Three-party equivalence query method, device, storage medium and electronic device

Abstract

The embodiment of the present application discloses a three-party equivalence query method, which relates to the field of trusted secret computing technology. The method allows the index establishment and query process to be independently completed by the secret state oblivious distributed data storage system without the need to interact with the data provider and the queryer, thereby ensuring the high security of data interaction and being applicable to the trusted secret computing system. The secret state oblivious distributed data storage system, the three-party equivalence query device, the storage medium and the electronic device described in the embodiments of this specification also have the above-mentioned beneficial effects.

Description

Technical Field

[0001] The present invention relates to the field of trusted secret computing technology, and in particular to a method, device, storage medium and electronic device for three-party secret data equivalence query. Background Art

[0002] In a trusted secret computing system, data may come from multiple data providers or be the result of data fusion from multiple data providers. No single party has the right to access the plaintext data. In a trusted secret computing system, a fully secret, non-interactive data query process needs to be implemented. Existing data query methods, such as searchable encryption, anonymous query, and other ciphertext-based query methods, require interaction between the client and the server, and are not applicable to trusted secret computing systems. Summary of the invention

[0003] One or more embodiments of the present specification provide a method, device, storage medium and electronic device for three-party confidential data equivalence query, which can provide a safe and efficient fully confidential, non-interactive index establishment and query solution and can be well applied to trusted confidential computing systems.

[0004] In a first aspect, a dense oblivious distributed data storage system is proposed, the system comprising:

[0005] An oblivious random access machine storing a number of data in a tree structure and an index table of the oblivious random access machine;

[0006] The first, second and third servers are each configured to obtain a secret share of the index table and a secret share of the oblivious random access machine through a three-party secret sharing scheme as their respective secret state index table and secret state oblivious random access machine;

[0007] In the query phase, any one of the first, second, and third servers is used as a query server; the query server shares the query information with the other two servers through the three-party secret sharing scheme, and performs secret recovery based on the secret shares of the query results fed back by the other two servers to obtain the target data;

[0008] In the eviction phase, each server shares the eviction scheme through the three-party secret sharing scheme and performs the eviction operation according to the eviction scheme.

[0009] As an optional implementation manner of the system described in the first aspect, the three-party secret sharing scheme supports additive homomorphism and multiplicative homomorphism of at least two secret shares of the shared secret under three-party secret sharing.

[0010] As an optional implementation of the system described in the first aspect, the three-party secret sharing scheme is a replicated secret sharing protocol.

[0011] As an optional implementation of the system described in the first aspect, the first, second and third servers run in a local area network.

[0012] As an optional implementation of the system described in the first aspect, the first, second, and third servers are also configured to store the secret index table and the secret oblivious random access machine in a trusted execution environment, and perform data access operations on the secret index table and the secret oblivious random access machine in the trusted execution environment.

[0013] As an optional implementation manner of the system of the first aspect, the index table is used to describe the correspondence between the address index, leaf node and position index of the data block in the tree structure; the query stage specifically includes:

[0014] The query server shares the address index of the target data with the other two servers through the three-party secret sharing scheme, and performs secret recovery based on the secret address shares fed back by the other two servers to obtain the leaf node and location index of the target data;

[0015] The query server generates a data query vector based on the leaf node and position index of the target data and shares it with the other two servers through the three-party secret sharing scheme; and performs secret recovery according to the secret shares of the confidential data fed back by the other two servers to obtain the target data.

[0016] As an optional implementation manner of the system according to the first aspect, the query stage specifically includes:

[0017] After each query, the query server generates a new address for the target data, and shares the new address with the other two servers through the three-party secret sharing scheme;

[0018] The other two servers update their respective secret index tables according to the secret share of the new address, and in the eviction phase, update the secret share of the secret data of the target data rewritten by the query server through the three-party secret sharing scheme to the corresponding position of their respective secret oblivious random access machines according to the updated secret index table.

[0019] Specifically, the query stage also includes:

[0020] The query server generates a location update vector at each query, and shares the location update vector with the other two servers through the three-party secret sharing scheme;

[0021] The other two servers update all data blocks on the path where the target data is located in their respective secret oblivious random access machines according to the secret share of the position update vector, place the secret share of the secret data of the target data in the root node, and put the remaining data blocks back to the original position of the data block.

[0022] More specifically, the expulsion phase includes:

[0023] The first, second and third servers send their updated secret index tables to a trusted third party;

[0024] The trusted third party performs secret recovery according to the updated secret index tables of the first, second and third servers to obtain an updated index table;

[0025] The trusted third party generates a confusion matrix according to the updated index table;

[0026] The first, second and third servers obtain the secret shares of the confusion matrix through the three-party secret sharing scheme, and according to the obtained secret shares of the confusion matrix, evict the data blocks stored in the root nodes of their respective secret oblivious random access machines to the locations specified by the updated secret index table.

