A batch private information retrieval method and system resistant to Byzantine attacks

Abstract

A method and system for batch private information retrieval that resists Byzantine attacks, the method comprising: a client receiving a prompt for verification generated by masked data of an original file; the client constructing a query based on an index set of a batch query; calculating and generating a response corresponding to the query; the client verifying the response based on the prompt, and if the response verification passes, obtaining the retrieved file set; if the response verification fails, initiating a challenge for response verification; the client performing response verification, and if the response verification passes, obtaining the retrieved file set; if the response verification fails, terminating the protocol. The present invention can identify Byzantine servers and implement batch retrieval, and can obtain correct results when there is only one honest server, thereby protecting the user's query privacy and the correctness of the retrieval results, and improving query efficiency. The client of the present invention has low storage overhead, and as the number of files continues to increase, the amount of data required to be stored by the client increases less.

Description

Technical Field

[0001] The present invention belongs to the field of information retrieval technology, and in particular relates to a batch privacy information retrieval method and system that is resistant to Byzantine attacks. Background Art

[0002] In today's digital society, private information retrieval is crucial for protecting sensitive user information. This presents a significant challenge for businesses, governments, and individuals: ensuring the privacy and security of user data during information retrieval. Traditional private information retrieval methods can ensure user privacy and the accuracy of retrieval results in semi-honest scenarios. However, with the rapid development of the internet and the increasing complexity of networks, considering only semi-honest scenarios is no longer sufficient to meet the security requirements of today's networks. Furthermore, most current private information retrieval schemes are single-query schemes, which retrieve a single file or entry each time a search is completed. This requires multiple executions of a single query to query multiple files or entries. To protect the privacy of both the queryer and the server, a number of queries must be constructed that is linearly proportional to the number of database elements. This requires multiple query constructions and multiple server responses, resulting in low efficiency. To address this issue, researchers have proposed batch private information retrieval. However, current batch private information retrieval schemes are mostly based on cryptographic schemes such as homomorphic encryption, which incurs significant computational overhead. Therefore, in order to protect user query privacy and the correctness of retrieval results and improve query efficiency in scenarios where malicious servers exist, it is urgent to propose a batch privacy information retrieval solution that can achieve result verification and Byzantine-resistant services.

[0003] In related prior art, for example, the paper "Mughees MH, Ren L. Vectorized batch private information retrieval [C] / / 2023 IEEE Symposium on Security and Privacy (SP). IEEE, 2023: 437-452." addresses the high communication overhead in traditional private information retrieval schemes and proposes a private information retrieval scheme that supports batch queries based on a vectorized homomorphic encryption scheme. Specifically, during the setup phase, this scheme hashes each database data item into multiple buckets using a hash function. For batch queries, each index in the index set is represented as a basis vector and encrypted. A vectorized PIR protocol is then run on each hash bucket. Furthermore, two mechanisms, request ciphertext packaging and response ciphertext merging, are proposed to reduce the size of requests and responses.

[0004] Although the existing batch query solution reduces the communication cost based on the original batch information retrieval solution and achieves the goal of batch query, it still has some shortcomings:

[0005] 1) The query vector is encrypted using homomorphic encryption. The computational complexity of the encrypted vector and the database entry is higher than that of ordinary addition and multiplication operations.

[0006] 2) When the database file size is large, the solution is not applicable, but only applies to the case where the database file size is small.

[0007] 3) Since the database data needs to be mapped to the hash bucket, conversion between the database index and the hash bucket index is required, which increases the complexity of the query.

[0008] 4) Current batch privacy information retrieval does not consider the problem of Byzantine servers in multi-server scenarios. Summary of the Invention

[0009] The purpose of the present invention is to address the problems in the above-mentioned prior art and provide a batch private information retrieval method and system that is resistant to Byzantine attacks. The method can identify Byzantine servers, implement batch retrieval, obtain correct results even when there is only one honest server, protect user query privacy and the correctness of retrieval results, and improve query efficiency.

[0010] In order to achieve the above object, the present invention has the following technical solutions:

[0011] In a first aspect, an embodiment of the present invention provides a batch private information retrieval method that is resistant to Byzantine attacks, comprising:

[0012] The client receives a verification prompt generated by adding masked data to the original file;

[0013] The client constructs a query based on the index set for batch query;

[0014] Calculate and generate the response corresponding to the query;

[0015] The client verifies the response according to the prompt. If the response verification passes, the retrieved file set is obtained; if the response verification fails, a challenge for response verification is initiated;

[0016] The client performs response verification. If the response verification passes, the retrieved file set is obtained; if the response verification fails, the protocol is terminated.

