A private information retrieval method based on homomorphic encryption

Abstract

The present invention relates to the field of information security technology, and more specifically, to a method for retrieving private information based on homomorphic encryption. The method comprises the following steps: S1. Server preprocessing; S2. Client generating query information; S3. Server responding to the query online; S4. Client decrypting the response information; and S5. Server updating the database. The present invention provides a method for retrieving private information based on homomorphic encryption. Client query requests can be responded to within a sublinear time complexity, significantly reducing the time complexity of previous private information retrieval processes and helping to improve user experience and data retrieval efficiency. Furthermore, the technology provides strong privacy protection, ensuring that users' personal information and sensitive data are fully protected.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and more specifically, to a privacy information retrieval method based on homomorphic encryption. Background Art

[0002] Privacy information retrieval aims to protect the privacy of users' queries. Suppose there are n pieces of data in the database. Conventional privacy information retrieval requires the server to perform Ω(n) calculations, which is linearly related to the size of the database. This is an inherent "flaw" in privacy information retrieval schemes, because once the server misses a piece of data when performing the calculation, it can guess that the client is very likely not interested in that piece of data. Since 2020, scholars have begun to explore PIR schemes with sublinear online query time. Such schemes require the server to perform a preprocessing operation once, which can support the client's online query to be responded to in a short time. However, the current preprocessing PIR schemes either require the server to perform preprocessing operations for each client separately (the clues obtained by preprocessing are stored separately by each client), or require a large amount of server storage (superlinear), which is inefficient and complex to process. Summary of the Invention

[0003] In order to overcome the above-mentioned defects in the prior art, the present invention provides a privacy information retrieval method based on homomorphic encryption, which has sublinear computational complexity and supports single-server privacy information retrieval of database updates.

[0004] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0005] A method for retrieving private information based on homomorphic encryption, comprising the following steps:

[0006] S1. Server preprocessing; the input is a security parameter λ and a database DB, and the output is a "clue" h and a public auxiliary information aux;

[0007] S2. The client generates a query message; the input is a security parameter λ, an index to be queried i, and a public auxiliary information aux; the output is the query information qu and the private key s;

[0008] S3. The server responds to the query online; the input is the database DB, the query information qu, the clue h, and the output is the response information a;

[0009] S4. The client decrypts the response message; the input is the private key s and the response message a, and the output is the data item DB[i] to be retrieved;

[0010] S5. The server updates the database; the input is the rth row DB of the database r , the output is the updated clue h r .

[0011] Furthermore, the step S1 specifically includes:

[0012] S11. The server formats the database;

[0013] S12. The server generates clues.

[0014] Furthermore, the step S11 includes: assuming that there are n entries in the database, each entry belongs to That is, it contains log w bits; the database is organized into a matrix of n / N×N dimensions; the server encodes each row of the database as polynomials; for example, the first row is expressed as The second line is And so on. The encoded database is regarded as a vector with n / N components, denoted as

[0015] Furthermore, the step S12 includes: for j∈[[n / N]], the server performs the following operations: First, calculate c←CipherGen(1 λ ,aux), where aux is the public auxiliary information; then, calculate in Specifically, the server generates a clue, represented as Each component of the clue is a ciphertext; the CipgerGen algorithm here represents the random generation of a homomorphic ciphertext, and the Eval algorithm represents homomorphic computation; the homomorphic encryption scheme used has a plaintext modulus of p, a ciphertext modulus of q, and a security parameter of λ; the plaintext space is The ciphertext space is

[0016] Furthermore, the step S2 includes:

[0017] S21. The client calculates the row index i corresponding to index i based on the database dimension r and column index i c ;

[0018] S22. The client executes c←CipherGen(1 λ ,aux) obtain random ciphertext;

[0019] S23. The client uses the homomorphic encryption key generation algorithm to randomly sample a secret key s←KeyGen(1 λ ), and then use the decryption algorithm of the homomorphic encryption scheme to calculate v: = Dec(s,c), where v∈R p ,p is the plaintext modulus;

[0020] S24. For v's Ni c coefficients, denoted as After Update where γ is an integer parameter; the updated polynomial is expressed as

[0021] S25. The client uses the private key s to access row index i r Encrypt and get an encrypted As query information for the binary decision tree lookup algorithm;

[0022] S26. The client sends the plaintext polynomial and ciphertext Package it into a query qu and then send it to the server, and the client saves the private key s.

[0023] Furthermore, step S3 includes:

[0024] S31. The server first parses the received query information qu and obtains

[0025] S32. The server performs plaintext-plaintext multiplication and obtains Then homomorphic computation where g2 executes h and Subtraction between

[0026] S33. Server operation Where g3 is a table lookup algorithm with and As input, and output ciphertext a; the server sends response information a to the client.

[0027] Furthermore, the step S4 includes: after the client receives the response information a, it calculates m:=Dec(s,a) through the decryption algorithm of the homomorphic encryption scheme and the saved private key s, and then extracts the entry DB[i] to be searched.

[0028] Furthermore, the step S5 includes: after the server receives the row r of the database to be updated, it only needs to re-encode the row data into w The polynomial is then multiplied by the random ciphertext c stored locally on the server, and the result is used to update the rth component in the clue.

