A privacy information retrieval method and device against Byzantine server attacks

Abstract

The present invention discloses a method for retrieving private information that is resistant to Byzantine server attacks. The method comprises: a first client receives and encodes information, stores the encoded data on multiple servers, creates a reversible matrix, a check matrix, a full-rank matrix, a third encoding matrix, and a hash function, and discloses the information to a second client; the second client constructs and sends a query request to the server based on the query index; recovers the server-stored data based on the query response fed back by the server; performs a comprehensive check on the recovered data, and determines the presence of Byzantine servers based on the check result; and uses different data recovery strategies based on the presence of different Byzantine servers to recover and decode the data and obtain the query result. The method can resist multiple complicit servers without requiring multiple rounds of queries.

Description

Technical Field

[0001] The present invention belongs to the field of information retrieval, and in particular relates to a privacy information retrieval method and device that is resistant to Byzantine server attacks. Background Art

[0002] With the rapid development and widespread use of the internet, people are increasingly relying on search engines and other information retrieval systems to obtain the information they need. While these systems provide convenience, they also collect and process large amounts of user personal data, such as search history, browsing history, and location information. The leakage of user personal data may infringe on user privacy and even be used for illegal activities. Against this backdrop, private information retrieval has emerged. It allows users to retrieve desired files from databases while ensuring that the index values of the retrieved files are not leaked to the server. Private information retrieval includes single-server private information retrieval and multi-server private information retrieval. Compared to single-server private information retrieval solutions, multi-server private information retrieval solutions are more efficient and guarantee absolute security. However, these servers may collude or maliciously provide erroneous query results. In other words, these servers may contain Byzantine servers, which can leak user query privacy or prevent users from retrieving correct information.

[0003] Therefore, in order to protect the user's query privacy and ensure that the user can retrieve the correct information, a private information retrieval solution that can resist Byzantine servers is urgently needed. Summary of the Invention

[0004] In order to solve the above problems existing in the prior art, the present invention provides a privacy information retrieval method that is resistant to Byzantine server attacks.

[0005] The technical problem to be solved by the present invention is achieved through the following technical solutions:

[0006] A private information retrieval method resistant to Byzantine server attacks, comprising:

[0007] The first client receives information uploaded by the information holder and encodes the information using a reversible matrix to obtain a first encoding matrix; stores each row of data in the first encoding matrix on multiple servers; uses a hash function to calculate the hash value of each element in the first encoding matrix to obtain a check matrix; encodes the first encoding matrix using a full-rank matrix to obtain a second encoding matrix; extracts any row from the second encoding matrix and saves it, and the remaining rows constitute a third encoding matrix; and discloses the reversible matrix, the check matrix, the full-rank matrix, the third encoding matrix, and the hash function to the second client;

[0008] The second client constructs and sends query requests with the query index i masked to the multiple servers according to the query index i and different random quantities, so that each server feeds back a query response according to the received query request and the row data of the first coding matrix stored in the server;

[0009] The second client recovers the i-th bit of data in the row data stored by each server based on the random number used when constructing the query request for each server and the query response fed back by the server; performs a comprehensive check on the recovered data using a check matrix and a hash function, and determines the presence of Byzantine servers among the multiple servers based on the check result;

[0010] The second client uses different data recovery strategies based on the different existence situations of Byzantine servers to recover the i-th column data of the first coding matrix, and decodes the column data using the inverse of the reversible matrix to obtain the query result; among them, some data recovery strategies require the assistance of the full-rank matrix and the third coding matrix.

[0011] In one embodiment, when there is no Byzantine server among the multiple servers, the data recovery strategy of the second client includes: forming the i-th column data of the first coding matrix with the i-th bit data of all the recovered servers.

[0012] In one embodiment, when some of the multiple servers are Byzantine servers, the data recovery strategy of the second client includes:

[0013] With the assistance of the full-rank matrix and the third encoding matrix, the i-th data of each Byzantine server is restored based on the i-th data of each non-Byzantine server. The i-th data of each server is then combined into the i-th column data of the first encoding matrix.

[0014] In one embodiment, when the multiple servers are all Byzantine servers, the data recovery strategy of the second client includes:

[0015] Obtaining retained data from the first client; the retained data is the i-th bit in a row of data of the second coding matrix stored by the first client;

[0016] With the assistance of the full-rank matrix and the third coding matrix, based on the retained data, the i-th data of all servers is restored by constructing and solving a set of linear equations to obtain the i-th column data of the first coding matrix.