[0027] In a second aspect, a three-party equivalence query method is provided, which is applicable to a first server, wherein the first server shares an oblivious random access machine and an index table storing user privacy data in a tree structure with a second server and a third server through a three-party secret sharing scheme to obtain respective secret index tables and secret oblivious random access machines; the method comprises:

[0028] In the query phase, the first server acts as a query server, shares the equal-value query information with the other two servers through the three-party secret sharing scheme, and performs secret recovery based on the query result secret shares fed back by the other two servers to obtain the target data;

[0029] In the eviction phase, the first server shares an eviction scheme with the second and third servers through the three-party secret sharing scheme, and performs an eviction operation according to the eviction scheme.

[0030] As an optional implementation of the method described in the second aspect, the three-party secret sharing scheme supports additive homomorphism and multiplicative homomorphism of at least two secret shares of the shared secret under three-party secret sharing.

[0031] As an optional implementation of the method described in the second aspect, the three-party secret sharing scheme is a replicated secret sharing protocol.

[0032] As an optional implementation of the method described in the second aspect, the first, second and third servers run in a local area network.

[0033] As an optional implementation of the method described in the second aspect, the first, second, and third servers are also configured to store the secret index table and the secret oblivious random access machine in a trusted execution environment, and perform data access operations on the secret index table and the secret oblivious random access machine in the trusted execution environment.

[0034] As an optional implementation of the method of the second aspect, the method for constructing the oblivious random access machine specifically includes:

[0035] Acquiring the user's private data;

[0036] Based on the attributes of the user privacy data, a hash calculation is used to establish an address index for each attribute data of the user privacy data;

[0037] Randomly generate a leaf node and a position index for each of the address indexes to obtain the index table;

[0038] Each piece of attribute data of the user's private data is taken as a data block, and according to the index table, the user's private data is stored in a binary tree to obtain the oblivious random access machine.

[0039] Specifically, the equivalent query steps performed by the query server in the query phase specifically include:

[0040] The query server determines the target address index through hash calculation according to the target attribute value specified in the equal value query request;

[0041] The query server shares the target address index with the other two servers through the three-party secret sharing scheme, and performs secret recovery based on the secret address secret shares fed back by the other two servers to obtain the leaf node and position index corresponding to the target address index;

[0042] The query server generates a data query vector based on the leaf node and the position index and shares it with the other two servers through the three-party secret sharing scheme; and performs secret recovery according to the secret shares of the confidential data fed back by the other two servers to obtain the target data.

[0043] As an optional implementation manner of the method described in the second aspect, the query server is specifically used to generate a new address for the target data after each equal value query, and share the new address with the remaining two servers through the three-party secret sharing scheme; the remaining two servers update their respective secret index tables according to the secret share of the new address, and in the eviction phase, update the secret share of the secret data of the target data rewritten by the query server through the three-party secret sharing scheme to the corresponding position of their respective secret oblivious random access machines according to the updated secret index table.

[0044] More specifically, the query server is also used to generate a location update vector at each query, and share the location update vector with the remaining two servers through the three-party secret sharing scheme; the remaining two servers update all data blocks on the path where the target data is located in their respective secret oblivious random access machines according to the secret share of the location update vector, place the secret share of the secret data of the target data in the root node, and put the remaining data blocks back to the original position of the data block.

[0045] More specifically, the query server is further used to calculate the number of equal value queries, and when the number of equal value queries reaches a preset threshold, enter the expulsion phase;

[0046] In the expulsion phase, the first, second and third servers send their updated secret index tables to a trusted third party;

[0047] The trusted third party performs secret recovery according to the updated secret index tables of the first, second and third servers to obtain an updated index table;

[0048] The trusted third party generates a confusion matrix according to the updated index table;

[0049] The first, second and third servers obtain the secret shares of the confusion matrix through the three-party secret sharing scheme, and according to the obtained secret shares of the confusion matrix, evict the data blocks stored in the root nodes of their respective secret oblivious random access machines to the locations specified by the updated secret index table.

[0050] In a third aspect, a three-party equivalence query device is provided, the device is applied to a first server, the first server shares an oblivious random access machine and an index table storing user privacy data in a tree structure with a second server and a third server through a three-party secret sharing scheme, and obtains their own secret index table and secret oblivious random access machine; the device comprises:

[0051] A data acquisition module configured to acquire equivalent query information;

[0052] The data query module is configured to share the equal-value query information with the other two servers through the three-party secret sharing scheme during the query phase, and perform secret recovery based on the secret shares of the query results fed back by the other two servers to obtain the target data;

[0053] The data eviction module is configured to share the eviction scheme with the second and third servers through the three-party secret sharing scheme during the eviction phase, and perform the eviction operation according to the eviction scheme.

