query process, the query ID of the client 10 is protected, that is, the server 20 knows whether the query ID matches, but does not know which query ID it is, and the data of the server 20 is also protected, that is, when the query ID matches, the client 10 can only obtain the data corresponding to the query ID, and cannot obtain other data, thereby realizing the function of ensuring the security of the anonymous query (that is, the query ID and the data in the data set are not leaked) while enabling the server to perceive whether the query ID matches, thereby avoiding the risk of economic loss to the server caused by the evil behavior of the client.

[0069] Please refer to Figure 2 , which shows a flowchart of an anonymous query method provided by an embodiment of the application. The execution subject of each step of the method can be Figure 1 the client 10 in the implementation environment of the scheme shown in the figure, and the method can include the following steps (steps 201-205):

[0070] Step 201, sending an anonymous query request to a server; wherein the server corresponds to a data set stored therein.

[0071] The server in the embodiment of the application is the server corresponding to the anonymous query, that is, the queried party. The anonymous query request is used to initiate an anonymous query to the server. Optionally, the anonymous query request can be generated and sent by the client corresponding to the anonymous query. The anonymous query can be an online anonymous query.

[0072] In one example, the server is correspondingly provided with a database, and the database stores a data set formed by data required to be obtained by a user. Illustratively, the database is a relational database, for example, a KV database, and the data set is a KV data set, for example, data and ID are stored correspondingly. Optionally, the ID can be used to represent the corresponding data, and the ID can be a string of symbols corresponding to the queried object or a keyword corresponding to the queried object, which is not limited in the embodiment of the application.

[0073] Illustratively, the above data set can be represented as follows:

[0074] DB = {(id1, v1), (id2, v2),..., (id L , v L )};

[0075] Wherein, the data set includes L pairs of key-value pairs (that is, data and id pairs), (id L , v L ) is the Lth pair of key-value pairs.

[0076] Step 202, receiving a first ciphertext from the server, the first ciphertext being generated by encrypting an identity number ID corresponding to the data in the data set.

[0077] Optionally, the server can encrypt all IDs corresponding to the dataset to obtain the first ciphertext. In one example, the server can use a homomorphic encryption algorithm to encrypt all IDs corresponding to the dataset to obtain the first ciphertext. The specific method for generating the first ciphertext will be described in detail below. For content not described in the embodiments of this application, please refer to the following embodiments, which will not be repeated here.

[0078] For example, based on the above embodiments, the server can use the ElGamal homomorphic encryption algorithm based on elliptic curves to perform encryption on {id1, id2, ..., id...}. L The encryption process is performed to obtain the first ciphertext, which is then sent to the client.

[0079] Step 203: Calculate the first feedback parameter based on the query ID and the first ciphertext, and send the first feedback parameter to the server; wherein, the first feedback parameter is used to determine whether there is an ID in the corresponding ID of the dataset that matches the query ID.

[0080] A query ID refers to the ID corresponding to the queried object in a hidden query, and a query ID may include multiple IDs. This query ID corresponds to the ID corresponding to the dataset. For example, the query ID may be included among the IDs corresponding to the dataset, or it may match a specific ID among the IDs corresponding to the dataset. The embodiments of this application do not limit this.

[0081] The first feedback parameter is the feedback parameter corresponding to the query ID. In this embodiment, the plaintext corresponding to this feedback parameter can be 0 or a non-zero value (such as 1). For example, if there is an ID in the dataset that matches the query ID, then the plaintext corresponding to the first feedback parameter is 0; otherwise, it is 1.

[0082] In one example, the first ciphertext includes multiple encryption coefficients, which are obtained by encrypting the coefficients of a null polynomial constructed based on the IDs corresponding to the dataset. (See reference...) Figure 3 Step 203 above may include the following sub-steps:

[0083] Step 203a: Construct a zero-fiber polynomial with encrypted coefficients based on multiple encryption coefficients.

[0084] Alternatively, the nihilistic polynomial can be expressed as follows: F(x) j x = 0, j = 1, 2, ..., L, in the embodiments of this application, x j The plaintext of the j-th ID corresponding to the dataset, i.e. This represents the plaintext space corresponding to the homomorphic encryption algorithm.

[0085] For example, if the null polynomial constructed based on the IDs corresponding to the dataset is represented as:

[0086] F(X) = f0 + f1X + f2X 2 +...+f L X L ;

[0087] There are L encryption coefficients, and the null polynomial after encryption can be expressed as:

[0088] Enc(F(X))=ct0+ct1X+ct2X 2 +...+ct L X L ;

[0089] Among them, ct L The encryption coefficient is the Lth coefficient after encryption.

[0090] The specific method for obtaining the encryption coefficient will be described in detail below. For content not described in the embodiments of this application, please refer to the following embodiments, which will not be repeated here.

[0091] Step 203b: Obtain the first value of the zero-coefficient polynomial after coefficient encryption at the query ID.

[0092] Optionally, the plaintext corresponding to the query ID can be input into the zero-valued polynomial after the coefficients are encrypted to obtain the first value.

[0093] In one example, you can first call the first hash function to hash the query ID to get the first hash value corresponding to the query ID, and then calculate the value of the homomorphically encrypted null polynomial at the first hash value to get the first value.

[0094] For example, after obtaining L encryption coefficients, the client calls the first hash function: calculate Where id represents the query ID and x represents the first hash value. Then, the first value of Enc(F(X)) at x is homomorphically calculated: the values ​​of x at ct0, ct1X, ct2X are calculated homomorphically in turn. 2 , ..., ct L X L The first value is obtained by homomorphically adding the L values ​​together.

[0095] Step 203c: The first value is blinded using a blinding parameter to obtain the first feedback parameter; wherein, the blinding parameter is randomly selected from the plaintext space corresponding to the server, and the plaintext space is constructed based on the ID corresponding to the dataset using the first hash function.

[0096] Optionally, the encryption coefficient described above can be obtained by encrypting the coefficients of the annihilating polynomial using a homomorphic encryption algorithm, such as an elliptic curve-based ElGamal homomorphic encryption algorithm. The homomorphic encryption algorithm is correspondingly provided with a private key and a public key, the private key is selected from the plaintext space, and the public key is generated based on the private key.

[0097] Exemplarily, taking the elliptic curve-based ElGamal homomorphic encryption algorithm as an example, the public parameters of the homomorphic encryption algorithm are as follows:

[0098] 1. Elliptic curve group Order n, generator G (i.e. first generator), H (i.e. second generator) And the discrete logarithm of G and H is unknown, that is, the first generator and the second generator are selected from the elliptic curve group.

[0099] 2. Three hash functions: the first hash function is used to generate the plaintext space, and the first hash function can be represented as: The second hash function is used to obtain the first data space under the first security parameter based on the corresponding elliptic curve group of the server, and the second hash function can be represented as: Where 2λ is the first security parameter, λ is usually 128, {0, 1} 2λ is the first data space; the third hash function is used to generate the second data space under the second security parameter, which is associated with the first security parameter, and the third hash function can be represented as: H3: {0, 1} * → {0, 1} λ , λ is the second security parameter, {0, 1} λ is the second data space.