[0029] The present invention also provides a device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the above-described method for private information retrieval based on homomorphic encryption.

[0030] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which is executed by a processor to implement the above-mentioned method for private information retrieval based on homomorphic encryption.

[0031] According to the above technical solution, the present invention designs a private information retrieval scheme with sublinear server computational complexity based on homomorphic encryption. The scheme has the following characteristics:

[0032] (1) The offline phase is executed independently by the server, which obtains a "thread". Using this thread, the client's query request in the online phase can be responded to in sublinear time. The offline phase only needs to be executed once and requires sublinear server storage;

[0033] (2) The “clues” generated by the server in the offline phase can be reused by any number of clients in any number of queries in the online phase;

[0034] (3) The scheme supports fast database updates. Instantiating the scheme with TFHE, only two polynomial multiplication operations are required to complete the “clue” update in the offline phase.

[0035] Compared with existing technologies, the present invention offers the following advantages: The method for private information retrieval based on homomorphic encryption enables client queries to be responded to within sublinear time complexity, significantly reducing the time complexity of previous private information retrieval processes and improving user experience and data retrieval efficiency. Furthermore, this technology provides strong privacy protection, ensuring that users' personal information and sensitive data are fully protected. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 It is a schematic flow chart of the method of the present invention. DETAILED DESCRIPTION

[0037] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. The present invention is described in one of the embodiments below in combination with the specific implementation methods. Among them, the drawings are only for illustrative purposes and represent only schematic diagrams rather than physical drawings, and cannot be understood as limitations on this patent; in order to better illustrate the embodiments of the present invention, some parts of the drawings may be omitted, enlarged or reduced, and do not represent the size of the actual product; for those skilled in the art, it is understandable that some well-known structures and their descriptions in the drawings may be omitted.

[0038] In addition, if there are descriptions involving "first", "second", etc. in the embodiments of the present invention, the descriptions of "first", "second", etc. are only for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features specified as "first" or "second" may explicitly or implicitly include at least one of such features. In addition, the meaning of "and / or" appearing throughout the text is to include three parallel solutions. Taking "A and / or B" as an example, it includes solution A, solution B, or solutions that meet both A and B.

[0039] Example 1:

[0040] A private information retrieval method based on homomorphic encryption is proposed. Taking TFHE (Fully Homomorphic Encryption over the Torus) as an example, the various steps of the scheme are instantiated and specific parameter settings are given.

[0041] Assume that the database has a total of n = 2 29 data, polynomial dimension N = 1024, ciphertext modulus q = 2 32 , plaintext modulus p = 2 16 , each entry in the database is log w = 3 bits, the TRLWE ciphertext dimension k = 1, the gadget decomposition depth l = 2 in TFHE, and the gadget decomposition precision ∈ = 2 -21 , the quality of gadget decomposition β = 2 9 , expansion factor γ=2 13 , the variance of the error during TRGSW encryption is limited to 2 -56 Assume that the client wants to retrieve the i=1027th data.

[0042] Step 1: The server formats the database and generates leads.

[0043] S11. The server encodes the database into a polynomial vector according to the above steps

[0044] S12. The server uses a pseudorandom function (PRF) to instantiate the CipherGen algorithm. The input of the PRF is a public seed and the output is a random TRLWE ciphertext. Then Each component of is multiplied by the random TRLWE ciphertext to obtain a ciphertext vector, namely the clue h.

[0045] Step 2: The client generates query information for column index and row index respectively.

[0046] S21. The client calculates the trip index i r =1 and column index i c =3;

[0047] S22. The client recovers the random ciphertext based on the public seed

[0048] S23. Then, according to the key generation algorithm in the TFHE scheme, a key s is generated, and then the random ciphertext is decrypted using this key to obtain a polynomial v∈R p ;

[0049] S24. Set v′ 1020 =v 1020 +2 13 mod2 16 , and obtain the new polynomial

[0050] S25. The client uses the generated private key s to access row index i r =1 to perform TRGSW encryption bit by bit to obtain the ciphertext

[0051] S26. and Packaged into query information qu.

[0052] Step 3: The server performs online calculations. The process is as follows:

[0053] S31. Analyze the received query information qu and obtain

[0054] S32. The server performs plaintext-plaintext multiplication and obtains Then homomorphic computation where g2 executes h and Subtraction between

[0055] S33. After executing the table lookup algorithm, the server obtains a TRLWE ciphertext. It then executes the SampleExtract algorithm in TFHE to extract the constant term of the TRLWE-encrypted plaintext, obtaining a TLWE ciphertext. The server sends this TLWE ciphertext as response a to the client.

[0056] Step 4: After receiving the response, the client performs the following steps:

[0057] The client uses the saved private key s to decrypt the returned TLWE ciphertext a. The expansion factor used for decryption should be set to γΔ=2 29 .

[0058] Step 5: Assuming that row r=5 in the database has data to be updated, the server executes the following steps to update the clue:

[0059] After the server receives the row r of the database that needs to be updated, it only needs to re-encode the row data into w The polynomial is then multiplied by the random ciphertext c stored locally on the server, and the result is used to update the rth component in the clue.

