A vulnerability search method based on homomorphic encryption and oblivious transfer

Abstract

The application discloses a vulnerability searching method based on homomorphic encryption and careless transmission and belongs to the technical field of information security.The method comprises the following steps: after pre-processing vulnerability database data and initializing system parameters, a server and a user share a key based on a SLS-based digital signature encryption algorithm, and the key is used as a key of an AES encryption algorithm to protect the transmission of a software name, so that the software name is searched in a ciphertext mode; the user generates corresponding public keys and private keys according to a homomorphic encryption algorithm, and sends the public keys and homomorphic-encrypted version numbers to the server; the server ensures version range privacy through homomorphic encryption and linear transformation, so that the software version range is searched in the ciphertext mode; and the server and the user find matched index numbers according to the joint searching of a software name keyword and a software version range, and realize the searching of detailed vulnerability data through careless transmission.The application can ensure that the searching conditions and results of the user are not leaked and protect the privacy of the vulnerability database data.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, and in particular relates to a vulnerability retrieval method based on homomorphic encryption and unintentional transmission. Background Technology

[0002] The number of network software programs has reached an unprecedented scale, and the existence of security vulnerabilities has become a widespread phenomenon. Cybersecurity research companies have built a massive vulnerability database based on their capabilities and experience, but for commercial purposes, they cannot directly disclose it. This database contains the names of various affected software programs, their specific version numbers, and detailed vulnerability data. Cybersecurity research companies could use this database to provide vulnerability search services to users. If users directly upload software names and version numbers to a server for testing, the leakage of this information could pose a threat to their cybersecurity. Considering factors such as security risks, legal liability, and commercial interests, the vulnerability database cannot be directly made public. To strengthen the protection of user privacy and prevent the disclosure of search conditions and results, private information retrieval technology within secure multi-party computation has emerged.

[0003] Private information retrieval is an important research branch of secure multi-party computation. Its purpose is to ensure that the information queried by the user is known only to the user; that is, the server is unaware of the user's specific query conditions and results during the query process. Private information retrieval methods generally involve a user and a server. To obtain the required information, the user first sends a query request to the server; then, the server responds to the user based on the received request; finally, the user extracts the required data from the server's response. The entire process must ensure that the server has no ability to distinguish between the index of the queried information and the query results. Existing private information retrieval methods are mainly divided into two categories: information-theoretic private information retrieval and computationally secure private information retrieval.

[0004] (1) Information-theoretic Private Information Retrieval: The goal of this method is to protect user privacy in any computational model, even if the database has unlimited computing power, it cannot determine the index of the information the user wants to retrieve. Chor et al. first proposed the concept of private information retrieval in 1995 and presented an information-theoretic private information retrieval method. Such protocols often require multiple non-colluding database copy servers, utilizing inter-server cooperation and encoding techniques to achieve private information retrieval. These protocols have high security, but high spatial storage complexity and require non-collusion among servers.

[0005] (2) Computationally Secure Private Information Retrieval: To address the issues of high spatial storage complexity and server collusion, Chor et al. proposed a private information retrieval method requiring only two database copies in 1997. Subsequently, Kushilevitz et al. constructed a private information retrieval method requiring only a single server by utilizing the quadratic residue difficulty problem. These methods are typically based on difficult problems and assumptions in cryptography, requiring the server to be unable to distinguish between the user's query conditions and results in polynomial time.

[0006] Currently, there are several main methods for achieving private information retrieval:

[0007] In 2002, Beimel et al. [A.Beimel, Y.Ishai, E.Kushilevitz, et al.Breaking theO(n 1 / (2k-1) [A barrier for information-theoretic Private Information Retrieval. IEEE Symposium on Foundations of Computer Science, 2002, pp. 261-270.] proposes an efficient method for private information retrieval. They utilize a polynomial representation of the database, replicate the database to k servers, and then recursively perform private information retrieval. This method improves the communication complexity of k-server private information retrieval, reducing it to O(n log n). (loglogk) / (klogk) In the same year, Yang et al. [EYYang, J.Xu, KH Bennett. Private information retrieval in the presence of malicious failures. Annual International Computer Software and Applications, 2002, pp.805-810.] applied secret sharing technology to the problem of private information retrieval and proposed a private information retrieval method that can resist attacks from malicious database owners.