[0100] 3. Key pair: private key Public key

[0101] The encryption process (i.e. the first feedback parameter) of the homomorphic encryption algorithm can be as follows:

[0102] 1. Using the blinding parameter, the first generator and the value of the random polynomial at the query ID, a first sub-feedback parameter is generated.

[0103] Optionally, the first sub-feedback parameter can be represented as:

[0104] C o = r·R(x)·G = (C 0，0 +x·C 1，0 +x 2 ·C 2，0 +...+x L ·C L，0 )

[0105] wherein C0 is the first sub-feedback parameter, is a blinding parameter, R(x) is a value of a random polynomial at the query ID, the random polynomial is constructed based on the corresponding random parameter of the encryption coefficient in the encryption process, and the random polynomial can be expressed as: R(x) = r0+r1x+r2x 2 +...+r L x L , r L is a random parameter corresponding to the Lth encryption coefficient, C L，0 is the Lth parameter corresponding to the first sub-feedback parameter.

[0106] 2. Based on the blinding parameter, the first value, the second generator, the public key and the value of the random polynomial at the query ID, the second sub-feedback parameter is generated.

[0107] Optionally, the second sub-feedback parameter can be expressed as:

[0108] C1 = r·(R(x)·PK+Enc(F(x))·H) = (C 0，1 +x·C 1，1 +x 2 ·C 2，1 +...+x L ·C L，1 );

[0109] wherein C1 is the second sub-feedback parameter, Enc(F(x) is the first value, C L，1 is the Lth parameter corresponding to the second sub-feedback parameter.

[0110] 3. Based on the first sub-feedback parameter and the second sub-feedback parameter, the first feedback parameter is obtained.

[0111] Optionally, the first feedback parameter can be expressed as (C0, C1).

[0112] The purpose of the embodiment of the application for blinding the first value is to prevent the server from deducing the query ID of the client according to the private key sk when the query ID of the client is in the ID set corresponding to the data set, so that the query ID is not disclosed, and the security of the anonymous query is maintained.

[0113] Step 204, receiving the second ciphertext from the server, the second ciphertext is generated by the server based on the data in the data set according to the first feedback parameter in the case that the ID corresponding to the query ID exists in the ID set corresponding to the data set.

[0114] Optionally, the server can encrypt all data in the data set to obtain second ciphertext. In an example, the server can use a symmetric encryption algorithm to encrypt all data in the data set to obtain the second ciphertext, such as an encryption algorithm of AES (Advanced Encryption Standard), SM4 (a national encryption algorithm), etc. The specific generation method of the second ciphertext will be described in detail below, and the content not described in the embodiments of the present application can refer to the following embodiments, which will not be described here.

[0115] For example, the server can use a symmetric encryption algorithm to encrypt {v1, v2,..., vn} to obtain the second ciphertext, and then send the second ciphertext to the client. L

[0116] Step 205, extracting the query data corresponding to the query ID from the second ciphertext according to the query ID.

[0117] The query data refers to the data required by the client to obtain. For example, referring to Figure 1 , the query ID corresponding to the client is idl, and the data1 corresponding to idl can be determined as the query data corresponding to idl.

[0118] In an example, the second ciphertext includes a plurality of ciphertext pairs, each ciphertext pair includes an initial vector and a ciphertext, the ciphertext is the ciphertext after the data is encrypted, and the initial vector is used to retrieve the ID corresponding to the query ID, which can be obtained based on the query ID by a third hash function. Referring to Figure 4 , step 205 can further include the following sub-steps:

[0119] Step 205a, calling a second hash function to hash the product between the public key corresponding to the server and the blinding parameter to obtain a first intermediate parameter and a second intermediate parameter; wherein the first intermediate parameter is used to determine the target initial vector, and the second intermediate parameter is the key corresponding to the query ID. The target initial vector refers to the initial vector matched with the query ID.

[0120] Optionally, based on the above embodiments, the client calls the second hash function H2 to calculate: t1||t2←H2(r·PK) after receiving the L ciphertext pairs (iv, ciphertext), wherein iv is the initial vector, t1 is the first intermediate parameter corresponding to the left λ bits, t2 is the second intermediate parameter corresponding to the right λ bits, and t1||t2 represents the splicing result between t1 and t2.

[0121] Step 205b, calling a third hash function to hash the splicing result between the first intermediate parameter and the query ID to obtain the target initial vector corresponding to the query ID.

[0122] ​Optionally, a third hash function H3 is called to calculate: iv←H3(t1||id). Wherein iv represents the target initial vector corresponding to the query ID, id represents the query ID, and t1||id is the splicing result between the first intermediate parameter and the query ID.

[0123] In step 205c, the second intermediate parameter and the target initial vector are used to decrypt the sub-ciphertext corresponding to the target initial vector, to obtain the query data corresponding to the query ID.

[0124] Optionally, the target initial vector is matched with the initial vectors corresponding to the L ciphertext pairs respectively, to obtain the ciphertext pair corresponding to the target initial vector, and then the query ID corresponding to the sub-ciphertext is obtained, and finally the second intermediate parameter is used as a key to decrypt the sub-ciphertext in combination with the target initial vector, to obtain the query data corresponding to the query ID.

[0125] In one example, in the case that the protocol termination information from the server is received, the client can determine that the query data corresponding to the query ID does not exist in the data set corresponding to the server, and then the online anonymous query can be ended.

[0126] In the embodiments of the present application, under the random oracle model, based on the DDH security assumption, when the client and the server honestly comply with the protocol corresponding to the anonymous query, the protocol is secure, that is, under the semi-honest model, according to the interaction content corresponding to the anonymous query, the client cannot obtain other information (including other IDs and other data of the server) except the query data corresponding to the matching query ID, and the server cannot obtain the query ID of the client except knowing whether the query ID matches.

[0127] In summary, the technical scheme provided by the embodiments of the present application enables the client to calculate the first feedback parameter for determining whether there is an ID matching the query ID in the ID corresponding to the data set based on the first ciphertext generated by encrypting the ID corresponding to the data set and the query ID, and then the server determines whether there is an ID matching the query ID in the ID corresponding to the data set based on the first feedback parameter, so that the server can actively perceive whether the query ID matches, without passively obtaining the information from the client, thereby improving the anti-risk ability of the server, and avoiding the risk of economic loss of the server caused by the evil of the client.

[0128] In addition, the server generates the second ciphertext based on the data encryption of the data in the data set when it is determined that there is an ID matching the query ID in the ID corresponding to the data set, and the client extracts the query data corresponding to the query ID from the second ciphertext according to the query ID, which realizes that the query ID and the data in the data set are not disclosed, thereby maintaining the security of the anonymous query.

[0129] In addition, the technical scheme provided in the embodiments of the present application reduces the communication volume and decryption calculation volume in the anonymous query by using the homomorphic encryption algorithm and the symmetric encryption algorithm, thereby solving the problem of large communication volume and high decryption calculation volume caused by using the asymmetric encryption technology and the oblivious transfer technology to implement the anonymous query, and further improving the efficiency of the anonymous query.