[0017] As a preferred solution, generating a prompt for client verification from the masked data of the original file includes the following steps:

[0018] The database DB storing N files is represented as the following n×n two-dimensional matrix, where

[0019]

[0020] Use the pseudo-random function F(key,x) to take the file index as input and calculate the mask for each file, where key is the key of the pseudo-random function. After obtaining the masked database X, store it on different servers:

[0021]

[0022] Generate a random vector R according to the following formula and calculate the inner product hint of the random vector R and each row vector of the database to obtain the linear combination of the elements of each row of the database X:

[0023]

[0024] in, Represents the inner product calculation of the vector and each row in the matrix;

[0025] Share the pseudo-random function F(key,x) and its key, inner product hint, and random vector R with the client as a hint.

[0026] As a preferred solution, the steps of constructing a query based on the index set of the batch query by the client include:

[0027] The ascending order of the index set to be queried is represented as S = [s1,...,s n ], where s j ∈[N], the client first calculates the column subscript set of each index in the database as I=[i1,...,i n ], then construct a query for each index based on the subscripts in set I; assuming index s j The column index in the database is i j , then for index s j The query is constructed as follows:

[0028]

[0029] Among them, α j , β j is a random number, R is a random vector of length n, is a standard basis vector of length n, that is, only at position i j The value of the position is 1, and the rest of the positions are 0; the final query constructed is Q=(q1,...,q n ).

[0030] As a preferred solution, in the step of calculating and generating a response corresponding to the query, after the server receives the query sent by the client, it calculates the inner product a of the corresponding query and the stored file according to the following formula: j :

[0031]

[0032] The final response generated is A=(a1,...,a n ).

[0033] As a preferred solution, the step of the client verifying the response according to the prompt includes:

[0034] The search results after adding the mask are calculated according to the following formula:

[0035]

[0036] Using the pseudo-random function F(key,x) and the retrieved file index, the mask value of each file is calculated and subtracted according to the following formula to obtain the original file data:

[0037]

[0038] Compare the retrieval results of the same index to see if they are equal, that is, for the retrieved file index s j ∈S, compare and Are they equal? If they are equal, then This is the final retrieval result; if they are not equal, it means that at least one server returned an incorrect result in this calculation, and the client needs to interact with the data owner to determine the identity of the Byzantine server.

[0039] As a preferred solution, the steps of the client performing response verification include:

[0040] Assume that the set of response tuples that fail verification is:

[0041]

[0042] The corresponding index set is SU={s 1 ,...,s u};

[0043] The client issues a challenge U to the data owner. For each element of the tuple The data owner queries the index set of the corresponding element in the database And return a list of all index collections as the response content:

[0044]

[0045] For each index s in SU u , client verification collection index collection Does it contain s u ;like Contains s u , it means that the query index is s u When the file is 1-t ; If s is not included in both index sets u , it means that the two servers are in the process of u If an error result is returned during the file retrieval process, the protocol is terminated.

[0046] In a second aspect, an embodiment of the present invention proposes an application of the aforementioned Byzantine attack-resistant batch private information retrieval method when the data owner is a medical institution or a financial institution.

[0047] In a third aspect, an embodiment of the present invention further provides a batch private information retrieval system resistant to Byzantine attacks, comprising:

[0048] A prompt receiving module, configured for the client to receive a prompt for verification generated by the masked data of the original file;

[0049] The query building module is used by the client to build queries based on the index set of batch queries;

[0050] Response calculation module, used to calculate and generate the response corresponding to the query;

[0051] The response verification module is used by the client to verify the response according to the prompt. If the response verification passes, the retrieved file set is obtained; if the response verification fails, a response verification challenge is initiated;

[0052] The response verification module is used for the client to perform response verification. If the response verification passes, the retrieved file set is obtained; if the response verification fails, the protocol is terminated.

[0053] In a fourth aspect, an embodiment of the present invention further provides an electronic device, including:

[0054] A memory storing at least one instruction; and a processor executing the instruction stored in the memory to implement the batch private information retrieval method resistant to Byzantine attacks.

[0055] In a fifth aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for batch private information retrieval that is resistant to Byzantine attacks is implemented.