[0008] In 2005, Gentry and Ramzan [C. Gentry, Z. Ramzan. Single-database private information retrieval with constant communication rate. International Colloquium on Automata, Languages ​​and Programming-ICALP 2005, LNCS 3580, 2005, pp. 803-815.] proposed a single-database private information retrieval method using the Chinese Remainder Theorem. They divided the data in the database into blocks and used the Chinese Remainder Theorem to calculate a prime number and its power based on each data block, using these as identifiers. The server calculates the value of the entire database based on these identifiers. Users send a query request to the server by calculating the identifier of the data block to be queried. The server responds to the user based on the query request and the database value. The security of this scheme is based on a simple variant of the Φ-hiding hypothesis proposed by Cachin, Micali, and Stadler.

[0009] In 2008, Williams et al. [P. Williams, R. Sion, B. Carbunar. Building castles out of mud: practical access pattern privacy and correctness on untrusted storage. ACM Conference on Computer and Communications Security-CCS2008, 2008, pp. 139-148.] designed a private information retrieval method based on trusted computing. This method introduces technologies such as Oblivious Random Access Memory (ORAM) and Bulon filters to ensure access pattern privacy and data correctness in untrusted storage environments.

[0010] In 2017, Tajeddine and Rouayheb [R. Tajeddine, SERouayheb. Robust private information retrieval on coded data. 2017 IEEE International Symposium on Information Theory, 2017, pp. 1903-1907.] designed a robust private information retrieval method. This protocol uses random vectors to guarantee query privacy, stores data in a distributed database, and can compensate for the failure of some nodes by transmitting data from other nodes.

[0011] In addition, Chinese patent application CN113190584A discloses an anonymous query method based on unintentional transmission. This method uses a public-key encryption algorithm to encrypt data in the channel, while using unintentional transmission to ensure the security of the data provider. Chinese patent application CN113094383A discloses a method for constructing a private information retrieval protocol capable of detecting cheating servers, using a Merkle tree to ensure that users can verify the authenticity of data while conducting secret searches. Chinese patent application CN107992582A discloses a private information retrieval method based on sawtooth decoding, using sawtooth decoding to improve the robustness of private information retrieval in distributed storage systems. These private information retrieval methods only consider using indexes or keywords for retrieval, lacking support for combined keyword and range searches. Summary of the Invention

[0012] The purpose of this invention is to realize a single-server vulnerability retrieval method in an untrusted environment, providing privacy data protection functions for users and servers in private information retrieval.

[0013] This invention discloses a vulnerability retrieval method based on homomorphic encryption and unintentional transmission, comprising the following steps:

[0014] This invention provides a vulnerability retrieval method based on homomorphic encryption and unintentional transmission, comprising:

[0015] Step 1: The server preprocesses the vulnerability database data and sets system parameters with the user to generate public and private keys (PK) for digital signature encryption. a ,sk a ) and (pk b ,sk b ) and the public and private keys (h,(λ,μ)) for homomorphic encryption;

[0016] Step 2: The server shares the key k with the user using a digital signature encryption algorithm. k is used as the key for encrypting the hash value of the software name using the AES (Advanced Encryption Standard) encryption algorithm. The server sends all the encrypted software names to the user in sequence. The user determines the encrypted software name to be queried by comparing the encrypted software names.

[0017] Step 3: The user generates a homomorphic encryption public key h and a private key (λ, μ), encrypts the version number to be queried using the public key h, and sends the public key h and the encrypted version number to be queried to the server; the server sends the encrypted version number after linear transformation and the encrypted version ranges of all versions to the user in sequence; the user decrypts the encrypted version number after linear transformation using the private key (μ, λ), and determines the encrypted version number to be queried by comparing it with the encrypted version ranges.

[0018] Step 4: The user finds the matching index number by using the encrypted name and version number of the software to be queried, and obtains the expected detailed vulnerability data by executing an unintentional transmission protocol on the server based on the index number.

[0019] Furthermore, in step 1, the server preprocesses the vulnerability database data, including:

[0020] The server stores the vulnerability database data in a table format. Each table contains multiple entries, and each entry contains the following fields: index I, software name m. I Software version range And detailed vulnerability data m″ I , where 1≤I≤N, and N represents the total number of indexes in the vulnerability database.