[0054] As an optional implementation manner of the device described in the third aspect, the three-party secret sharing scheme supports additive homomorphism and multiplicative homomorphism of at least two secret shares of the shared secret under three-party secret sharing.

[0055] As an optional implementation manner of the device described in the third aspect, the three-party secret sharing scheme is a replicated secret sharing protocol.

[0056] As an optional implementation manner of the device described in the third aspect, the first, second and third servers run in a local area network.

[0057] As an optional implementation of the device described in the third aspect, the device also includes a trusted execution environment, and the trusted execution environment is used to store the confidential index table and confidential oblivious random access machine of the device.

[0058] As an optional implementation manner of the device according to the third aspect, the method for constructing the oblivious random access machine specifically includes:

[0059] Acquiring the user's private data;

[0060] Based on the attributes of the user privacy data, a hash calculation is used to establish an address index for each attribute data of the user privacy data;

[0061] Randomly generate a leaf node and a position index for each of the address indexes to obtain the index table;

[0062] Each piece of attribute data of the user's private data is taken as a data block, and according to the index table, the user's private data is stored in a binary tree to obtain the oblivious random access machine.

[0063] Specifically, the data acquisition module is further used to share the oblivious random access machine and the index table with the second and third servers through the three-party secret sharing scheme to obtain the secret index table and secret oblivious random access machine of the device.

[0064] Specifically, the data query module is specifically used to determine the target address index through hash calculation according to the target attribute value specified in the equal value query request during the query phase; share the target address index with the other two servers through the three-party secret sharing scheme, and perform secret recovery based on the secret address shares fed back by the other two servers to obtain the leaf node and position index corresponding to the target address index; generate a data query vector based on the leaf node and position index and share it with the other two servers through the three-party secret sharing scheme; and perform secret recovery based on the secret data secret shares fed back by the other two servers to obtain the target data.

[0065] As an optional implementation manner of the device described in the third aspect, the data query module is specifically used to generate a new address for the target data after each equal value query, and share the new address with the remaining two servers through the three-party secret sharing scheme; the remaining two servers update their respective secret index tables according to the secret share of the new address, and in the eviction phase, update the secret share of the secret data of the target data rewritten by the query server through the three-party secret sharing scheme to the corresponding position of their respective secret oblivious random access machines according to the updated secret index table.

[0066] Specifically, the data query module is also used to generate a position update vector at each query, and share the position update vector with the remaining two servers through the three-party secret sharing scheme; the remaining two servers update all data blocks on the path where the target data is located in their respective secret oblivious random access machines according to the secret share of the position update vector, place the secret share of the secret data of the target data in the root node, and put the remaining data blocks back to the original position of the data block.

[0067] More specifically, the data eviction module is specifically used to calculate the number of equivalent queries, and when the number of equivalent queries reaches a preset threshold, enter the eviction phase;

[0068] In the eviction phase, the data eviction module sends the updated secret state index table to the trusted third party, and evicts the data block stored in the secret state oblivious random access machine root node to the location specified by the updated secret state index table according to the secret share of the confusion matrix shared by the trusted third party through the three-party secret sharing scheme;

[0069] The confusion matrix is ​​generated by the trusted third party according to the updated index table; the updated index table is obtained by the trusted third party through secret recovery according to the data eviction module and the updated secret index tables of the second and third servers.

[0070] In a fourth aspect, a computer-readable storage medium is provided, wherein the storage medium stores a computer program, and when the computer program is executed by a processor, the specific steps of the above-mentioned three-party equivalence query method are implemented.

[0071] In a fifth aspect, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned three-party equivalence query method when executing the program.

[0072] The beneficial effect of the confidential oblivious distributed data storage system described in one or more embodiments of this specification is that the index establishment and query process are independently completed by the confidential oblivious distributed data storage system without the need to interact with data providers and queryers, thereby ensuring a high degree of security in data interaction and being applicable to trusted confidential computing systems.

[0073] The three-party equivalence query method, device, storage medium and electronic device described in the embodiments of this specification also have the above-mentioned beneficial effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0075] Figure 1 An example of the data structure of Tree ORAM is shown.

[0076] Figure 2 A schematic diagram of the structure of a dense oblivious distributed data storage system provided in one or more embodiments of this specification.

[0077] Figure 3 A schematic diagram of the structure of a binary tree of an oblivious random access machine provided in one or more embodiments of this specification.

[0078] Figure 4 A schematic diagram of the positions of data blocks corresponding to position indexes in a binary tree of an oblivious random access machine provided in one or more embodiments of this specification.

[0079] Figure 5 A schematic diagram of data storage results of an oblivious random access machine provided in one or more embodiments of this specification.