[0017] In one embodiment, the second client constructs and sends query requests with the query index i masked to the multiple servers according to the query index i and different random quantities, including:

[0018]

[0019]

[0020]

[0021] in, represents the query request constructed for the j∈[1,n]th server, n is the total number of servers, r=[r1,…,r i ,…,r m ] is a random quantity of length m, m is the maximum index value, α and β are both random numbers; e i are standard basis vectors of length m.

[0022] In one embodiment, the server feeds back a query response based on the received query request and the row data of the first coding matrix stored in the server, including:

[0023]

[0024]

[0025]

[0026] in, represents the query response of the jth server, y j is the row data of the first encoding matrix stored in the j-th server, and <·> represents the inner product.

[0027] In one embodiment, the second client recovers the i-th bit of data in the row data stored by the server according to the random amount used when constructing the query request for each server and the query response fed back by the server, including: calculating Represents the recovered y j The i-th data.

[0028] In one embodiment, the method is applied to a client device;

[0029] The first client and the second client are two different user modules of the client device respectively;

[0030] The first user of the client device logs into the client device using the first client, and the second user of the client device logs into the client device using the second client.

[0031] The present invention also provides a privacy information retrieval device that is resistant to Byzantine server attacks, comprising:

[0032] The first user module is configured to receive information uploaded by the first user, encode the information using a reversible matrix to obtain a first encoding matrix; store each row of data in the first encoding matrix to multiple servers; calculate the hash value of each element in the first encoding matrix using a hash function to obtain a check matrix; encode the first encoding matrix using a full-rank matrix to obtain a second encoding matrix; extract any row from the second encoding matrix and save it, with the remaining rows forming a third encoding matrix; and save the reversible matrix, the check matrix, the full-rank matrix, the third encoding matrix, and the hash function;

[0033] The second user module is used to construct and send query requests with the query index i masked for the multiple servers based on the query index i sent by the second user and different random quantities, so that each server feeds back a query response based on the received query request and the row data of the first coding matrix stored by itself; recover the i-th bit of data in the row data stored by the server based on the random quantity used when constructing the query request for each server and the query response fed back by the server; use the check matrix and hash function to perform an overall check on the recovered data, and determine the existence of Byzantine servers in the multiple servers based on the check result; use different data recovery strategies based on the different existence situations of the Byzantine servers to recover the i-th column data of the first coding matrix, and use the inverse of the reversible matrix to decode the column data to obtain the query result; wherein, some data recovery strategies require the assistance of the full rank matrix and the third coding matrix.

[0034] In one embodiment, the apparatus is applied to a client device.

[0035] The privacy information retrieval method for resisting Byzantine server attacks provided by the present invention can effectively identify Byzantine servers and can use different data recovery strategies to recover encoded data according to the existence of Byzantine servers. Even if all servers are Byzantine servers, it can ensure that the retrieval is correct, effectively protect the user's query privacy, and ensure that the user can retrieve the correct information. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 This is a flow chart of a privacy information retrieval method for resisting Byzantine server attacks provided by an embodiment of the present invention;

[0037] Figure 2 yes Figure 1 a schematic diagram of the interactions between the parties involved in the illustrated method;

[0038] Figure 3 2 shows the simulation data of the embodiment of the present invention. DETAILED DESCRIPTION

[0039] The present invention will be further described in detail below with reference to specific examples, but the embodiments of the present invention are not limited thereto.

[0040] In order to solve the technical problems raised in the background technology, the embodiments of the present invention provide a privacy information retrieval method and device that are resistant to Byzantine server attacks.

[0041] First, a privacy information retrieval method for resisting Byzantine server attacks provided by an embodiment of the present invention is described in detail. Figure 1 A flow chart showing the method is shown, Figure 2 A schematic diagram showing the interaction between the various parties involved in the method is shown.