[0021] Furthermore, in step 1, the server and the user respectively set the system parameters, including:

[0022] The server selects large prime numbers p and q such that q|(p-1), and selects... Let g be an element of order q; define two secure hash functions H1 and H2, where H1 is a hash function for elements from {0,1}. * Mapped to H2 converts the string to an integer, where {0,1} * Represents a set of binary sequences of arbitrary bit length. Representing the finite field Z p ={0,1,…,p-1} is the finite field obtained by removing zeros; define a pseudo-random function F. k To achieve the transition from {0,1} l ×{0,1} l Mapped to {0,1} m where {0,1} l and {0,1} mLet L and M represent binary sequences of length l and m, respectively; define E and D as the AES encryption and decryption algorithms, respectively; the total number of indexes in the vulnerability database is N = 2. l , where l is the number of bits in the binary index;

[0023] The server publicly displays system parameters (p, q, g, H1, H2, F). k ,E,D,l);

[0024] The user randomly selects two prime numbers q1 and q2 such that gcd(q1q2,(q1-1)(q2-1))=1, where gcd() is a function to find the greatest common divisor and calculates n=q1q2;

[0025] The user discloses the system parameter n.

[0026] Furthermore, step 2 specifically includes:

[0027] The server selects the private key sk. a ,1≤sk a ≤q-1, based on private key sk a Generate the corresponding public key And PK the public key a Send to the user;

[0028] User selects private key sk b ,1≤sk b ≤q-1, based on private key sk b Generate the corresponding public key And PK the public key b Send to the server;

[0029] The server generates a key k for AES encryption; a random integer u is selected, 1 ≤ u ≤ q-1, and the following calculations are performed. r = (g u mod p)mod q and h=H1(k||pk) a ||pk b ||k2), then encrypt the key. And generate the signature e1 = hu / (h + sk) a r)mod q and e2=ru / (h+sk a r)mod q, send the signed ciphertext σ=(c) to the user with key k. key (e1, e2); where, This indicates the AES encryption algorithm based on k1;

[0030] User computing and Then decrypt the ciphertext. Calculate h = H1(k||pk) a ||pkb Given ||k2) and s=r / e2modq, determine whether e1s=hmodq is true. If true, accept the key k; where This represents the AES decryption algorithm based on k1;

[0031] Server calculates c I =E k (H2(m I Obtain the encrypted software name c I And send all software names in encrypted form to the user in sequence;

[0032] User calculates c = E k (H2(m)) yields the encrypted name c of the software to be queried. Among them, E k () represents the AES encryption algorithm based on key k.

[0033] Furthermore, step 3 includes:

[0034] User from Randomly select an integer h such that the order of h is a multiple of n; define Calculate the private key μ = (L(g) λ mod n 2 )) -1 mod n and λ = lcm(q1-1,q2-1), where lcm() is a function to find the least common multiple; send h as the public key for homomorphic encryption to the server;

[0035] The server randomly selects a non-zero integer (x, y) and calculates... and And ciphertext for all versions Send to users in sequence;

[0036] Users from Z n Select a random number r1 and calculate And put c′ a Send to the server;

[0037] The server is from Z. n Select a random number r2 and calculate And put c′ b Send to the user;

[0038] The user decrypts the calculation result sent by the server using the homomorphic encryption private key (μ,λ), and calculates the ciphertext c′=L((c′) ... b ) λ mod n 2 )·μmod n.

[0039] Furthermore, step 4 specifically includes:

[0040] The user finds the matching index T based on the encrypted software name c and the encrypted version number c′, and converts the index T into a binary string of length l. <t1,t2,...,t l >;

[0041] The server generates 2l keys, each of length l.

[0042] The server converts index I into a binary string of length l. <i1,i2,...,i l > Calculate detailed encrypted data of the vulnerability Where 1≤j≤l, and ciphertext c″ containing all vulnerability details is sent to the user in sequence. I ;in For key The parameter at the corresponding position in i; j binary string <i1,i2,...,i l Elements in >

[0043] The server and user execute 1 out-of-2 unintentional transfer protocol (1-out-of-2 unintentional transfer protocol) 1 time. The server sends User based on t j choose

[0044] User Decryption Obtain the desired vulnerability details m″ T .