[0056] Compared with the prior art, the present invention has at least the following beneficial effects:

[0057] The batch privacy information retrieval method for resisting Byzantine attacks of the present invention can identify all Byzantine servers. First, the client verifies the response of the server. If the verification fails, it means that there is at least one Byzantine server. Then, a challenge is issued to the data owner, and the data owner's response is verified to identify the specific identity of the Byzantine server. At the same time, batch queries can be realized. By constructing a query for each row vector of the database, a file can be retrieved in each row vector of the database. In one search, n files located in different rows can be queried without executing multiple queries, thereby realizing batch privacy information retrieval. The present invention can obtain correct results when there is only one honest server. Through the interaction between the client and the data owner, for each file retrieved, as long as one of the servers returns the correct result, the client can correctly obtain all files of this batch retrieval. In addition, the storage overhead of the client of the present invention is small. As the number of files continues to increase, the amount of data required for client storage increases less, and the construction and update method of the prompt are also relatively simple. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. It should be understood that the following drawings only show some embodiments of the present invention. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without paying any creative work.

[0059] Figure 1 Schematic diagram of the batch private information retrieval method against Byzantine attacks according to an embodiment of the present invention;

[0060] Figure 2 Detailed flow chart of the batch private information retrieval method against Byzantine attacks according to an embodiment of the present invention;

[0061] Figure 3 A graph showing changes in communication volume and client storage data volume under different file numbers in an embodiment of the present invention;

[0062] Figure 4 A graph showing changes in communication volume and client storage data volume under different file sizes in an embodiment of the present invention. DETAILED DESCRIPTION

[0063] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, ordinary technicians in this field can also derive other embodiments without making any creative work.

[0064] See also Figure 1In an embodiment of the present invention, a method for batch private information retrieval that is resistant to Byzantine attacks proposes that the data owner uses a pseudo-random function to desensitize database entries and then uploads them to two servers. The client constructs a query based on the index set of the batch query and sends it to the server. After receiving the query, the server calculates a response value and returns it to the client. The client verifies the response result to achieve file retrieval.

[0065] The data owner can usually be one or more different types of institutions or entities, such as medical institutions such as hospitals and clinics that own patient medical records, diagnostic data and other information, or financial institutions such as banks and insurance companies that hold customer financial data, risk assessment data and other information.

[0066] See also Figure 2 The batch private information retrieval method against Byzantine attacks according to an embodiment of the present invention specifically includes:

[0067] S1. The client receives a prompt for verification generated by adding masked data to the original file;

[0068] S2. The client constructs a query based on the index set for batch query;

[0069] S3. Calculate and generate a response corresponding to the query;

[0070] S4. The client verifies the response according to the prompt. If the response verification passes, the retrieved file set is obtained; if the response verification fails, a challenge for response verification is initiated;

[0071] S5. The client performs response verification. If the response verification passes, the retrieved file set is obtained; if the response verification fails, the protocol is terminated.

[0072] In this embodiment, step S3 is performed by two different servers storing the masked file, each server storing the same copy. The server calculates a response based on the received query and the stored file, and returns the response to the client.

[0073] The data owner masks the data and stores it on the server. Based on the masked data, they generate a prompt and share it with the client. The client constructs a query based on the query index set and uploads it to the server. The server generates a response based on the query and returns it to the client. The client first verifies the response using the prompt. If the response passes verification, the retrieved file set is obtained. If the response fails verification, the client issues a challenge to the data owner and verifies the data owner's response. If the response passes verification, the retrieved file set is obtained. If the response also fails verification, the protocol terminates.

[0074] The batch privacy information retrieval method that resists Byzantine attacks in the embodiment of the present invention can identify Byzantine servers. First, the client verifies the responses of the two servers. If the verification fails, it means that there is at least one Byzantine server. Then, a challenge is issued to the data owner, and the data owner's response is verified to identify the identity of the Byzantine server. Secondly, the batch privacy information retrieval method that resists Byzantine attacks in the embodiment of the present invention can realize batch query. By constructing a query for each row vector of the database, a file can be retrieved in each row vector of the database to realize batch privacy information retrieval. At the same time, the batch privacy information retrieval method that resists Byzantine attacks in the embodiment of the present invention can obtain correct results when there is only one honest server. Through the interaction between the client and the data owner, for each file retrieved, as long as one of the servers returns the correct result, the client can correctly obtain all the files of this batch retrieval.