[0042] See also Figure 1 and Figure 2 As shown, the privacy information retrieval method against Byzantine server attacks provided by an embodiment of the present invention includes the following steps:

[0043] S10: The first client receives the information uploaded by the information holder, and uses a reversible matrix to encode the information to obtain a first coding matrix; stores each row of data in the first coding matrix to n servers respectively; uses a hash function to calculate the hash value of each element in the first coding matrix to obtain a check matrix; uses a full-rank matrix to encode the first coding matrix to obtain a second coding matrix; extracts any row from the second coding matrix and saves it, and the remaining rows constitute a third coding matrix; discloses the reversible matrix, the check matrix, the full-rank matrix, the third coding matrix and the hash function to the second client.

[0044] Specifically, assuming that the information to be uploaded by the information holder is a file system, represented by X = [f 1 ,…,f m ];in, f i represents the i∈[1,m]th file, where m is the number of files and l is the file length. The first client encodes X using the n×l-dimensional reversible matrix V to obtain the first encoding matrix Y=VX:

[0045]

[0046] Then, the first client stores Y on n servers (n is the total number of servers), each server stores a row of data of Y, that is, server j stores y j ; Use the hash function h(x) to calculate the hash value for each element in Y and obtain the check matrix H:

[0047]

[0048] The first client generates an n×n full-rank matrix B, also called a reconstruction matrix, and uses B to encode Y to obtain an n×m second encoding matrix S=BY. This operation is equivalent to generating n linearly independent combinations for each column of Y. This ensures that the second client can still recover the correct data when it receives the query response from the Byzantine server. The second encoding matrix is formed as follows:

[0049]

[0050] The second client randomly selects a row of data from S and saves it, which is recorded as k∈[1,n], the remaining rows form the third encoding matrix S′ with dimension (n-1)×m:

[0051]

[0052] Then, the second client discloses V, H, B, S', and h(x) to the second client.

[0053] S20: The second client constructs and sends query requests with the query index i masked to n servers according to the query index i and different random quantities, so that each server feeds back a query response according to the received query request and the row data of the first coding matrix stored in itself.

[0054] Specifically, the query index is submitted by the user to the second client and is the index number of the information the user wants to search for. In practice, the user may submit a keyword to the second client, and the second client identifies the index of the information the user wants to search for based on the keyword. This operation is not the key point of the present invention and reference is made to the relevant prior art.

[0055] The second client constructs query requests for n servers respectively based on the query index i and different random quantities, each of which masks the query index, including:

[0056]

[0057]

[0058]

[0059] in, represents the query request constructed for the j∈[1,n]th server, [r1,…,r i ,…,r m ] is a random quantity of length m, m is the maximum index value, when the information uploaded by the information holder is a file system, m is the number of files; α and β are both random numbers; e iis a standard basis vector of length m, which has a value of 1 only at position i and 0 at all other positions.

[0060] It can be seen that due to They are all uniformly random and independent of the query index i, which is equivalent to masking the query index i in the query request. Therefore, the server will not obtain any information about the query index i from the received query request, effectively protecting the user's query privacy.

[0061] After receiving the query request, the server feeds back a query response based on the received query request and the row data of the first coding matrix stored in the server, including:

[0062]

[0063]

[0064]

[0065] in, represents the query response of the jth server, y j is the row data of the first encoding matrix stored on the j-th server, and <·> represents the inner product. The specific calculation process is as follows:

[0066]

[0067]

[0068] S30: The second client recovers the i-th bit of data in the row data stored by the server based on the random amount used when constructing the query request for each server and the query response fed back by the server; uses the check matrix and hash function to perform a comprehensive check on the recovered data, and determines the existence of Byzantine servers among the n servers based on the check result.

[0069] Specifically, the second client calculates for each server Represents the y of the restored j-th server j Then, the i-th data of all restored servers are summarized to obtain Then the y i Each element in the matrix H is hashed using the hash function h(x) and the hash values are compared with the i-th column data h i If the values of the same position in the two vectors are different, it means that the server with the corresponding index is a Byzantine server, and the existence of Byzantine servers is obtained.

[0070] S40: According to different existence situations of the Byzantine servers, the second client restores the data of the i-th column of the first encoding matrix by using different data restoration strategies, and decodes this column of data by using the inverse of the invertible matrix to obtain the query result; among them, some data restoration strategies require the assistance of a full-rank matrix and a third encoding matrix.

[0071] Specifically, when there are no Byzantine servers among the n servers, the data restoration strategy of the second client includes: the data of the i-th bit of all the restored servers form the data of the i-th column of the first encoding matrix.