[0045] In this invention, the Naor-Pinkas 1-out-of-N unintentional transmission protocol is adopted. The user can obtain one vulnerability detail from N vulnerability detail data from the server by performing only log2N 1-out-of-2 unintentional transmissions.

[0046] Due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0047] This invention enables joint retrieval of software name keywords and software version ranges based on homomorphic encryption and unintentional transmission, solving two problems in vulnerability retrieval:

[0048] (1) When users transmit private data in plaintext, if this information is stolen by hackers or dishonest data providers, it may threaten the user's network security;

[0049] (2) Considering factors such as security risks, legal responsibilities and commercial interests, the vulnerability database of the data provider cannot be directly opened to the public. Attached Figure Description

[0050] Figure 1 This is a flowchart illustrating a specific embodiment of the present invention;

[0051] Figure 2 This is a schematic diagram of the software name encrypted query interaction in a specific embodiment of the present invention;

[0052] Figure 3 This is a schematic diagram illustrating the version range encrypted query interaction of a specific embodiment of the present invention;

[0053] Figure 4 This is a schematic diagram illustrating the interaction of querying detailed vulnerability data in a specific embodiment of the present invention. Detailed Implementation

[0054] To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the embodiments and accompanying drawings.

[0055] This invention provides a vulnerability retrieval method based on homomorphic encryption and unintentional transmission, comprising:

[0056] The server preprocesses vulnerability database data and sets system parameters separately for the user to generate public and private keys (PK) for digital signature encryption. a ,sk a ) and (pk b ,sk b ) and the public and private keys (h,(λ,μ)) for homomorphic encryption;

[0057] The server uses a digital signature algorithm to share the key k with the user, and uses k as the key for the AES encryption algorithm to encrypt the hash value of the software name; the server sends all the encrypted software names to the user in order, and the user determines the encrypted software name to be queried by comparing the encrypted software names.

[0058] The user generates a homomorphic encryption public key h and a private key (λ, μ), encrypts the version number to be queried using the public key h, and sends the public key h and the ciphertext of the version number to be queried to the server; the server sends the ciphertext of the version number after linear transformation and the ciphertext of all version ranges to the user in sequence; the user decrypts the ciphertext of the version number after linear transformation using the private key (μ, λ), and determines the ciphertext of the version number to be queried by comparing it with the ciphertext of the version ranges.

[0059] Users can find a matching index number by using the encrypted name and version number of the software to be queried, and obtain the expected detailed vulnerability data by executing an unintentional transmission protocol on the server based on the index number.

[0060] See Figure 1 The specific execution steps include preprocessing data, setting system parameters, querying encrypted software names, querying encrypted version ranges, and querying detailed vulnerability data, as described below:

[0061] (1) Preprocessed data: The server stores the vulnerability database data in tabular form. Each table contains multiple entries, and each entry contains the following fields: index I, software name m. I Software version range And detailed vulnerability data m″ I , where 1≤I≤N.

[0062] (2) Set system parameters:

[0063] (2.1) The server selects large prime numbers p and q such that q|(p-1), and selects... Let g be an element of order q; define two secure hash functions H1 and H2, where H1 is a hash function for elements from {0,1}. * Mapped to H2 converts the string to an integer, where {0,1} * Represents a set of binary sequences of arbitrary bit length. Representing the finite field Z p ={0,1,…,p-1} is the finite field obtained by removing zeros; define a pseudo-random function F. k To achieve the transition from {0,1} l ×{0,1} l Mapped to {0,1} m where {0,1} l and {0,1} m Let L and M represent binary sequences of length l and m, respectively; define E and D as the AES encryption and decryption algorithms, respectively; the total number of indexes in the vulnerability database is N = 2. l , where l is the number of bits in the binary index.

[0064] (2.2) The server exposes system parameters (p, q, g, H1, H2, F) k ,E,D,l).

[0065] (2.3) The user randomly selects two prime numbers q1 and q2, satisfying gcd(q1q2,(q1-1)(q2-1))=1, where gcd() is the function to find the greatest common divisor, and calculates n=q1q2.

[0066] (2.4) User discloses system parameter n.