[0130] In addition, in the embodiments of the present application, the server only needs to generate a public key and a private key once, that is, the homomorphic encryption algorithm and the symmetric encryption algorithm share the public key and the private key, thereby further reducing the communication volume of the anonymous query and further improving the efficiency of the anonymous query.

[0131] Please refer to Figure 5 which shows a flowchart of an anonymous query method provided by another embodiment of the present application. The execution subject of each step of the method can be Figure 1 the server 20 in the implementation environment of the scheme shown in the figure. The method can include the following steps (steps 501-503):

[0132] Step 501, in response to receiving an anonymous query request from a client, generating a first ciphertext based on the identity identifier ID corresponding to the data in the data set, and sending the first ciphertext to the client.

[0133] The client in the embodiments of the present application is the client corresponding to the anonymous query, that is, the query party. The anonymous query request is used to initiate the anonymous query. The anonymous query request can be generated and sent by the client corresponding to the anonymous query. The anonymous query can be an online anonymous query.

[0134] The data set can be formed by data required to be obtained by a user, and the data set can be stored in the database of the server. Exemplarily, the data set is a KV data set, which can be stored in a KV database. The ID can be a string of identifiers corresponding to the queried object, or a keyword corresponding to the queried object, which is not limited in the embodiments of the present application.

[0135] Optionally, the server can use the homomorphic encryption algorithm to encrypt all IDs corresponding to the data set to obtain the first ciphertext, such as the ElGamal homomorphic encryption algorithm based on the elliptic curve in the above embodiments. Optionally, the ElGamal algorithm based on the discrete logarithm problem of large integer field can also be used in combination with the additive homomorphism, that is, the additive homomorphism of ElGamal is used to generate the first ciphertext, which is not limited in the embodiments of the present application.

[0136] In one example, taking the ElGamal homomorphic encryption algorithm based on the elliptic curve as an example, as Figure 6 shown, step 501 can further include the following sub-steps:

[0137] Step 501a, calling a first hash function to hash the IDs corresponding to the data set to obtain the hash values corresponding to the data set; wherein the first hash function is used to generate the plaintext space corresponding to the server.

[0138] Optionally, the server can call the first hash function to hash all IDs corresponding to the data set to obtain the hash values corresponding to each ID respectively, that is, to obtain the plaintext corresponding to each ID respectively.

[0139] Illustratively, the client calls the first hash function: hashes {id1, id2,..., id L L respectively, denoted as j = 0, 1, 2,..., L.

[0140] Step 501b, constructing a zero polynomial based on the hash values corresponding to the data set.

[0141] Optionally, for any xj, the value of the zero polynomial is zero, which can be represented as follows:

[0142] F(X) = f0 + f1X + f2X 2 +... + f L X L ;

[0143] Where f L is the coefficient corresponding to the hash value of the Lth ID.

[0144] Step 501c, encrypting the coefficients of the zero polynomial to obtain encrypted coefficients.

[0145] Optionally, the server can use the public key PK corresponding to the ElGamal homomorphic encryption algorithm based on elliptic curve to encrypt each coefficient of the zero polynomial. In one example, the process of obtaining encrypted coefficients can be as follows:

[0146] 1. For the target coefficient corresponding to the zero polynomial, randomly obtain the target random parameter corresponding to the target coefficient from the plaintext space.

[0147] Wherein the target coefficient can refer to any one of the plurality of coefficients corresponding to the zero polynomial.

[0148] Illustratively, for the target coefficient f i , the target random parameter corresponding to f i is denoted as: r i is randomly selected from .

[0149] 2. Obtain a first product between the target random parameter and the first generator.

[0150] Optionally, the first product corresponding to the target coefficient can be represented as: r i ·G, where G is the first generator, which is randomly selected from the elliptic curve group corresponding to the server.

[0151] 3. Obtain a second product between the public key of the server and the target random parameter.

[0152] Optionally, the second product corresponding to the target coefficient can be represented as: r i ·PK, where PK is the public key of the server, which is generated based on the private key of the server, and the private key is randomly selected from the plaintext space.

[0153] 4. Obtain a third product between the target coefficient and the second generator.

[0154] Optionally, the third product corresponding to the target coefficient can be represented as: f i ·H, where H is the second generator, which is also randomly selected from the elliptic curve group corresponding to the server.

[0155] 5. Sum the second product and the third product to obtain a first sum value.

[0156] Optionally, the first sum value corresponding to the target coefficient can be represented as: r i ·PK+f i ·H.

[0157] 6. Obtain the encryption coefficient corresponding to the target coefficient based on the first product and the second sum value.

[0158] Optionally, the encryption coefficient corresponding to the target coefficient can be represented as: The encryption coefficient can also be denoted as: ct i =(C i，0 , C i，1 ).

[0159] Then the zero polynomial after coefficient encryption can be represented as:

[0160] Enc(F(X)) = ct0+ct1X+ct2X 2 +...+ct L X L .

[0161] Step 501d, generate a first ciphertext based on the encryption coefficient.

[0162] Optionally, the server can directly send the L encrypted coefficients as the first ciphertext to the client. In the case of using the ed25519 elliptic curve, the length of the encrypted coefficients is 64 bytes, and the length of the first ciphertext is 64*L bytes, thereby facilitating the reduction of the communication volume of the query.

[0163] At step 502, the first feedback parameter generated by the client based on the query ID and the first ciphertext is received from the client. The first feedback parameter is used to determine whether there is an ID matching the query ID in the ID corresponding to the data set.

[0164] After receiving the first ciphertext, the client generates the first feedback parameter based on the query ID and the first ciphertext, and sends the first feedback parameter to the server. The first feedback parameter includes a first sub-feedback parameter and a second sub-feedback parameter. The first sub-feedback parameter is generated based on the blinding parameter, the first generator, and the value of the random polynomial at the query ID. The second sub-feedback parameter is generated based on the blinding parameter, the first value, the second generator, the public key of the server, and the value of the random polynomial at the query ID. The blinding parameter is randomly selected from the plaintext space. The first value refers to the value of the encrypted zero polynomial at the query ID. The encrypted zero polynomial is constructed by the encrypted coefficients corresponding to the first ciphertext. The random polynomial is constructed based on the random parameter corresponding to the encrypted coefficients in the encryption process.

[0165] Exemplarily, the first feedback parameter can be represented as (C0, C1), wherein the first sub-feedback parameter can be represented as: C0=r·R(x)·G=(C 0，0 +x·C 1，0 +x 2 ·C 2，0 +...+x L ·C L，0 ), and the second sub-feedback parameter can be represented as: C1=r·(R(x)·PK+Enc(F(x))·H)=(C 0，1 +x·C 1，1 +x 2 ·C 2，1 +...+x L ·C L，1 ), wherein r is the blinding parameter, and R(x) is the value of the random polynomial at the query ID.

[0166] At step 503, in the case that the first feedback parameter satisfies the first condition, the data in the data set is encrypted to generate the second ciphertext, and the second ciphertext is sent to the client. The first condition is used to indicate that there is an ID matching the query ID in the ID corresponding to the data set.