[0075] Furthermore, in a possible implementation, generating a prompt for client verification from masked data of the original file includes the following steps:

[0076] The database DB storing N files is represented as the following n×n two-dimensional matrix, where

[0077]

[0078] The data owner uses a pseudo-random function F(key,x) with the file index as input to calculate a mask for each file, where key is the key of the pseudo-random function. After obtaining the masked database X, it is stored on two servers, Server1 and Server2:

[0079]

[0080] Next, generate a random vector R according to the following formula and calculate the inner product hint of the random vector R and each row vector of the database to obtain the linear combination of the elements of each row of the database X:

[0081]

[0082] in, Represents the inner product calculation of the vector and each row in the matrix;

[0083] Share the pseudo-random function F(key,x) and its key, inner product hint, and random vector R with the client as a hint.

[0084] Step S2: The client constructs a query based on the index set for the batch query, including:

[0085] The embodiment of the present invention can obtain a file of each row in one query, and the index set to be queried in ascending order is represented as S=[s1,...,s n ], where s j ∈[N], the client first calculates the column subscript set of each index in the database as I=[i1,...,i n ], then construct a query for each index based on the subscripts in set I; assuming index s j The column index in the database is i j , then for index s j The query is constructed as follows:

[0086]

[0087] Among them, α j , β j is a random number, R is a random vector of length n, is a standard basis vector of length n, that is, only at position i j The value of the position is 1, and the rest of the positions are 0; the final query constructed is Q=(q1,...,q n ).

[0088] Since R is uniformly randomly generated and independent of the query index s j Therefore, the server will not obtain any information about the query index from the received query, protecting the client's query privacy.

[0089] In a possible implementation, in step S3, after the server receives the query sent by the client, it calculates the inner product a of the corresponding query and the stored file according to the following formula: j :

[0090]

[0091] The final response generated is A=(a1,...,a n ).

[0092] In one possible implementation, the step of the client verifying the response according to the prompt includes:

[0093] The search results after adding the mask are calculated according to the following formula:

[0094]

[0095] Using the pseudo-random function F(key,x) and the retrieved file index, the mask value of each file is calculated and subtracted according to the following formula to obtain the original file data:

[0096]

[0097] Compare the retrieval results of the same index to see if they are equal, that is, for the retrieved file index s j ∈S, compare and Are they equal? If they are equal, then This is the final retrieval result; if they are not equal, it means that at least one server returned an incorrect result in this calculation, and the client needs to interact with the data owner to determine the identity of the Byzantine server.

[0098] Furthermore, if the response verification in step S4 fails, step S5 needs to be executed to verify the identity of the Byzantine server. The steps of the client's response verification include:

[0099] Assume that the set of response tuples that fail the verification in step S4 is:

[0100]

[0101] The corresponding index set is SU={s 1 ,...,s u};

[0102] The client issues a challenge U to the data owner. For each element of the tuple The data owner queries the index set of the corresponding element in the database And return a list of all index collections as the response content:

[0103]

[0104] For each index s in SU u , client verification collection index collection Does it contain s u ;like Contains s u , it means that the query index is s u When the file is 1-t ; If s is not included in both index sets u , it means that the two servers are in the process of u If an error result is returned during the file retrieval process, the protocol is terminated.

[0105] Compared with the existing information retrieval scheme using parity check code and client storage, the present invention has the following advantages:

[0106] Batch retrieval is possible: n files located in different rows can be queried in one retrieval without having to perform multiple queries.

[0107] Identifying all Byzantine servers: First, response verification is performed to determine if any Byzantine servers exist. Since two servers can be malicious but not colluding, the possibility of both servers simultaneously returning identical error responses can be ignored. Response verification is then performed by issuing a challenge to the data owner to determine the specific identity of the Byzantine server.

[0108] The client has low storage overhead: the client only needs to store two vectors R and hint of length n, with a total of 2n elements, and a pseudo-random function F to retrieve files privately and correctly in batches.

[0109] Simple prompt construction and updating: To construct a prompt, the data owner only needs to uniformly randomly generate a vector R of length n and calculate the inner product of R with each row element. To update the prompt, primarily R, the client can construct n random vectors and send them to two servers. The two random vectors with the same response are selected as the new random vector.