[0080] Figure 6A flowchart of a method for implementing a secret-state obliviously distributed data storage system provided in one or more embodiments of this specification.

[0081] Figure 7 A flowchart of a three-party equivalence query method provided in one or more embodiments of this specification.

[0082] Figure 8 A data eviction method provided in one or more embodiments of this specification Schematic diagram of the process.

[0083] Fig. 9 A schematic diagram of the structure of a three-party equivalence query device provided in one or more embodiments of this specification.

[0084] Fig.10 A schematic diagram of the structure of an electronic device provided in one or more embodiments of this specification. DETAILED DESCRIPTION

[0085] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0086] It should be noted that: in other embodiments, the steps of the corresponding method are not necessarily performed in the order shown and described in this specification. In some other embodiments, the steps included in the method may be more or less than those described in this specification. In addition, a single step described in this specification may be decomposed into multiple steps for description in other embodiments; and multiple steps described in this specification may be combined into a single step for description in other embodiments.

[0087] Those skilled in the art will appreciate that the terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit the present invention. The singular forms of "a", "said" and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings.

[0088] Oblivious Random Access Machine (ORAM) allows customers to access their data on cloud servers without revealing their access patterns. ORAM obfuscates each access process, making it indistinguishable from random access, thereby protecting information such as access operations and access locations in real access. ORAM plays a very important role in cloud computing and secure multi-party computing. Using ORAM can reduce the possibility of attackers inferring user privacy information through access patterns, reduce the attack surface of the system, and thus provide safer and more complete services.

[0089] ORAM is a cryptographic technology that includes a series of cryptographic protocols that allow clients to read and write data to servers without revealing their access patterns. All ORAM schemes require that data stored on the server must be encrypted using a probabilistic encryption scheme (semantically secure). Probabilistic encryption schemes can ensure that the encryption of the same data block corresponds to different ciphertexts. After the data block is operated, it needs to be re-encrypted and written back to the server, so that the server does not know whether a data block has been read or modified. This is a necessary condition to ensure the obfuscation of access patterns. The general process of the ORAM algorithm is:

[0090] 1. The client encrypts the data block using a probabilistic encryption scheme (semantically secure) and sends it to the server by running the operations in the ORAM protocol.

[0091] 2. The server stores physical data blocks in a specific data structure.

[0092] 3. Read and write data blocks. When an ORAM user wants to perform a read operation, after running ORAM, the server returns the data block to the user. If it is a write operation, the server runs the operation in the ORAM protocol to write the data block.

[0093] 4. After the user obtains the data block, it decrypts it and then encrypts it using the probabilistic encryption algorithm, and then returns the data block to the server by running the operations in the ORAM protocol.

[0094] The following is a discussion of certain ORAM configurations and their limitations, followed by a description of new and improved ORAM designs that address the limitations.

[0095] After years of development, ORAM generally includes the following typical solutions: Ring ORAM, Path ORAM and ORAM.

[0096] Path ORAM is mainly based on Tree ORAM. Let's first introduce Tree ORAM. In Tree ORAM, the server uses a binary tree structure to store the client's data blocks. Each node of the binary tree is called a Bucket, and a Bucket can store multiple data blocks. Tree ORAM usually includes the following two algorithms:

[0097] Access(): The client uses this algorithm to read data blocks from the server or write data to the data blocks on the server.

[0098] Evict(): This algorithm is usually run by the server. Its main function is to disrupt the order of data blocks stored on the server to ensure the uncertainty of client access to data.

[0099] In Tree ORAM, the client has a data block address mapping table to store the leaf nodes corresponding to each data block. Figure 1 As shown, assuming that the client has 14 data blocks, the client needs to map these 14 data blocks to the corresponding leaf nodes. After that, when accessing a data block, it is necessary to query the id of the leaf node corresponding to this data block, send this id to the server, reselect a new leaf node for this data block, and then update the data block address mapping table. After receiving it, the server will access the data block on the path of this leaf node id, and then return the data block according to a specific protocol. After the client accesses it, the re-encrypted data block will be placed in the root node. Obviously, if the root node does not distribute its internal data blocks to other nodes, the root node will definitely overflow. Therefore, the server will run the Evict() algorithm to disperse the root node's data blocks to other nodes to ensure that the root node does not overflow. This process needs to ensure the indistinguishability of client access and random access, that is, the relevant information of the client's access mode will not be leaked to the server.

[0100] In Path ORAM, users retrieve / store data in blocks on the cloud. The cloud stores a binary tree structure, where each node has a fixed number of Z data blocks. The client has two data structures: location mapping and Stash storage. Each access (search) to a data block in the ORAM tree requires two protocols: read and write. For example, if a user wants to read a data block, the corresponding leaf node will be obtained through the location mapping, and then the entire path corresponding to the leaf node will be read from the tree on the cloud to the Stash storage. After changing the leaf node corresponding to the read data block, all data blocks are written back to the original path. The data write-back follows the following principle: if the current access node is located at the intersection of the path corresponding to the leaf node mapped by the data block and the current path, the data block can be written to the current node. This is done by accessing multiple data blocks to cover up a data block that is actually wanted to access, thereby hiding the access mode, that is, it is unknown which data block the query actually corresponds to.