[0072] It can be understood that if there are no Byzantine servers, then the y aggregated in step S30 i is the data of the i-th column of the first encoding matrix.

[0073] When some of the multiple servers are Byzantine servers, the data restoration strategy of the second client includes: with the assistance of a full-rank matrix and a third encoding matrix, according to the data of the i-th bit of each non-Byzantine server restored, the method of constructing and solving a system of linear equations is used to restore the data of the i-th bit of each Byzantine server again, and then the data of the i-th bit of all the servers form the data of the i-th column of the first encoding matrix.

[0074] Specifically, assume that there are b Byzantine servers among the n servers, b < n; the indices of these b Byzantine servers are E = [e1,..,e b , and the indices of the non-Byzantine servers (also called honest servers) are C = [c1,…c n-b . The second client selects the column S′ of the query index i from the third encoding matrix S′ i , and constructs the matrix Here, is the submatrix obtained by removing the k-th row from the full-rank matrix B; randomly select b rows from the matrix to obtain the matrix [[ID=2​​​​​​​​​​​​​​​​​​Extract the elements of the corresponding column to form a column vector And construct the matrix Among them, non-Byzantine servers is recovered in step S30, yes Then, the second client calculates To restore the i-th data of each Byzantine server; here, the calculated Z includes the i-th data of each Byzantine server that has been restored, and they are aggregated with the i-th data of each non-Byzantine server restored in step S30 to obtain the i-th column data of the first coding matrix.

[0076] When all n servers are Byzantine servers, the data recovery strategy for the second client includes:

[0077] (1) Obtaining retained data from the first client; the retained data is the i-th bit in a row of data of the second coding matrix stored by the first client;

[0078] (2) With the assistance of the full-rank matrix and the third coding matrix, based on the retained data, the i-th data of all servers is restored by constructing and solving a set of linear equations to obtain the i-th column data of the first coding matrix.

[0079] Specifically, the second client and the first client transmit the i-th bit of a row of data of the second coding matrix stored by the first client to the second client by executing the m-choose-1 oblivious transfer protocol. in Transmit to the second client; the second client transmits With the above S′ i Combined into Referring to the second encoding matrix formation expression S=BY, we can know that By i =s i , where y i is the i-th column data of the first encoding matrix Y. For the second client, y i is an unknown number, and B and s i are all known numbers, so according to the formula By i =s i You can construct n linear equations, and by solving the linear equations, you can solve y i , thus recovering the i-th bit data of all servers and obtaining the i-th column data of the first encoding matrix. This process is calculated in matrix form as follows:

[0080]

[0081] After the second client recovers the i-th column data of the first encoding matrix, it decodes the column data using the inverse of the reversible matrix, that is, calculates You can get the file f with index i that the user wants to query i .

[0082] In summary, the privacy information retrieval method against Byzantine server attacks provided by the embodiment of the present invention can effectively identify Byzantine servers and can recover the encoded data using different data recovery strategies based on the presence of Byzantine servers. Even when all servers are Byzantine servers, the correct retrieval can be ensured, effectively protecting the user's query privacy and ensuring that the user can retrieve the correct information.

[0083] In addition, the privacy information retrieval method for resisting Byzantine server attacks provided by the embodiment of the present invention has further other beneficial effects. The following illustrates the other beneficial effects of the embodiment of the present invention by comparing it with two multi-server privacy information retrieval schemes in the related art.

[0084] In the related art, there is a class of private information retrieval schemes that use linear error-correcting codes to implement multi-server privacy information retrieval. This type of scheme uses linear codes to encode the original file and then stores it on multiple servers, with each server storing a portion of the encoding of each file. For example, Saarela P et al. proposed a private information retrieval scheme based on linear error-correcting codes. This scheme uses RM (Reed-Muller) codes to encode the original data to form a storage code, which is stored on multiple servers. The RM code is then used to generate a retrieval code, and the item-by-item product of the storage code and the retrieval code is calculated. Finally, based on the error-correcting properties of the RM code, the item-by-item product is decoded to obtain the correct retrieval file.