[0167] In one example, the first condition is that a product of a first sub-feedback parameter in the first feedback parameter and a private key of the server is equal to a second sub-feedback parameter in the first feedback parameter.

[0168] After receiving the first feedback parameter (C0, C1), the client can determine whether sk·C0 is equal to C1 using the private key sk. If sk·C0 is equal to C1, it can be determined that there is an ID matching the query ID in the IDs corresponding to the data set; if sk·C0 is not equal to C1, it can be determined that there is no ID matching the query ID in the IDs corresponding to the data set. That is, sk·C0 = C1 is equivalent to the plaintext corresponding to (C0, C1) being 0, which is equivalent to the first hash value x of the query ID being in {x1, x2, x3,..., x L}, which is equivalent to the query ID being in {id1, id2,..., id L}. Since the embodiment of the present application only needs to determine whether the product of the first sub-feedback parameter and the private key is equal to the second sub-feedback parameter, it can be determined whether the query ID matches, which reduces the determination workload and further improves the efficiency of the anonymous query compared to decoding the corresponding plaintext from the root-based first feedback parameter to determine whether the query ID matches.

[0169] In another example, the first plaintext corresponding to the first feedback parameter is 0.

[0170] After receiving the first feedback parameter (C0, C1), the client can decrypt the first feedback parameter after homomorphic calculation using the private key to obtain the first plaintext. If the first plaintext is 0, it can be determined that there is an ID matching the query ID in the IDs corresponding to the data set. If the first plaintext is not 0, it can be determined that there is no ID matching the query ID in the IDs corresponding to the data set.

[0171] Optionally, in the case where it is determined that there is an ID matching the query ID in the IDs corresponding to the data set, the client encrypts the data in the data set to generate a second ciphertext, and sends the second ciphertext to the client. In the case where it is determined that there is no ID matching the query ID in the IDs corresponding to the data set, the client generates protocol termination information and sends the protocol termination information to the client to indicate that the current online anonymous query is over.

[0172] In one example, the server can generate the second ciphertext using a symmetric encryption algorithm, which can include the following contents:

[0173] 1. For target data in the data set, call the first hash function corresponding to the server to hash the target ID corresponding to the target data to obtain the target hash value corresponding to the target data.

[0174] The target data can be any data in the data set.

[0175] Optionally, the client calls a first hash function: Hashes the target data v j to obtain a target hash value y j .

[0176] 2. Obtain a target value of a random polynomial at the target hash value.

[0177] Optionally, the target value corresponding to the target data can be expressed as:

[0178] 3. Generate a target intermediate parameter according to the target value and a second sub-feedback parameter.

[0179] Optionally, the target intermediate parameter corresponding to the target data can be expressed as:

[0180] 4. Call a second hash function to hash the target intermediate parameter to obtain an intermediate initial vector and a key corresponding to the target data; wherein the second hash function is used to obtain a first data space under a first security parameter based on an elliptic curve group corresponding to the server. The above key refers to a key corresponding to a symmetric encryption algorithm.

[0181] Optionally, the server calls the second hash function: Calculate Here, t1 is used to represent the intermediate initial vector corresponding to the target data, which corresponds to the left λ bits, and t2 is used to represent the key corresponding to the target data, which corresponds to the right λ bits.

[0182] Embodiments of the present application derive an initial vector and a key of symmetric encryption for each data in the data set using the second sub-feedback parameter, and then encrypt the corresponding data using the key. If the query ID of the client is in the ID set corresponding to the server, then the intermediate parameter calculated by the server must be equal to r·PK, so the client can derive the target initial vector and the key corresponding to the query ID according to r·PK to decrypt the first ciphertext to obtain the query data corresponding to the query ID.

[0183] 5. Call a third hash function to hash the splicing result between the intermediate initial vector and the target ID to obtain an initial vector corresponding to the target data; wherein the third hash function is used to generate a second data space under a second security parameter, and the second security parameter is associated with the first security parameter.

[0184] Optionally, the initial vector corresponding to the target data can be expressed as: H3(t1||id j ), id jID is corresponding to the target data, and H3() is a third hash function.

[0185] 6. Encrypt the target data based on the key corresponding to the target data and the initial vector to obtain sub-ciphertext corresponding to the target data.

[0186] Optionally, the server uses a symmetric encryption algorithm to encrypt the target data based on the key corresponding to the target data to obtain sub-ciphertext corresponding to the target data.

[0187] The server uses the same method as described above to obtain sub-ciphertext corresponding to each data in the data set respectively.

[0188] 7. Generate second ciphertext based on the initial vector and the sub-ciphertext corresponding to each data in the data set respectively.

[0189] For each data, the server constructs a ciphertext pair in the form of an initial vector and a sub-ciphertext pair, and then generates second ciphertext based on multiple ciphertext pairs. Finally, the server sends the second ciphertext to the client.

[0190] In the embodiment of the present application, let Then C1=s·r·PK, If the client does not use the blinding parameter r, then at this time Since the server knows that the query ID matches, then s∈{s1,s2,...,s L}, when s=s j , which indicates that the query ID is equal to id j , thereby causing the query ID to be leaked. Therefore, in order to avoid the leakage of the query ID, the client must blind the above first value using the blinding parameter. For The server can only determine the probability that s is equal to s j is 1 / L, thereby making the query ID not be leaked.

[0191] In an exemplary embodiment, it has been measured that the anonymous query method provided by the embodiment of the present application can realize 1-10 and 1-100 online anonymous queries. Exemplarily, under CentOS Linux operating system, Intel Xeon(R), 6132, 2.50GHZ, 32G memory, the performance comparison of the anonymous query method provided by the embodiment of the present application and the BlindRSA-based anonymous query method under single-core single-thread is as shown in the following Table 1:

[0192] Table 1

[0193]

[0194]

[0195] As shown in Table 1, the technical solution provided by the embodiment of the present application increases the function that the client knows whether the query ID matches, thereby ensuring the economic benefits of the client. Meanwhile, the query efficiency of the embodiment of the present application is 1-1.5 times faster than that of the query based on BlindRSA anonymous query. In addition, since the technical solution provided by the embodiment of the present application adopts the ElGamal homomorphic encryption algorithm based on an elliptic curve, the performance is obviously better than that of the BlindRSA anonymous query method, and compared with the BlindRSA anonymous query method, the communication amount of the technical solution provided by the embodiment of the present application is reduced by about 4 times, and compared with the OPRF (Oblivious Pseudo Random Function, Oblivious Pseudo Random Function) based anonymous query method, the communication amount of the technical solution provided by the embodiment of the present application is reduced by about 1 times.

[0196] In one exemplary embodiment, since the online anonymous query is established on the basis of PSI (Private Set Intersection, private set intersection), in order to increase the function that the client knows whether the query ID matches, the PSI circuit can be electrified, and the query ID is taken as the output of the client and whether the query ID matches is taken as the output of the server, at this time, the GC (Garbled Circuits, garbled circuits) is used to execute the PSI, then the client obtains the random value matched with the query ID, and the server knows whether the query ID matches, finally the client converts the obtained random value into the anonymous query by using the symmetric encryption algorithm.