[0067] (3) Software name encrypted lookup:

[0068] The server and user use the SLS digital signature cryptography algorithm [JBShin, K. Lee, and K. Shim. New DSA-verifiable signcryption schemes. Information Security and Cryptology - ICISC 2002, LNCS 2587, 2003, pp. 35-47.] and the AES encryption algorithm to perform ciphertext lookup of the software name. See also Figure 2 The specific steps are as follows:

[0069] (3.1) The server selects the private key sk a ,1≤sk a ≤q-1, generate the corresponding public key And PK the public key a Send to the user.

[0070] (3.2) User selects private key sk b ,1≤sk b ≤q-1, generate the corresponding public key And PK the public key b Send to the server.

[0071] (3.3) The server generates a key k for AES encryption.

[0072] (3.4) The server selects a random integer u, 1≤u≤q-1, and calculates... r = (g u mod p)mod q and h=H1(k||pk) a ||pk b ||k2), then encrypt the key. And generate the signature e1 = hu / (h + sk) a r)mod q and e2=ru / (h+sk a r)mod q, send the signed ciphertext σ=(c)mod q to the user with key k. key (e1,e2).

[0073] (3.5) User Calculation and Then decrypt the ciphertext. Calculate h = H1(k||pk) a ||pk b The signature is determined by setting ||k2) and s = r / e2 mod q, and then by checking whether e1s = h mod q is true. If true, the key k is accepted.

[0074] (3.6) Server calculates c I =E k (H2(mI Obtain the encrypted software name c I It then sends all software names in encrypted form to the user in sequence.

[0075] (3.7) User calculates c = E k (H2(m)) is used to obtain the encrypted name c of the software to be queried.

[0076] (4) Version range ciphertext lookup:

[0077] The server and users use the Paillier homomorphic encryption algorithm [P. Paillier. Public-key cryptosystems based on composite degree residuosity classes. Advances in Cryptology-EUROCRYPT'99, LNCS1592, 1999, pp.223-238.] and linear transformations to perform ciphertext lookups within the software version range. See also Figure 3 The specific steps are as follows:

[0078] (4.1) User from Randomly select an integer h such that the order of h is a multiple of n; define Calculate the private key μ = (L(g) λ mod n 2 )) -1 mod n and λ = lcm(q1-1,q2-1), where lcm() is a function to find the least common multiple; h is sent to the server as the public key for homomorphic encryption.

[0079] (4.2) The server randomly selects a non-zero integer (x, y) and applies a linear transformation. and Processing software version range Obtain version range ciphertext And send all version ranges of encrypted text to the user in sequence.

[0080] (4.3) User from Z n Select a random number r1, encrypt the version number m′ to be queried using the homomorphic encryption public key h, and then output the result. Send to the server.

[0081] (4.4) The server is from Z n Select a random number r2 from the list, and calculate the result. Send to the user.

[0082] (4.5) The user decrypts the calculation result sent by the server using the homomorphic encryption private key (μ,λ), and calculates the ciphertext c′=L((c′)=L(μ,λ ... b ) λ mod n 2 )·μmod n.

[0083] (5) Version range ciphertext lookup:

[0084] The server and user find a matching index T based on a joint query using software name keywords and software version ranges, and then use Naor-Pinkas' 1-out-of-N unintentional transfer protocol [M. Naor, B. Pinkas. Computationally secure oblivious transfer. Journal of Cryptology, 2005, 18, pp. 1-35.] to query detailed vulnerability data. See also Figure 4 The specific steps are as follows:

[0085] (5.1) The user finds the matching index number T based on the encrypted software name c and the encrypted version number c′, and converts the index number T into a binary string of length l. <t1,t2,...,t l >

[0086] (5.2) The server generates 2l keys of length l.

[0087] (5.3) The server converts the index I of the vulnerability details into a binary string of length l. <i1,i2,...,i l > Calculate detailed encrypted data of the vulnerability Where 1≤j≤l, and ciphertext c″ containing all vulnerability details is sent to the user in sequence. I .

[0088] (5.4) The server and user execute a 1-out-of-2 unintentional transfer protocol l times, and the server sends... User based on t j Select the corresponding key

[0089] (5.5) The user selects a key. Decrypt all vulnerability details in ciphertext c I ″ To obtain the desired detailed vulnerability data

[0090] The above description is merely a specific embodiment of the present invention. Any feature disclosed in this specification may be replaced by other equivalent or similar features unless otherwise specified. All disclosed features, or steps in all methods or processes, may be combined in any way except for mutually exclusive features and / or steps.