[0085] However, the above scheme using linear error correction code encoding has the following disadvantages:

[0086] (1) Low coding efficiency: First, the value of the monomial needs to be calculated to form a generator matrix and then the file is encoded. The file system after encoding is ML polynomials in P1,…,P n The evaluation values at a total of n points, where M is the number of files and L is the number of lines in each file. Each server stores the evaluation values of ML polynomials at a point;

[0087] (2) High decoding complexity: The decoding process is complex and requires complex calculations and multiple rounds of queries;

[0088] (3) The number of correctable errors is limited: When the number of errors exceeds the error correction capability of the RM code, the RM code cannot recover the correct data;

[0089] (4) The number of servers that can resist collusion is limited by the encoding parameters: To resist t collusion servers, it is required Where t is the number of colluding servers, and d is the dual code D of the retrieval code D. T The minimum distance.

[0090] There is also a type of private information retrieval scheme that uses secret sharing in related technologies. This scheme splits the original file using a secret sharing scheme and stores multiple shares of each file on multiple servers. However, this secret sharing scheme has the following disadvantages:

[0091] (1) The scenario with Byzantine servers is not considered: multiple servers may collude or maliciously provide incorrect query results, that is, server Byzantine servers, which may cause the leakage of user query privacy or prevent users from obtaining correct files. The secret sharing scheme only considers the scenario with unresponsive servers and eavesdroppers, and cannot meet the retrieval requirements in the presence of Byzantine servers.

[0092] (2) Multiple rounds of queries are required: Multiple rounds of queries are required to multiple servers to obtain the retrieved files.

[0093] (3) Large storage overhead: There are two main storage methods: one is that each server stores the same copy of all file shares, and the other is that each server stores multiple shares of each file, and the data stored by multiple servers has some overlap. However, both methods have large storage overhead.

[0094] In contrast to the above two existing solutions, the embodiments of the present invention also have the following beneficial effects:

[0095] (1) High coding efficiency: In the embodiment of the present invention, information can be coded by multiplying the information with a reversible matrix.

[0096] (2) Simple decoding: In the embodiment of the present invention, decoding of information only requires a matrix multiplication, and does not require complex calculations involving polynomials.

[0097] (3) Ability to correct all errors: Even when all servers are Byzantine servers, the embodiment of the present invention can correct all errors and ensure that users can retrieve correct information.

[0098] (4) Ability to resist the collusion of all servers being Byzantine servers: Since the first client does not disclose the original first encoding matrix to the second client in the embodiment of the present invention, and the query request is uniformly randomly generated and independent of the query index, the query index is shielded. Therefore, even if all servers are in collusion, they cannot obtain the original information.

[0099] (5) Each server only needs to store a small portion of the original information, so the storage cost is low.

[0100] By comparison, it can be seen that the privacy information retrieval method for resisting Byzantine server attacks provided by the embodiment of the present invention can resist more colluding servers, correct more errors, and only requires one round of queries. On the basis of protecting database privacy and user query privacy, it uses a relatively low storage cost to achieve accurate and efficient retrieval.

[0101] In order to verify the effectiveness of the embodiment of the present invention, a simulation as shown below was performed. The simulation configuration includes: the number of files m=20, the file length l=10, and the total number of servers n=10.

[0102] In addition, in order to verify the effectiveness of recovering data in the presence of a Byzantine server in the embodiment of the present invention, some modifications were made to the method of the embodiment of the present invention to form a retrieval scheme that does not consider the Byzantine server. That is, in step S30, after the second client recovers the i-th bit of data in the row data stored by each server, it does not determine whether the Byzantine server exists, but directly combines these data to form the i-th column data of the first coding matrix containing errors, thereby directly using the inverse of the reversible matrix to decode the column data to obtain the query result.

[0103] Figure 3 The comparison data of the retrieval accuracy of the above-mentioned modified method and the method to be protected in the embodiment of the present invention is shown. Figure 3 As can be seen in the figure, the correct retrieval rates of the two methods under different numbers of Byzantine servers form a clear contrast: the method to be protected by the embodiment of the present invention can correctly retrieve all symbols in the file with 100% accuracy when there are any number of Byzantine servers, and the number of errors corrected is completely independent of the number of files m, the file length l, and the number of servers n, and can efficiently and correctly complete file retrieval. However, the correct retrieval rate of the modified method is almost 0 when there are Byzantine servers, which proves the effectiveness of the privacy information retrieval method against Byzantine server attacks to be protected by the embodiment of the present invention.

[0104] The privacy information retrieval method for resisting Byzantine server attacks provided in an embodiment of the present invention can be applied to a client device. The first client and the second client are two different user modules of the client device. A first user of the client device logs in to the client device using the first client, and a second user of the client device logs in to the client device using the second client.