[0197] In summary, in the anonymous query process, the client first encrypts the generated first ciphertext based on the ID corresponding to the data set and the query ID, calculates the first feedback parameter for determining whether there is an ID matched with the query ID in the ID corresponding to the data set, and then the server determines whether there is an ID matched with the query ID in the ID corresponding to the data set based on the first feedback parameter, so that the server can actively perceive whether the query ID matches, without passively obtaining the information from the client, thereby improving the anti-risk ability of the server, and avoiding the risk that the client does evil to bring economic loss to the server.

[0198] In addition, the server generates the second ciphertext based on the data in the data set in the case that there is an ID matched with the query ID in the ID corresponding to the data set, and the client extracts the query data corresponding to the query ID from the second ciphertext according to the query ID, which realizes that the query ID and the data in the data set are not disclosed, thereby maintaining the security of the anonymous query.

[0199] In addition, the embodiment of the present application only needs to determine whether the product of the first sub-feedback parameter and the private key is equal to the second sub-feedback parameter, so as to determine whether the query ID matches, thereby reducing the determination workload and further improving the efficiency of the anonymous query, compared with determining whether the query ID matches by decoding the corresponding plaintext from the root-based first feedback parameter.

[0200] The following is an apparatus embodiment of the present application, which can be used to execute the method embodiments of the present application. For details not disclosed in the apparatus embodiments of the present application, refer to the method embodiments of the present application.

[0201] Please refer to Figure 7 , which shows a block diagram of an anonymous query apparatus provided by an embodiment of the present application. The apparatus has the functions of implementing the above method examples, which can be implemented by hardware or corresponding software executed by hardware. The apparatus can be the computer device introduced above or be arranged in the computer device. As Figure 7 shown, the apparatus 700 includes a request sending module 701, a ciphertext receiving module 702, a parameter calculation module 703, and a data extraction module 704.

[0202] The request sending module 701 is configured to send an anonymous query request to a server, wherein the server corresponds to a stored data set.

[0203] The ciphertext receiving module 702 is configured to receive first ciphertext from the server, wherein the first ciphertext is generated by encrypting an identity number ID corresponding to data in the data set.

[0204] The parameter calculation module 703 is configured to calculate a first feedback parameter based on a query ID and the first ciphertext, and send the first feedback parameter to the server, wherein the first feedback parameter is used to determine whether there is an ID matching the query ID in the ID corresponding to the data set.

[0205] The ciphertext receiving module 702 is further configured to receive second ciphertext from the server, wherein the second ciphertext is generated by encrypting data in the data set by the server in the case that there is an ID matching the query ID in the ID corresponding to the data set according to the first feedback parameter.

[0206] The data extraction module 704 is configured to extract query data corresponding to the query ID from the second ciphertext according to the query ID.

[0207] In some embodiments, the first ciphertext includes a plurality of encrypted coefficients, wherein the encrypted coefficients are obtained by encrypting coefficients of a zero polynomial constructed based on the ID corresponding to the data set.

[0208] As shown in Figure 8 The parameter calculation module 703 includes a polynomial construction submodule 703a, a value acquisition submodule 703b, and a parameter calculation submodule 703c.

[0209] The polynomial construction submodule 703a is configured to construct a zero polynomial after coefficient encryption according to the plurality of encrypted coefficients.

[0210] The value acquisition submodule 703b is configured to acquire a first value of the zero polynomial after coefficient encryption at the query ID.

[0211] The parameter calculation submodule 703c is configured to blind the first value by using a blinding parameter to obtain the first feedback parameter, wherein the blinding parameter is randomly selected from a plaintext space corresponding to the service end, and the plaintext space is constructed based on an ID corresponding to the data set by using a first hash function.

[0212] In some embodiments, the value acquisition submodule 703b is configured to:

[0213] invoke the first hash function to hash the query ID to obtain a first hash value corresponding to the query ID;

[0214] homomorphically calculate a value of the zero polynomial after coefficient encryption at the first hash value to obtain the first value.

[0215] In some embodiments, the encrypted coefficients are obtained by encrypting coefficients of the zero polynomial by using a homomorphic encryption algorithm, and the homomorphic encryption algorithm is correspondingly provided with a private key and a public key, the private key is selected from the plaintext space, and the public key is generated based on the private key; the parameter calculation submodule 703c is configured to:

[0216] generate a first sub-feedback parameter by using the blinding parameter, a first generator, and a value of a random polynomial at the query ID;

[0217] generate a second sub-feedback parameter based on the blinding parameter, the first value, a second generator, the public key, and a value of the random polynomial at the query ID;

[0218] obtain the first feedback parameter based on the first sub-feedback parameter and the second sub-feedback parameter;

[0219] wherein the first generator and the second generator are selected from the elliptic curve group, and the random polynomial is constructed based on a random parameter corresponding to the encrypted coefficients in an encryption process.

[0220] In some embodiments, the second ciphertext includes a plurality of ciphertext pairs, each ciphertext pair including an initial vector and a sub-ciphertext, the sub-ciphertext being ciphertext of encrypted data; the data extraction module 704 is configured to:

[0221] call a second hash function to hash a product between the public key corresponding to the server and the blinding parameter, to obtain a first intermediate parameter and a second intermediate parameter; wherein the second hash function is configured to obtain a first data space under a first security parameter based on an elliptic curve group corresponding to the server, the first intermediate parameter is configured to determine a target initial vector, and the second intermediate parameter is a key corresponding to the query ID;

[0222] call a third hash function to hash a splicing result between the first intermediate parameter and the query ID, to obtain a target initial vector corresponding to the query ID; wherein the third hash function is configured to generate a second data space under a second security parameter, and the second security parameter is associated with the first security parameter;

[0223] use the second intermediate parameter and the target initial vector to decrypt the sub-ciphertext corresponding to the target initial vector, to obtain the query data corresponding to the query ID.

[0224] In summary, the technical scheme provided by the embodiments of the present application, in the process of anonymous query, the client first calculates a first feedback parameter for determining whether there is an ID matching the query ID in the ID corresponding to the data set based on the first ciphertext generated by encrypting the ID corresponding to the data set and the query ID, and then the server determines whether there is an ID matching the query ID in the ID corresponding to the data set based on the first feedback parameter, so that the server can actively perceive whether the query ID is matched, without passively obtaining this information from the client, thereby improving the anti-risk ability of the server, and avoiding the risk of economic loss to the server caused by the evil of the client.

[0225] In addition, the server generates a second ciphertext based on the data in the data set in the case that there is an ID matching the query ID in the ID corresponding to the data set, and the client extracts the query data corresponding to the query ID from the second ciphertext according to the query ID, which realizes that the query ID and the data in the data set are not disclosed, thereby maintaining the security of anonymous query.

[0226] Please refer to Figure 9 which shows a block diagram of an anonymous query device provided by another embodiment of the present application. The device has the functions of implementing the above-mentioned method examples, which can be implemented by hardware or corresponding software executed by hardware. The device can be the computer device introduced above, or can be arranged in the computer device. As Figure 9As shown, the apparatus 900 includes a ciphertext generation module 901 and a parameter receiving module 902.