[0101] The data structure of Ring ORAM is roughly the same as that of Path ORAM, with only some optimizations made to Path ORAM.

[0102] ORAM is a multi-server distributed ORAM based on Shamir secret sharing. It is based on Tree ORAM and uses the PIR protocol and Shamir secret sharing pairs. It is also an improvement on Onion ORAM based on Tree ORAM. The data block address mapping table contains the location of the data block in each Bucket, that is, the address mapping table pm=(id, pID, pIdx), where id is the identifier of the data block and pID is the leaf node ID corresponding to the data block. ORAM labels each node in the binary tree from top to bottom and from left to right, with the root node being 1, so , H is the height of the binary tree. pIdx is the absolute position of the data block in the Tree ORAM. Assume that Bucket can store at most Z data blocks, so . ORAM mainly includes the following algorithms:

[0103] This algorithm is run by the client. Its main function is to use Tree ORAM to store data in the database DB. That is, the client creates a Tree ORAM T. Then the client uses Shamir secret sharing to secretly split T. Let the split share be , and then distribute to The specific process of this algorithm is as follows:

[0104] This algorithm models the database DB into N data blocks , and their corresponding identifiers are .initialization . They are the number of eviction operations and the number of query operations respectively.

[0105] Based on N data blocks Create a Tree ORAM T.

[0106] set up is the jth data block of the ith node of T. Divide all the data blocks in T into m small blocks, and get .

[0107] For each of the m small blocks of all data blocks, use Shamir secret sharing to perform secret segmentation, and get .

[0108] set up ,get .

[0109] This algorithm is run by the server. By running this algorithm, the client can get the data block b that it wants to read, or write the data that it wants to write. id is the identifier of the data block that the client wants to access, op represents the client's request, and op can only be read or written. Represents the data that the client wants to write. When the op is read, this value can be empty. The specific process of this algorithm is as follows:

[0110] use , get the data you want to access according to the id .

[0111] Reselect the corresponding leaf node for this data block, that is , and set pIdx to .

[0112] If op is a write, then .

[0113] Divide the data block b into m small blocks, that is, .

[0114] Shamir secret sharing is performed on each of the m small blocks, that is, .

[0115] Write the Shamir secret shares of these m small blocks into the corresponding servers respectively.

[0116] calculate .

[0117] like Then execute algorithm, and update .

[0118] Returns b.

[0119] The algorithm is actually an eviction algorithm. The main method used by this eviction algorithm is to use Shamir secret sharing and SMP protocol to perform data block obfuscation operations and multi-layer encryption operations. The main process of this algorithm is that the client generates a permutation matrix, and then the client sends this permutation matrix to the server. After the server receives it, it starts from the root node and performs some calculation operations on the buckets on the specified path to confuse their order. For the adjacent buckets on the specified path, directly copy the data blocks of their parent buckets until it reaches the leaf node.

[0120] The defects of the above existing solutions are mainly:

[0121] (1) Ring ORAM, Path ORAM and ORAM is a client-server model that requires interaction with the client to complete certain operations required for queries, so the client or data owner must remain online during the query process. In addition, since the performance of the interaction is limited by bandwidth, the query efficiency is low, which is limited by the bandwidth rate of the network in actual scenarios.

[0122] (2) Ring ORAM, Path ORAM and The client-server model used by ORAM requires the client to be completely trustworthy, but it is difficult to fully trust the client in real scenarios.

[0123] (3) Ring ORAM and Path ORAM cannot meet the multi-server mode under the TECC system, and therefore cannot be directly applied to the TECC system and need to be improved; ORAM can meet the needs of multi-server mode, but the client mode cannot be directly applied to the TECC system and needs to be improved.

[0124] (4) Ring ORAM, Path ORAM and ORAM cannot be directly adapted to the TECC system.

[0125] (5) Ring ORAM and Path ORAM use a single server, which has a single point of failure problem. That is, if this server goes down, it will no longer be able to provide query services. The solution has poor robustness and lacks fault tolerance.

[0126] Based on the above reasons, the above solutions Ring ORAM, Path ORAM and ORAM cannot meet the needs of fully encrypted and non-interactive encrypted indexing and querying because they require the client to interact with the server, the client needs to be online throughout the process, and the address mapping table stored on the client needs to be in plain text. It cannot be directly applied to the TECC (Trusted-Environment-Based Cryptographic Computing) system.