[0110] The embodiment of the present invention compares the total communication volume (including verification) and the amount of data stored on the client under different file numbers and different file sizes to verify the changes in the communication volume and the amount of data stored on the client.

[0111] Figure 3 The changes in communication volume and client storage data volume under different file numbers are shown. The experimental setting parameters are: query vector element size E = 1 Byte, file size F = 1KB, pseudo-random function and its key size P = 54 Byte. Figure 3 It can be seen that as the number of files continues to increase, the amount of data required to be stored on the client side increases less.

[0112] Figure 4 This paper shows how communication traffic and client-stored data change under varying file sizes. The experimental parameters are: query vector element size E = 1 byte, number of files N = 100, and pseudorandom function and key size P = 54 bytes. This shows that as file size increases, the amount of data required to be stored by the client grows only slowly.

[0113] Another embodiment of the present invention further provides a batch private information retrieval system resistant to Byzantine attacks, comprising:

[0114] A prompt receiving module, configured for the client to receive a prompt for verification generated by the masked data of the original file;

[0115] The query building module is used by the client to build queries based on the index set of batch queries;

[0116] Response calculation module, used to calculate and generate the response corresponding to the query;

[0117] The response verification module is used by the client to verify the response according to the prompt. If the response verification passes, the retrieved file set is obtained; if the response verification fails, a response verification challenge is initiated;

[0118] The response verification module is used for the client to perform response verification. If the response verification passes, the retrieved file set is obtained; if the response verification fails, the protocol is terminated.

[0119] Another embodiment of the present invention further proposes an electronic device, comprising: a memory storing at least one instruction; and a processor executing the instruction stored in the memory to implement the batch private information retrieval method resistant to Byzantine attacks.

[0120] An embodiment of the present invention further provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the method for batch private information retrieval that is resistant to Byzantine attacks is implemented.

[0121] Exemplarily, the instructions stored in the memory can be divided into one or more modules / units, which are stored in a computer-readable storage medium and executed by the processor to implement the Byzantine attack-resistant batch private information retrieval method of the present invention. The one or more modules / units can be a series of computer-readable instruction segments capable of performing specific functions, which are used to describe the execution process of the computer program in the server.

[0122] The electronic device may be a computing device such as a smartphone, laptop, PDA, or cloud server. The electronic device may include, but is not limited to, a processor and memory. Those skilled in the art will appreciate that the electronic device may include more or fewer components, or a combination of certain components, or different components. For example, the electronic device may also include input / output devices, network access devices, buses, and the like.

[0123] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc.

[0124] The memory may be an internal storage unit of the server, such as a hard disk or memory of the server. The memory may also be an external storage device of the server, such as a plug-in hard disk equipped on the server, a Smart Media Card (SMC), a Secure Digital (SD) card, a Flash Card, etc. Furthermore, the memory may include both an internal storage unit of the server and an external storage device. The memory is used to store the computer-readable instructions and other programs and data required by the server. The memory may also be used to temporarily store data that has been output or is about to be output.

[0125] It should be noted that the information interaction, execution process, etc. between the above-mentioned module units are based on the same concept as the method embodiment. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0126] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated into one processing unit, or each unit can exist physically alone, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0127] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by a processor, it can implement the steps of the above-mentioned various method embodiments. Among them, the computer program includes computer program code, which can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium can at least include: any entity or device that can carry the computer program code to the camera / terminal device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunications signal and a software distribution medium. For example, a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk.

[0128] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant description of other embodiments.

[0129] The above-described embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present application, and should all be included in the scope of protection of the present application.

Claims

1. A batch private information retrieval method resistant to Byzantine attacks, characterized in that: include: The client receives a verification prompt generated by adding masked data to the original file; The client constructs a query based on the index set for batch query; Calculate and generate the response corresponding to the query; The client verifies the response according to the prompt. If the response verification passes, the retrieved file set is obtained; if the response verification fails, a challenge for response verification is initiated; The client performs response verification. If the response verification passes, the retrieved file set is obtained; If the response verification fails, the protocol is terminated; Generating a client-side verification prompt from the masked data of the original file includes the following steps: The database DB storing N files is represented as the following n×n two-dimensional matrix, where Use the pseudo-random function F(key,x) to take the file index as input and calculate the mask for each file, where key is the key of the pseudo-random function. After obtaining the masked database X, store it on different servers: Generate a random vector R according to the following formula and calculate the inner product hint of the random vector R and each row vector of the database to obtain the linear combination of the elements of each row of the database X: in, Represents the inner product calculation of the vector and each row in the matrix; Share the pseudo-random function F(key,x) and its key, inner product hint, and random vector R with the client as a hint.