[0227] The ciphertext generation module 901 is configured to, in response to receiving an anonymous query request from a client, generate first ciphertext based on identity identification numbers (IDs) corresponding to data in a data set, and send the first ciphertext to the client.

[0228] The parameter receiving module 902 is configured to receive a first feedback parameter from the client, the first feedback parameter being generated by the client based on a query ID and the first ciphertext, and the first feedback parameter being used to determine whether there is an ID matching the query ID in the IDs corresponding to the data set.

[0229] The ciphertext generation module 901 is further configured to, in a case where the first feedback parameter satisfies a first condition, encrypt data in the data set to generate second ciphertext, and send the second ciphertext to the client; wherein the first condition is used to indicate that there is an ID matching the query ID in the IDs corresponding to the data set.

[0230] In some embodiments, as Figure 10 As shown, the ciphertext generation module 901 includes a hash value obtaining sub-module 901a, a polynomial construction sub-module 901b, a coefficient encryption sub-module 901c, and a ciphertext generation sub-module 901d.

[0231] The hash value obtaining sub-module 901a is configured to call a first hash function to hash the IDs corresponding to the data set to obtain hash values corresponding to the data set; wherein the first hash function is used to generate a plaintext space corresponding to the server.

[0232] The polynomial construction sub-module 901b is configured to construct a zero polynomial based on the hash values corresponding to the data set.

[0233] The coefficient encryption sub-module 901c is configured to encrypt coefficients of the zero polynomial to obtain encrypted coefficients.

[0234] The ciphertext generation sub-module 901d is configured to generate the first ciphertext based on the encrypted coefficients.

[0235] In some embodiments, the coefficient encryption sub-module 901c is configured to:

[0236] For a target coefficient corresponding to the zero polynomial, randomly obtain a target random parameter corresponding to the target coefficient from the plaintext space;

[0237] Obtain a first product between the target random parameter and a first generator;

[0238] obtaining a second product between the public key of the server and the target random parameter;

[0239] obtaining a third product between the target coefficient and the second generator;

[0240] summing the second product and the third product to obtain a first sum value;

[0241] obtaining the encrypted coefficient corresponding to the target coefficient based on the first product and the second sum value;

[0242] The first generator and the second generator are selected from an elliptic curve group corresponding to the server, the public key of the server is generated based on a private key of the server, and the private key is selected from the plaintext space.

[0243] In some embodiments, the first feedback parameter includes a first sub-feedback parameter and a second sub-feedback parameter, the first sub-feedback parameter is generated based on a blinded parameter, a first generator and a value of a random polynomial at the query ID, the second sub-feedback parameter is generated based on the blinded parameter, a first value, a second generator, a public key of the server and a value of the random polynomial at the query ID, the blinded parameter is randomly selected from the plaintext space, the first value refers to a value of a zero polynomial encrypted by a coefficient at the query ID, the zero polynomial encrypted by the coefficient is constructed by an encrypted coefficient corresponding to the first ciphertext, and the random polynomial is constructed based on a random parameter corresponding to the encrypted coefficient in the encryption process; the ciphertext generation submodule 901d is configured to:

[0244] For target data in the data set, a first hash function corresponding to the server is called to hash a target ID corresponding to the target data to obtain a target hash value corresponding to the target data;

[0245] obtaining a target value of the random polynomial at the target hash value;

[0246] generating a target intermediate parameter according to the target value and the second sub-feedback parameter;

[0247] a second hash function is called to hash the target intermediate parameter to obtain an intermediate initial vector and a key corresponding to the target data; wherein the second hash function is used to obtain a first data space under a first security parameter based on an elliptic curve group corresponding to the server;

[0248] calling a third hash function to hash a splicing result between the intermediate initial vector and the target ID, to obtain an initial vector corresponding to the target data; wherein the third hash function is used to generate a second data space under a second security parameter, and the second security parameter is associated with the first security parameter;

[0249] encrypting the target data according to the key and the initial vector corresponding to the target data, to obtain sub-ciphertext corresponding to the target data;

[0250] generating the second ciphertext based on the initial vector and the sub-ciphertext corresponding to each data in the data set respectively.

[0251] In some embodiments, the first condition is that a product of a first sub-feedback parameter in the first feedback parameter and a private key of the server is equal to a second sub-feedback parameter in the first feedback parameter.

[0252] Alternatively, the first plaintext corresponding to the first feedback parameter is 0.

[0253] In summary, the technical scheme provided by the embodiments of the present application, in the process of anonymous query, the client first calculates the first feedback parameter for determining whether there is an ID matching the query ID in the ID corresponding to the data set based on the first ciphertext generated by encrypting the data set corresponding ID and the query ID, and then the server determines whether there is an ID matching the query ID in the ID corresponding to the data set based on the first feedback parameter, so that the server can actively perceive whether the query ID matches, without passively obtaining this information from the client, thereby improving the anti-risk ability of the server, and avoiding the risk of economic loss to the server caused by the evil of the client.

[0254] In addition, the server generates the second ciphertext based on the data encryption in the data set when it is determined that there is an ID matching the query ID in the ID corresponding to the data set, and the client extracts the query data corresponding to the query ID from the second ciphertext according to the query ID, which realizes that the query ID and the data in the data set are not disclosed, thereby maintaining the security of anonymous query.

[0255] It should be noted that the device provided in the above embodiments, in realizing its functions, only divides the above-mentioned functional modules as an example, and in actual application, the above-mentioned functions can be completed by different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the device and method embodiments provided in the above embodiments belong to the same concept, and the specific implementation process is described in detail in the method embodiments, which will not be repeated here.

[0256] Please refer to Figure 11Fig. 1 shows a structural schematic diagram of a computer device provided by an embodiment of the present application. The computer device can be any electronic device with data computing, processing and storage functions, and can be used to implement the anonymous query method provided in the above embodiments. Specifically, it can include the following contents.

[0257] The computer device 1100 includes a central processing unit (such as CPU (Central Processing Unit), GPU (Graphics Processing Unit) and FPGA (Field Programmable Gate Array)) 1101, a system memory 1104 including a RAM (Random-Access Memory) 1102 and a ROM (Read-Only Memory) 1103, and a system bus 1105 connecting the system memory 1104 and the central processing unit 1101. The computer device 1100 also includes a basic input / output system (I / O system) 1106 to help transfer information between various devices within the server, and a mass storage device 1107 for storing an operating system 1113, application programs 1114 and other program modules 1115.

[0258] In some embodiments, the basic input / output system 1106 includes a display 1108 for displaying information and an input device 1109 such as a mouse, keyboard, etc. for user input information. The display 1108 and the input device 1109 are both connected to the central processing unit 1101 through the input / output controller 1110 connected to the system bus 1105. The basic input / output system 1106 can also include an input / output controller 1110 for receiving and processing input from a keyboard, mouse, or electronic stylus, and other devices. Similarly, the input / output controller 1110 also provides output to a display screen, printer, or other types of output devices.