[0127] In view of this, the present embodiment provides a confidential oblivious distributed data storage system, a three-party confidential data equivalence query method, device, storage medium and electronic device to at least partially overcome the defects of the above-mentioned solutions.

[0128] In some embodiments, a dense state oblivious distributed data storage system is provided, please refer to Figure 2 The system includes: an oblivious random access machine storing a number of data in a tree structure and an index table of the oblivious random access machine; and a first, a second, and a third server, each of which is configured to obtain a secret share of the index table and a secret share of the oblivious random access machine through a three-party secret sharing scheme as their own secret index table and secret oblivious random access machine.

[0129] In the above system, no client is required, and only some initialization operations by a third party such as a user or organization are required to construct the above-mentioned oblivious random access machine and the index table of the oblivious random access machine, after which the third party such as the user or organization can go offline. The first, second, and third servers do not require the participation of third parties such as users or organizations in the construction of their respective secret index tables and secret oblivious random access machines, as well as the operation of data.

[0130] In some embodiments, the above-mentioned oblivious random access machine and the index table of the oblivious random access machine can be constructed in the following manner: first, the user privacy data is obtained; then, based on the attributes of the user privacy data, a hash calculation is used to establish an address index for each attribute data of the user privacy data; then, a leaf node and a position index are randomly generated for each address index to obtain the above-mentioned index table; finally, each attribute data of the user privacy data is taken as a data block, and according to the index table, the user privacy data is stored in a binary tree to obtain the above-mentioned oblivious random access machine.

[0131] A third party such as a user or organization publishes the constructed oblivious random access machine and the index table of the oblivious random access machine to the first, second, and third servers, and the first, second, and third servers obtain the secret share of the oblivious random access machine and the secret share of the index table through a three-party secret sharing scheme, thereby obtaining their own secret index table and secret oblivious random access machine.

[0132] In the above three-party secret sharing scheme, the plaintext data to be shared is divided into three secret shares, and the first, second, and third servers respectively obtain two of the secret shares, and the secret shares obtained by each server are not exactly the same. When recovering data, all three secret shares are required to recover the plaintext data. This scheme performs three-party secret sharing on the oblivious random access machine and the index table of the oblivious random access machine that needs to be stored. Each server saves the secret sharing share instead of the plaintext data, and the secret share saved by each server is not enough to reconstruct the plaintext data, thereby ensuring the confidentiality of the data and being directly applicable to the trusted secret computing system.

[0133] The working process of the above system mainly includes the query phase and the expulsion phase. In the query phase, any one of the first, second, and third servers is used as the query server. The query server shares the query information with the other two servers through a three-party secret sharing scheme, and performs secret recovery based on the secret share of the query result fed back by the other two servers to obtain the target data. In the expulsion phase, each server shares the expulsion scheme through a three-party secret sharing scheme, and performs the expulsion operation according to the expulsion scheme.

[0134] In some implementations, the above index table is used to describe the correspondence between the address index, leaf node, and position index of the data block in the tree structure. Based on this, the query stage specifically includes:

[0135] The query server shares the address index of the target data with the other two servers through a three-party secret sharing scheme, and performs secret recovery based on the secret address shares fed back by the other two servers to obtain the leaf node and location index of the target data.

[0136] The query server generates a data query vector based on the leaf node and position index of the target data and shares it with the other two servers through a three-party secret sharing scheme; and performs secret recovery based on the secret shares of the confidential data fed back by the other two servers to obtain the target data.

[0137] In addition, in the query phase, after each query, the query server needs to write the operated target data back to the secret state oblivious random access machines of the other two servers. Accordingly, the other two servers need to update their respective secret state index tables. Therefore, the query server generates a new address for the target data after each query, and shares the new address with the other two servers through a three-party secret sharing scheme. The other two servers update their respective secret state index tables according to the secret share of the new address, and in the eviction phase, update the secret share of the secret state data of the target data rewritten by the query server through the three-party secret sharing scheme to the corresponding position of their respective secret state oblivious random access machines according to the updated secret state index table.

[0138] While updating the location of the target data, it is also necessary to update the location of the data blocks on the original storage path of the target data in the secret state oblivious random access machines of the other two servers. Specifically, the query server generates a location update vector each time it queries, and shares the location update vector with the other two servers through a three-party secret sharing scheme. The other two servers update all data blocks on the path where the target data is located in their respective secret state oblivious random access machines according to the secret share of the location update vector, place the secret share of the target data in the root node, and put the remaining data blocks back to the original location of the data block. In other words, the secret share of the rewritten target data is not directly stored in the location corresponding to the new address in the secret state oblivious random access machine, but is first stored in the root node of the secret state oblivious random access machine, and then in the eviction phase, it is evicted to the location corresponding to the new address in the secret state oblivious random access machine through a preset eviction strategy.