[0060] Example 2:

[0061] The new PIR scheme can be obtained by replacing the TFHE scheme in Example 1 with the homomorphic encryption scheme used in the paper Spiral: Fast, High-Rate Single-Server PIR via FHE Composition, published in Security & Privacy 2022. This will not be described in detail here.

[0062] Example 3

[0063] This embodiment provides a device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. The processor executes the computer program to implement the method for private information retrieval based on homomorphic encryption described in Example 1.

[0064] Example 4

[0065] This embodiment provides a computer-readable storage medium having a computer program stored thereon. The program is executed by a processor to implement the private information retrieval method based on homomorphic encryption described in Example 1.

[0066] In the description of this specification, the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" mean that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification and features of different embodiments or examples without contradiction.

[0067] Obviously, the above embodiments of the present invention are merely examples for the purpose of clearly illustrating the present invention, and are not intended to limit the embodiments of the present invention. Those skilled in the art will appreciate that other variations or modifications can be made based on the above description. It is not necessary and impossible to enumerate all embodiments here. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention shall be included within the scope of protection of the claims of the present invention.

Claims

1. A privacy information retrieval method based on homomorphic encryption, characterized in that: The following steps are involved: S1. Server preprocessing; The input is a security parameter λ and a database DB, and the output is a clue h and public auxiliary information aux. The server encodes each row of the database into a polynomial and uses a homomorphic encryption algorithm to randomly generate a homomorphic ciphertext. The ciphertext vector, i.e., the clue h, is obtained by combining the polynomial and the ciphertext. S2. The client generates query information; The input is a security parameter λ, an index i to be queried and a public auxiliary information aux, and the output is the query information qu and the private key s; The step S2 comprises: S21. The client calculates the row index i corresponding to index i based on the database dimension r and column index i c ; S22. The client executes c←CipherGen(1 λ ,aux) obtain random ciphertext; S23. The client uses the homomorphic encryption key generation algorithm to randomly sample a secret key s←KeyGen(1 λ ), and then use the decryption algorithm of the homomorphic encryption scheme to calculate v: = Dec(s,c), where v∈R p ,p is the plaintext modulus; S24. For v's Ni c coefficients, denoted as After Update where γ is an integer parameter; the updated polynomial is expressed as S25. The client uses the private key s to access row index i r Encrypt and get an encrypted As query information for the binary decision tree lookup algorithm; S26. The client sends the plaintext polynomial and ciphertext Package it into a query qu and send it to the server. The client saves the private key s. S3 server online response query; input is the database DB, query information qu, clue h, the output is a response message; the step S3 comprises: S31. The server first parses the received query information qu and obtains S32. The server performs plaintext-plaintext multiplication and obtains Then homomorphic computation where g2 executes h and Subtraction between S33. Server operation Where g3 is a table lookup algorithm with and As input, and output ciphertext a; the server sends the response information a to the client; S4. The client decrypts the response message; the input is the private key s and the response message a, and the output is the data item DB[i] to be retrieved; S5. The server updates the database; the input is the rth row DB of the database r , the output is the updated clue h r .

2. The method for private information retrieval based on homomorphic encryption according to claim 1, characterized in that: The step S1 specifically includes: S11. The server formats the database; S12. The server generates clues.

3. The method for private information retrieval based on homomorphic encryption according to claim 2, characterized in that: The step S11 includes: setting that there are n entries in the database, each entry belongs to That is, it contains log w bits; the database is organized into a dimensional matrix; the server encodes each row of the database as The encoded database is considered to have a polynomial A vector of components, denoted as 4. The method for retrieving private information based on homomorphic encryption according to claim 3, characterized in that: The step S12 includes: The server performs the following operations: First, calculate c←CipherGen(1 λ ,aux), where aux is the public auxiliary information; then, calculate in Specifically, the server generates a clue, represented as Each component of the clue is a ciphertext; the CipherGen algorithm here represents the random generation of a homomorphic ciphertext, and the Eval algorithm represents homomorphic computation; the homomorphic encryption scheme used has a plaintext modulus of p, a ciphertext modulus of q, and a security parameter of λ; the plaintext space is The ciphertext space is 5. The method for private information retrieval based on homomorphic encryption according to claim 1, characterized in that: The step S4 includes: after the client receives the response information a, it calculates m:=Dec(s,a) through the decryption algorithm of the homomorphic encryption scheme and the stored private key s, and then extracts the entry DB[i] to be searched.

6. The method for private information retrieval based on homomorphic encryption according to claim 5, characterized in that: The step S5 includes: after the server receives the row r of the database to be updated, it only needs to re-encode the row data into w The polynomial is then multiplied by the random ciphertext c stored locally on the server, and the result is used to update the rth component in the clue.

7. A device, characterized in that The method comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method for retrieval of private information based on homomorphic encryption according to any one of claims 1 to 6.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: The program is executed by a processor to implement the privacy information retrieval method based on homomorphic encryption as described in any one of claims 1 to 6.

Images