[0259] The mass storage device 1107 is connected to the central processing unit 1101 through a mass storage controller (not shown) connected to the system bus 1105. The mass storage device 1107 and its associated computer readable medium provide non-volatile storage for the computer device 1100. That is, the mass storage device 1107 can include a computer readable medium (not shown) such as a hard disk or a CD-ROM (Compact Disc Read-Only Memory) drive.

[0260] Without loss of generality, the computer readable medium can include computer storage media and communication media. Computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Computer storage media includes RAM, ROM, EPROM (Erasable Programmable Read-Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), flash memory or other solid state memory technology, CD-ROM, DVD (Digital Video Disc), or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices. It should be understood by those skilled in the art that computer storage media does not limit to the above-mentioned several types. The system memory 1104 and the mass storage device 1107 mentioned above can be collectively referred to as memory.

[0261] According to the embodiments of the present application, the computer device 1100 can also be connected to a remote computer on a network through a network such as the Internet. That is, the computer device 1100 can be connected to a network 1112 through a network interface unit 1111 connected to the system bus 1105, or can be connected to other types of networks or remote computer systems (not shown) using the network interface unit 1111.

[0262] The memory further includes a computer program stored in the memory and configured to be executed by one or more processors to implement the above-mentioned anonymous query method.

[0263] In some embodiments, a computer readable storage medium is also provided, and the storage medium stores a computer program which, when executed by a processor, implements the above-mentioned anonymous query method.

[0264] Optionally, the computer readable storage medium can include ROM (Read-Only Memory), RAM (Random-Access Memory), SSD (Solid State Drives) or optical disk, etc. Among them, the random access memory can include ReRAM (Resistance Random Access Memory) and DRAM (Dynamic Random Access Memory).

[0265] In some embodiments, a computer program product or computer program is also provided, which includes computer instructions stored in a computer readable storage medium. A processor of a computer device reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions, so that the computer device performs the above-mentioned method for querying anonymously.

[0266] It should be noted that the information (including but not limited to object device information, object personal information, etc.), data (including but not limited to data for analysis, stored data, displayed data, etc.) and signals involved in the present application are all authorized by the object or fully authorized by all parties, and the collection, use and processing of related data need to comply with relevant laws, regulations and standards of relevant countries and regions. For example, the query ID, data set and the like involved in the present application are obtained under sufficient authorization.

[0267] It should be understood that "multiple" mentioned in the present application refers to two or more. "And / or" describes the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B can represent the following three cases: A exists alone, A and B exist together, and B exists alone. The character " / " generally represents that the associated objects before and after it are in an "or" relationship. In addition, the step numbers described in the present application only exemplarily show a possible execution order between steps, and in some other embodiments, the above steps can also be executed in a sequence different from the number, such as two steps with different numbers are executed at the same time, or two steps with different numbers are executed in an order opposite to the illustration, and the embodiments of the present application do not limit this.

[0268] The above only describes exemplary embodiments of the present application, and is not intended to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A hidden query method, characterized in that, The method comprises: sending an anonymous query request to a service end, wherein the service end corresponds to a stored data set; receiving a first ciphertext from the service end, the first ciphertext being generated by encrypting an identity identifier ID corresponding to data in the data set, the first ciphertext comprising a plurality of encrypted coefficients, the encrypted coefficients being obtained by encrypting coefficients of a zero polynomial constructed based on the ID corresponding to the data set using a homomorphic encryption algorithm, the homomorphic encryption algorithm corresponding to a private key and a public key, the private key being selected from a plaintext space, the public key being generated based on the private key, and the plaintext space being constructed based on the ID corresponding to the data set by a first hash function; constructing a zero polynomial with encrypted coefficients based on the plurality of encrypted coefficients; obtaining a first value of the zero polynomial with encrypted coefficients at a query ID; generating a first sub-feedback parameter using a blinding parameter, a first generator, and a value of a random polynomial at the query ID, the blinding parameter being randomly selected from the plaintext space, and the random polynomial being constructed based on a random parameter corresponding to the encrypted coefficients in the encryption process; generating a second sub-feedback parameter based on the blinding parameter, the first value, a second generator, the public key, and a value of the random polynomial at the query ID, the first generator and the second generator being selected from an elliptic curve group; obtaining a first feedback parameter based on the first sub-feedback parameter and the second sub-feedback parameter, and sending the first feedback parameter to the service end, wherein the first feedback parameter is used to determine whether there is an ID matching the query ID in the ID corresponding to the data set; receiving a second ciphertext from the service end, the second ciphertext being generated by encrypting data in the data set by the service end in the case that there is an ID matching the query ID in the ID corresponding to the data set according to the first feedback parameter; extracting query data corresponding to the query ID from the second ciphertext according to the query ID.

2. The method of claim 1, wherein, The obtaining of the first value of the zero polynomial with encrypted coefficients at the query ID comprises: hashing the query ID using the first hash function to obtain a first hash value corresponding to the query ID; homomorphically calculating a value of the zero polynomial with encrypted coefficients at the first hash value to obtain the first value.

3. The method of claim 1, wherein, The second ciphertext comprises a plurality of ciphertext pairs, each ciphertext pair comprising an initial vector and a sub-ciphertext, and the sub-ciphertext being ciphertext after data encryption; The extracting of the query data corresponding to the query ID from the second ciphertext according to the query ID comprises: calling a second hash function to hash a product between the public key corresponding to the server and the blinding parameter, to obtain a first intermediate parameter and a second intermediate parameter; wherein the second hash function is used to obtain a first data space under a first security parameter based on an elliptic curve group corresponding to the server, the first intermediate parameter is used to determine a target initial vector, and the second intermediate parameter is a key corresponding to the query ID; calling a third hash function to hash a splicing result between the first intermediate parameter and the query ID, to obtain a target initial vector corresponding to the query ID; wherein the third hash function is used to generate a second data space under a second security parameter, and the second security parameter is associated with the first security parameter; using the second intermediate parameter and the target initial vector, the sub-ciphertext corresponding to the target initial vector is decrypted to obtain the query data corresponding to the query ID.

4. A method for obfuscating a query, the method comprising: The method comprises: In response to receiving an anonymous query request from a client, a first ciphertext is generated based on the identity identifier ID corresponding to the data in the data set, and the first ciphertext is sent to the client, the first ciphertext comprising a plurality of encrypted coefficients, the encrypted coefficients being obtained by encrypting the coefficients of a zero polynomial constructed based on the ID corresponding to the data set using a homomorphic encryption algorithm, the homomorphic encryption algorithm being provided with a private key and a public key, the private key being selected from a plaintext space, the public key being generated based on the private key, and the plaintext space being constructed based on the ID corresponding to the data set by a first hash function; Receiving a first feedback parameter from the client, the first feedback parameter being generated by the client based on a query ID and the first ciphertext, the first feedback parameter being used to determine whether there is an ID matching the query ID in the ID corresponding to the data set, the first feedback parameter comprising a first sub-feedback parameter and a second sub-feedback parameter, the first sub-feedback parameter being generated based on a blinding parameter, a first generator and a random polynomial at the query ID, the second sub-feedback parameter being generated based on the blinding parameter, a first value, a second generator, the public key and the random polynomial at the query ID, the blinding parameter being randomly selected from the plaintext space, the first value being the value of the encrypted zero polynomial at the query ID, the encrypted zero polynomial being constructed by the plurality of encrypted coefficients, the random polynomial being constructed based on the random parameter corresponding to the encrypted coefficients in the encryption process, and the first generator and the second generator being selected from an elliptic curve group; In the case that the first feedback parameter satisfies the first condition, the data in the data set is encrypted to generate a second ciphertext, and the second ciphertext is sent to the client; wherein the first condition is used to indicate that there is an ID matching the query ID in the ID corresponding to the data set.