[0139] The above-mentioned expulsion operation can be performed by a trusted third party, but it does not need to obtain authorization from third-party institutions such as users or organizations. It only participates in the obfuscated expulsion operation and does not need to stay online all the time. For example, in reality, third-party institutions such as governments and enterprises are always needed to build data platforms, so they can act as trusted third parties and be responsible for participating in the expulsion operation.

[0140] In some implementations, the trusted third party may use a confusing expulsion method to implement the above expulsion operation, which may specifically include the following steps:

[0141] The first, second and third servers send their updated secret index tables to the trusted third party.

[0142] The trusted third party performs secret recovery based on the updated secret index tables of the first, second and third servers to obtain an updated index table.

[0143] The trusted third party generates a confusion matrix based on the updated index table.

[0144] The first, second and third servers obtain the secret shares of the confusion matrix through a three-party secret sharing scheme, and according to the obtained secret shares of the confusion matrix, evict the data blocks stored in the root nodes of their respective secret oblivious random access machines to the locations specified by the updated secret index table.

[0145] In some implementations, the first, second, and third servers mentioned above may be in a wide area network (extranet) or a local area network (intranet). Obviously, the interaction between the three servers can be performed only in the intranet, and there is no need to remotely interact with the client or the data owner during query. The query performance is not limited by the bandwidth between the client and the server, so the query efficiency is relatively high.

[0146] In some embodiments, the first, second, and third servers mentioned above may also be configured to store the secret index table and the secret oblivious random access machine in a trusted execution environment, and perform data access operations on the secret index table and the secret oblivious random access machine in the trusted execution environment.

[0147] In some implementations, the functions of the first, second, and third servers mentioned above can be decomposed into multiple computing tasks, and the computing tasks obtained by decomposing the functions of each server can be undertaken by one or more computing partition clusters. For example, the function of a server can be undertaken by a TEE partition cluster, and a TEE partition cluster contains multiple TEEs, which run in a high-speed network, i.e., an intranet, and are compatible with a trusted secret computing system.

[0148] It should be noted that the above three-party secret sharing scheme can adopt a variety of secret sharing algorithms, as long as the secret sharing algorithm satisfies additive homomorphism and multiplicative homomorphism under three parties, and this embodiment does not limit this. Specifically, the above three-party secret sharing scheme supports additive homomorphism and multiplicative homomorphism of at least two secret shares of the shared secret under three-party secret sharing.

[0149] Below, we will take the replicated secret sharing protocol as an example to explain the specific implementation of the above-mentioned secret state oblivious distributed data storage system. The replicated secret sharing is the 2-out-of-3 replicated secret sharing scheme (RSS for short) proposed by Araki et al. at the CCS 2016 conference. The scheme mainly includes two algorithms: The oblivious random access machine used in this embodiment is the one proposed by Hoang et al. at the CCS 2017 conference. Oblivious access machine ORAM, the solution mainly includes two algorithms ) However, the encrypted oblivious random access machine (EORAM) in this embodiment is different from ORAM is not exactly the same, because the EORAM in this embodiment is based on the RSS secret sharing algorithm, and the leaf node location index table is stored in a secret state on the first, second, and third servers instead of on the client. Algorithms and Different from ORAM, this embodiment uses the deterministic path backfilling method proposed by Gentry et al. at the PETS 2013 conference to perform eviction. Given a height of ORAM binary tree, each layer is marked with 0 on the left and 1 on the right, then The eviction operation is deterministically chosen to be , Represents an integer The binary reverse representation of .

[0150] In order to clearly explain the specific implementation of the above-mentioned secret state oblivious distributed data storage system, the relevant characters involved in the specific implementation are first explained. As shown in Table 1, the meanings of the relevant characters involved in the specific implementation of the above-mentioned secret state oblivious distributed data storage system are shown.

[0151] Table 1 Symbols

[0152]

[0153] Table 1 shows the variable names and their meanings. Assume that one row of the table corresponds to one target object and one column corresponds to one attribute value. For example, if the target object is a natural person, the attribute value can be the target object's private data such as salary, age, weight, etc. For ease of description, when i∈{1,2,3}, i+1 and i-1 correspond to the number after and before i, respectively, that is, when i=1, i-1=3; when i=3, i+1=1; i+2 is equivalent to i-1.

[0154] Please refer to Figure 6 The specific implementation of the above-mentioned encrypted oblivious distributed data storage system includes steps S600 to S608:

[0155] S600: Acquire user privacy data, and establish a data address index table according to the attribute value of the user privacy data.

[0156] Take the user privacy data shown in Table 2 as an example. In Table 2, the data plaintext obtained according to the attribute value is , each line is the plaintext of the private data of a target object.