[0105] Specifically, the first user is the user who holds the information. The first user uploads the information to the client device via the first client. The client device information is processed and stored in the manner described in step S10. The second user is the user who needs to retrieve information. The second user logs into the client device via the second client and retrieves and accesses the information previously uploaded by the first user via the client device.

[0106] In practical applications, the client device may be a desktop computer, a portable computer, a smart phone, or a tablet device.

[0107] Based on the same inventive concept, an embodiment of the present invention further provides a privacy information retrieval device that is resistant to Byzantine server attacks, comprising:

[0108] The first user module is configured to receive information uploaded by the first user, encode the information using a reversible matrix to obtain a first encoding matrix; store each row of data in the first encoding matrix to multiple servers; calculate the hash value of each element in the first encoding matrix using a hash function to obtain a check matrix; encode the first encoding matrix using a full-rank matrix to obtain a second encoding matrix; extract any row from the second encoding matrix and save it, with the remaining rows forming a third encoding matrix; and save the reversible matrix, the check matrix, the full-rank matrix, the third encoding matrix, and the hash function;

[0109] The second user module is used to construct and send query requests with the query index i masked for the multiple servers based on the query index i sent by the second user and different random quantities, so that each server feeds back a query response based on the received query request and the row data of the first coding matrix stored by itself; recover the i-th bit of data in the row data stored by the server based on the random quantity used when constructing the query request for each server and the query response fed back by the server; use the check matrix and hash function to perform an overall check on the recovered data, and determine the existence of Byzantine servers in the multiple servers based on the check result; use different data recovery strategies based on the different existence situations of the Byzantine servers to recover the i-th column data of the first coding matrix, and use the inverse of the reversible matrix to decode the column data to obtain the query result; wherein, some data recovery strategies require the assistance of the full rank matrix and the third coding matrix.

[0110] In practical applications, the privacy information retrieval device that resists Byzantine server attacks can be an application program (APP), which can be installed in the above-mentioned client device.

[0111] It should be noted that, for the device embodiment, since the functions of the first user module and the second user module have been described in detail in the method embodiment, the description of the device embodiment is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0112] It should be noted that the terms "first," "second," and the like are used to distinguish similar objects and are not necessarily used to describe a specific order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure.

[0113] In the description of this specification, the reference terms "one embodiment," "some embodiments," "example," "specific example," or "some examples" mean that the specific features or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features or characteristics described can be combined in any suitable manner in one or more embodiments or examples. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification.

[0114] Although the present application is described herein in conjunction with various embodiments, in the process of implementing the claimed application, those skilled in the art may understand and implement other variations of the disclosed embodiments by reviewing the drawings and the disclosed content. In the description of the present invention, the word "comprising" does not exclude other components or steps, "one" or "a" does not exclude multiple situations, and "multiple" means two or more, unless otherwise clearly and specifically limited. In addition, certain measures are recorded in different embodiments, but this does not mean that these measures cannot be combined to produce good results.

[0115] The above is a further detailed description of the present invention in conjunction with specific preferred embodiments, and the specific implementation of the present invention should not be considered to be limited to these descriptions. For those skilled in the art of the present invention, without departing from the concept of the present invention, several simple deductions or substitutions can be made, which should be considered to fall within the scope of protection of the present invention.

Claims

1. A privacy information retrieval method resistant to Byzantine server attacks, characterized in that: include: The first client receives the information uploaded by the information holder and encodes the information using a reversible matrix to obtain a first encoding matrix; Storing each row of data of the first encoding matrix to multiple servers respectively; Calculating the hash value of each element in the first coding matrix using a hash function to obtain a check matrix; encoding the first coding matrix using a full-rank matrix to obtain a second coding matrix; extracting any row from the second coding matrix and saving it, and using the remaining rows to form a third coding matrix; and disclosing the reversible matrix, the check matrix, the full-rank matrix, the third coding matrix, and the hash function to the second client; The second client constructs and sends query requests with the query index i masked to the multiple servers according to the query index i and different random quantities, so that each server feeds back a query response according to the received query request and the row data of the first coding matrix stored in the server; The second client recovers the i-th bit of data in the row data stored by the server based on the random amount used when constructing the query request for each server and the query response fed back by the server; Performing a comprehensive check on the recovered data using a check matrix and a hash function, and determining the presence of Byzantine servers in the plurality of servers based on the check result; The second client uses different data recovery strategies based on the different existence situations of Byzantine servers to recover the i-th column data of the first coding matrix, and decodes the column data using the inverse of the reversible matrix to obtain the query result; among them, some data recovery strategies require the assistance of the full-rank matrix and the third coding matrix.