2. The batch private information retrieval method against Byzantine attacks according to claim 1 is characterized in that: The steps for the client to construct a query based on the index set for batch query include: The ascending order of the index set to be queried is represented as S = [s1,...,s n ], where s j ∈[N], the client first calculates the column subscript set of each index in the database as I=[i1,...,i n ], then construct a query for each index based on the subscripts in set I; assuming index s j The column index in the database is i j , then for index s j The query is constructed as follows: q j =α j R+β j e ij =[α j r1,…,α j r ij ,…,α j r n ]+[0,…,β j ,…,0] ＝[α j r1,…,α j r ij +β j ,…,α j r n ] Among them, α j , β j is a random number, R is a random vector of length n, e ij is a standard basis vector of length n, that is, only at position i j The value of the position is 1, and the rest of the positions are 0; the final query constructed is Q=(q1,...,q n ).

3. The batch private information retrieval method against Byzantine attacks according to claim 2 is characterized in that: In the step of calculating and generating a response corresponding to the query, after the server receives the query sent by the client, it calculates the inner product a of the corresponding query and the stored file according to the following formula: j : The final response generated is A=(a1,...,a n ).

4. The batch private information retrieval method against Byzantine attacks according to claim 3 is characterized in that: The steps for the client to verify the response based on the prompt include: The search results after adding the mask are calculated according to the following formula: Using the pseudo-random function F(key,x) and the retrieved file index, the mask value of each file is calculated and subtracted according to the following formula to obtain the original file data: Compare the retrieval results of the same index to see if they are equal, that is, for the retrieved file index s j ∈S, compare and Are they equal? If they are equal, then This is the final retrieval result; if they are not equal, it means that at least one server returned an incorrect result in this calculation, and the client needs to interact with the data owner to determine the identity of the Byzantine server.

5. The batch private information retrieval method against Byzantine attacks according to claim 4 is characterized in that: The steps for the client to perform response verification include: Assume that the set of response tuples that fail verification is: The corresponding index set is SU={s 1 ,...,s u }; The client issues a challenge U to the data owner. For each element of the tuple The data owner queries the index set of the corresponding element in the database And return a list of all index collections as the response content: For each index s in SU u , client verification collection index collection Does it contain s u ;like Contains s u , it means that the query index is s u When the file is 1-t ; If s is not included in both index sets u , it means that the two servers are in the process of u If an error result is returned during the file retrieval process, the protocol is terminated.

6. Application of the Byzantine attack-resistant batch private information retrieval method according to any one of claims 1 to 5 in a case where the data owner is a medical institution or a financial institution.

7. A batch private information retrieval system resistant to Byzantine attacks, characterized in that: include: A prompt receiving module, configured for the client to receive a prompt for verification generated by the masked data of the original file; The query building module is used by the client to build queries based on the index set of batch queries; Response calculation module, used to calculate and generate the response corresponding to the query; The response verification module is used for the client to verify the response according to the prompt. If the response verification passes, the retrieved file set is obtained; If the response verification fails, a challenge for answer verification is initiated; The response verification module is used for the client to perform response verification. If the response verification passes, the retrieved file set is obtained; If the response verification fails, the protocol is terminated; Generating a client-side verification prompt from the masked data of the original file includes the following steps: The database DB storing N files is represented as the following n×n two-dimensional matrix, where Use the pseudo-random function F(key,x) to take the file index as input and calculate the mask for each file, where key is the key of the pseudo-random function. After obtaining the masked database X, store it on different servers: Generate a random vector R according to the following formula and calculate the inner product hint of the random vector R and each row vector of the database to obtain the linear combination of the elements of each row of the database X: in, Represents the inner product calculation of the vector and each row in the matrix; Share the pseudo-random function F(key,x) and its key, inner product hint, and random vector R with the client as a hint.

8. An electronic device, characterized in that: include: a memory storing at least one instruction; and A processor executes instructions stored in the memory to implement the batch private information retrieval method resistant to Byzantine attacks as described in any one of claims 1 to 5.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method for batch private information retrieval against Byzantine attacks as claimed in any one of claims 1 to 5 is implemented.

Images