5. The method of claim 4, wherein, The first ciphertext is generated by encrypting an identity ID corresponding to data in the data set, and the method comprises the following steps: The first hash function is called to hash the ID corresponding to the data set to obtain a hash value corresponding to the data set; The zero polynomial is constructed based on the hash value corresponding to the data set; The coefficients of the zero polynomial are encrypted to obtain the encrypted coefficients; The first ciphertext is generated based on the encrypted coefficients.

6. The method of claim 5, wherein, The coefficients of the zero polynomial are encrypted to obtain the encrypted coefficients, and the method comprises the following steps: A target random parameter corresponding to a target coefficient of the zero polynomial is randomly obtained from the plaintext space; A first product between the target random parameter and the first generator is obtained; A second product between the public key and the target random parameter is obtained; A third product between the target coefficient and the second generator is obtained; The second product and the third product are summed to obtain a first sum value; The encrypted coefficient corresponding to the target coefficient is obtained based on the first product and the first sum value.

7. The method of claim 4, wherein, The data in the data set is encrypted to generate a second ciphertext, and the method comprises the following steps: For target data in the data set, the first hash function is called to hash a target ID corresponding to the target data to obtain a target hash value corresponding to the target data; A target value of the random polynomial at the target hash value is obtained; A target intermediate parameter is generated according to the target value and the second sub feedback parameter; A second hash function is called to hash the target intermediate parameter to obtain an intermediate initial vector and a key corresponding to the target data; wherein the second hash function is used to obtain a first data space under a first security parameter based on the elliptic curve group; A third hash function is called to hash a splicing result between the intermediate initial vector and the target ID to obtain an initial vector corresponding to the target data; wherein the third hash function is used to generate a second data space under a second security parameter, and the second security parameter is associated with the first security parameter; The target data is encrypted according to the key and the initial vector corresponding to the target data to obtain a sub ciphertext corresponding to the target data; The second ciphertext is generated based on the initial vectors and the sub ciphertexts corresponding to each data in the data set.

8. The method of any one of claims 4 to 7, wherein the first condition is that the product of the first sub feedback parameter and the private key is equal to the second sub feedback parameter; or the first plaintext corresponding to the first feedback parameter is 0. The device comprises: A request sending module configured to send an anonymous query request to a server; wherein the server stores a data set. ​ 9. A concealed query device, characterized in that, ​ ​ The ciphertext receiving module is configured to receive first ciphertext from the server, the first ciphertext being generated by encrypting an identity ID corresponding to data in the data set, the first ciphertext comprising a plurality of encrypted coefficients, the encrypted coefficients being obtained by encrypting coefficients of a zero polynomial constructed based on the ID corresponding to the data set by using a homomorphic encryption algorithm, the homomorphic encryption algorithm being configured to have a private key and a public key, the private key being selected from a plaintext space, the public key being generated based on the private key, the plaintext space being constructed based on the ID corresponding to the data set by using a first hash function; The parameter calculating module is configured to construct a zero polynomial with encrypted coefficients based on the plurality of encrypted coefficients, obtain a first value of the zero polynomial with encrypted coefficients at a query ID, generate a first sub-feedback parameter by using a blinding parameter, a first generator, and a value of a random polynomial at the query ID, the blinding parameter being randomly selected from the plaintext space, the random polynomial being constructed based on random parameters corresponding to the encrypted coefficients in an encryption process, generate a second sub-feedback parameter based on the blinding parameter, the first value, a second generator, the public key, and a value of the random polynomial at the query ID, the first generator and the second generator being selected from an elliptic curve group, obtain a first feedback parameter based on the first sub-feedback parameter and the second sub-feedback parameter, and send the first feedback parameter to the server, wherein the first feedback parameter is used to determine whether there is an ID matching the query ID in the ID corresponding to the data set; The ciphertext receiving module is further configured to receive second ciphertext from the server, the second ciphertext being generated by encrypting data in the data set by the server in a case where it is determined that there is an ID matching the query ID in the ID corresponding to the data set based on the first feedback parameter; The data extracting module is configured to extract query data corresponding to the query ID from the second ciphertext based on the query ID.

10. A concealed query device, characterized in that, The apparatus comprises: The ciphertext generating module is configured to generate first ciphertext by encrypting an identity ID corresponding to data in a data set in response to receiving an anonymous query request from a client, and send the first ciphertext to the client, the first ciphertext comprising a plurality of encrypted coefficients, the encrypted coefficients being obtained by encrypting coefficients of a zero polynomial constructed based on the ID corresponding to the data set by using a homomorphic encryption algorithm, the homomorphic encryption algorithm being configured to have a private key and a public key, the private key being selected from a plaintext space, the public key being generated based on the private key, the plaintext space being constructed based on the ID corresponding to the data set by using a first hash function; The parameter receiving module is configured to receive a first feedback parameter from the client, the first feedback parameter being generated by the client based on a query ID and the first ciphertext, the first feedback parameter being used to determine whether there is an ID matching the query ID in the IDs corresponding to the data set, the first feedback parameter comprising a first sub-feedback parameter and a second sub-feedback parameter, the first sub-feedback parameter being generated based on a blinding parameter, a first generator, and a value of a random polynomial at the query ID, the second sub-feedback parameter being generated based on the blinding parameter, a first value, a second generator, the public key, and a value of the random polynomial at the query ID, the blinding parameter being randomly selected from the plaintext space, the first value being a value of a zero polynomial after coefficient encryption at the query ID, the zero polynomial after coefficient encryption being constructed from the plurality of encrypted coefficients, the random polynomial being constructed based on random parameters corresponding to the encrypted coefficients in the encryption process, the first generator and the second generator being selected from an elliptic curve group. The ciphertext generating module is further configured to, in a case where the first feedback parameter satisfies a first condition, encrypt data in the data set to generate a second ciphertext, and send the second ciphertext to the client, wherein the first condition is used to indicate that there is an ID matching the query ID in the IDs corresponding to the data set.

11. A computer device, comprising: The computer device comprises a processor and a memory, and the memory stores a computer program, the computer program is loaded and executed by the processor to implement the anonymous query method according to any one of claims 1 to 3, or implement the anonymous query method according to any one of claims 4 to 8.

12. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program is loaded and executed by the processor to implement the anonymous query method according to any one of claims 1 to 3, or implement the anonymous query method according to any one of claims 4 to 8.

13. A computer program product, characterised in that, The computer program product comprises computer instructions, and the computer instructions are executed by the processor to implement the anonymous query method according to any one of claims 1 to 3, or implement the anonymous query method according to any one of claims 4 to 8.

Images