Claims

1. A vulnerability retrieval method based on homomorphic encryption and unintentional transmission, characterized in that, Includes the following steps: Step 1: The server preprocesses the vulnerability database data and sets system parameters with the user to generate the server-side public and private keys for digital signature encryption. public and private keys of the user and homomorphic encryption public / private key pairs ; Step 2: The server uses a digital signature algorithm to transfer the key. Shared with users, for use The hash value of the encryption software name used as the key for the AES encryption algorithm; The server sends all software name ciphertexts to the user in sequence, and the user determines the software name ciphertext to be queried by comparing the software name ciphertexts. Step 3: The user generates a public key for homomorphic encryption. and private key Using public key Encrypt the version number to be queried and pass the public key. The user sends the encrypted version number to the server; the server then sends the encrypted version number (after linear transformation) and all version ranges to the user in sequence; the user then uses their private key... Decrypt the ciphertext of the version number after linear transformation, and determine the ciphertext of the version number to be queried by comparing it with the ciphertext of the version range. Step 4: The user finds the matching index number by using the encrypted name and version number of the software to be queried, and obtains the expected detailed vulnerability data by executing an unintentional transmission protocol on the server based on the index number.

2. The method as described in claim 1, characterized in that, In step 1, the server preprocesses the vulnerability database data, including: The server stores the vulnerability database data in a table format, with each table containing multiple entries. Each entry contains the following fields: Index Software Name Software version range and detailed vulnerability data ,in N represents the total number of indexes in the vulnerability database.

3. The method as described in claim 1, characterized in that, In step 1, the server and user respectively set the system parameters, including: The server selects a large prime number. ,satisfy , and select one of the Rank element Define two secure hash functions. and ,in From Mapped to , Convert the string to an integer, where Represents a set of binary sequences of arbitrary bit length. Representing a finite field The finite field obtained by removing zeros; define a pseudo-random function. To achieve from Mapped to ,in and They represent lengths of and Binary sequences; definition These are the AES encryption and decryption algorithms, respectively; the total number of indexes in the vulnerability database. , The number of bits for the binary index; Server exposes system parameters ; The user randomly selects two prime numbers. and ,satisfy ,in It is a function that finds the greatest common divisor and calculates... ; User publicly discloses system parameters .

4. The method as described in claim 3, characterized in that, Step 2 specifically includes: The server selects the private key. , Generate the corresponding public key and give the public key Send to the user; User selects private key , Generate the corresponding public key and give the public key Send to the server; The server generates a key for AES encryption. Select a random integer , ,calculate , and Then the encryption key And generate a signature and Send the key to the user ciphertext ; User computing and Then decrypt the ciphertext. ;calculate and ,judge If the condition is met, accept the key. ; Server computing Obtain the encrypted software name And send all software names in encrypted form to the user in sequence; User computing Obtain the encrypted name of the software to be queried. .

5. The method as described in claim 3, characterized in that, Step 3 specifically includes: Users from a limited domain Randomly select an integer ,satisfy The order is Multiples of; definition Calculate the private key : , ,in It is a function for finding the least common multiple; Send it to the server as the public key for homomorphic encryption; The server randomly selects a non-zero integer. ,calculate and and ciphertext for all versions. Send to users in sequence; User from Choose a random number ,calculate and put Send to the server; The server from Choose a random number ,calculate and put Send to the user; The user uses homomorphic encryption of the private key. Decrypt the calculation results sent by the server, and calculate the ciphertext of the version number to be queried. .

6. The method as described in claim 3, characterized in that, Step 4 specifically includes: The user enters the encrypted text of the software name to be queried. and the encrypted version number to be queried Find the matching index number and put the index number Convert to length of binary string ; Server generation A length of key ; The server indexes Convert to length of binary string Calculate the detailed encrypted data of the vulnerability ,in And send encrypted data containing all vulnerability details to the user in sequence. ; Server and user execution The 1-out-of-2 unintentional transmission protocol, the server sends... According to the user choose ; User Decryption To obtain the desired vulnerability details .

7. The method according to any one of claims 1 to 6, characterized in that, In step 3, the Paillier homomorphic encryption algorithm is used.

8. The method according to any one of claims 1 to 6, characterized in that, In step 4, Naor-Pinkas' 1-out-of-N unintentional transmission protocol is used.

Images