2. The privacy information retrieval method against Byzantine server attacks according to claim 1 is characterized in that: When there is no Byzantine server among the multiple servers, the data recovery strategy of the second client includes: forming the i-th column data of the first coding matrix with the i-th bit data of all the recovered servers.

3. The privacy information retrieval method against Byzantine server attacks according to claim 1, characterized in that: When some of the multiple servers are Byzantine servers, the data recovery strategy for the second client includes: With the assistance of the full-rank matrix and the third encoding matrix, the i-th data of each Byzantine server is restored based on the i-th data of each non-Byzantine server. The i-th data of each server is then combined into the i-th column data of the first encoding matrix.

4. The privacy information retrieval method against Byzantine server attacks according to claim 1, characterized in that: When the multiple servers are all Byzantine servers, the data recovery strategy for the second client includes: Obtaining retained data from the first client; the retained data is the i-th bit in a row of data of the second coding matrix stored by the first client; With the assistance of the full-rank matrix and the third coding matrix, based on the retained data, the i-th data of all servers is restored by constructing and solving a set of linear equations to obtain the i-th column data of the first coding matrix.

5. The privacy information retrieval method against Byzantine server attacks according to claim 1, characterized in that: The second client constructs and sends query requests with the query index i masked to the multiple servers according to the query index i and different random quantities, including: in, represents the query request constructed for the j∈[1,n]th server, n is the total number of servers, r=[r1,…, i ,…, m ] is a random quantity of length m, m is the maximum index value, α and β are both random numbers; e i are standard basis vectors of length m.

6. The privacy information retrieval method against Byzantine server attacks according to claim 5, characterized in that: The server feeds back a query response based on the received query request and the row data of the first coding matrix stored in the server, including: in, represents the query response of the j-th server, j is the row data of the first encoding matrix stored in the j-th server, and <·> represents the inner product.

7. The privacy information retrieval method against Byzantine server attacks according to claim 6, characterized in that: The second client recovers the i-th bit of data in the row data stored by the server according to the random amount used when constructing the query request for each server and the query response fed back by the server, including: calculating Represents the recovered y j The i-th data.

8. The privacy information retrieval method against Byzantine server attacks according to any one of claims 1 to 7, characterized in that: Applied to client devices; The first client and the second client are two different user modules of the client device respectively; The first user of the client device logs into the client device using the first client, and the second user of the client device logs into the client device using the second client.

9. A privacy information retrieval device resistant to Byzantine server attacks, characterized in that: include: A first user module is configured to receive information uploaded by a first user and encode the information using a reversible matrix to obtain a first encoding matrix; Storing each row of data of the first encoding matrix to multiple servers respectively; Calculating the hash value of each element in the first coding matrix using a hash function to obtain a check matrix; encoding the first coding matrix using a full-rank matrix to obtain a second coding matrix; extracting any row from the second coding matrix and saving it, and the remaining rows forming a third coding matrix; saving the reversible matrix, the check matrix, the full-rank matrix, the third coding matrix, and the hash function; The second user module is configured to construct and send query requests with the query index i masked to the multiple servers based on the query index i sent by the second user and different random quantities, so that each server feeds back a query response based on the received query request and the row data of the first coding matrix stored in the server; Recover the i-th bit of data in the row data stored on each server based on the random number used when constructing the query request for each server and the query response fed back by the server; The recovered data is verified as a whole using a check matrix and a hash function, and the presence of Byzantine servers among the multiple servers is determined based on the verification results; according to the different presence of Byzantine servers, different data recovery strategies are used to recover the i-th column data of the first coding matrix, and the inverse of the reversible matrix is used to decode the column data to obtain the query result; among them, some data recovery strategies require the assistance of a full-rank matrix and a third coding matrix.

10. The privacy information retrieval device against Byzantine server attacks according to claim 9, characterized in that: Applicable to client devices.

Images