[0157] Table 2 User privacy data

[0158]

[0159] For each attribute in Table 2, an address index is established to obtain a data address index table. Taking the attribute value salary as an example, a data address index table is established for the attribute value salary. A hash function is used to calculate the address index for each data plaintext and ensure that each address index is unique, that is, to calculate The address index is , is the number of address indexes. Table 3 shows the data address index table established for the attribute value salary. The process of establishing the data address index table for other attribute values ​​is similar.

[0160] Table 3 Data address index table

[0161]

[0162] S602: Create an address leaf node position index table according to the data address index table.

[0163] Take the data address index table shown in Table 3 as an example, The address index is ,calculate , consider the user privacy data (each row of data in Table 3) as a data block , for this The address index randomly generates leaf nodes , and calculate the position index , Finally, we get the address leaf node location index table , as shown in Table 4.

[0164] Table 4 Address leaf node location index table

[0165]

[0166] The order of node IDs in the binary tree structure of the oblivious random access machine used here is from root to leaf, from left to right, such as Figure 3 The position index indicates the actual position of the data block on the path of the leaf node, as shown in Figure 4 As shown, if , you need to Place it in the position with red fill color in the picture.

[0167] S604: According to the address leaf node position index table, use an oblivious random access machine to store the data block.

[0168] According to the address leaf node position index table ,Will Data blocks According to the corresponding leaf nodes and position indexes, they are stored in a binary tree, and the binary tree storage structure of the random access machine is established, such as Figure 5 shown.

[0169] S606: Establish a secret state oblivious random access machine and a secret state address leaf node position index table.

[0170] Based on the replicated secret sharing algorithm, the binary tree storage structure of the oblivious random access machine constructed in step S604 is used The algorithm performs secret sharing and obtains the secret state oblivious random access machine .

[0171] Based on the replicated secret sharing algorithm, the address leaf node position index table constructed in step S602 is used The algorithm performs secret sharing and obtains the index table of leaf node locations of secret addresses .

[0172] S608: Distribute the secret address leaf node position index table and the secret oblivious random access machine to three servers.

[0173] Will Distribute to three servers for storage, each server stores two secret address leaf node location index tables and two secret random access machines. storage .For example:

[0174] Server 1 storage: ;

[0175] Server 2 storage: ;

[0176] Server 3 Storage: .

[0177] Please continue to refer to Figure 2 At this time, each server stores confidential data, and different colors represent different confidential data shards. Since the 2-out-of-3 replication secret sharing scheme requires three different RSS shares to recover the data plaintext, a single server cannot obtain the plaintext at this time because each server now only stores two RSS shares.

[0178] Based on the above steps S600 to S608, the construction of the above-mentioned dense oblivious distributed data storage system is completed.

[0179] Based on the above-mentioned secret state oblivious distributed data storage system, this embodiment also provides a three-party equivalence query method, which is applicable to any server in the above-mentioned secret state oblivious distributed data storage system. The following takes the first server as a query server as an example to illustrate the method. In this method, the first server and the second and third servers share the oblivious random access machine and its index table that stores user privacy data in a tree structure through a three-party secret sharing scheme to obtain their respective secret state index tables and secret state oblivious random access machines.

[0180] Please refer to Figure 7 , Figure 7 This is a flow chart of a three-party equivalence query method proposed in one or more embodiments of this specification, the method comprising steps S700 to S702:

[0181] S700: In the query phase, the first server acts as a query server, shares the equal-value query information with the other two servers through a three-party secret sharing scheme, and performs secret recovery based on the query result secret shares fed back by the other two servers to obtain the target data.

[0182] S702: In the eviction phase, the first server shares an eviction plan with the second and third servers through a three-party secret sharing plan, and performs an eviction operation according to the eviction plan.

[0183] The above-mentioned oblivious random access machine is constructed based on the attributes of the user's private data. Specifically, the construction process of the above-mentioned oblivious random access machine is as follows: obtain the user's private data, and based on the attributes of the user's private data, use hash calculation to establish an address index for each attribute data of the user's private data. For each address index, a leaf node and a position index are randomly generated to obtain an index table. Finally, each attribute data of the user's private data is taken as a data block, and according to the index table, the user's private data is stored in a binary tree to obtain an oblivious random access machine.

[0184] For the above-mentioned oblivious random access machine constructed based on the attributes of user privacy data, in the query phase described in the above step S700, the first server acts as a query server, and the equivalent query steps to be performed specifically include: the query server determines the target address index through hash calculation according to the target attribute value specified in the equivalent query request. The query server shares the target address index with the other two servers through a three-party secret sharing scheme, and performs secret recovery based on the secret shares of the confidential address fed back by the other two servers to obtain the leaf node and position index corresponding to the target address index. The query server generates a data query vector based on the leaf node and position index and shares it with the other two servers through a three-party secret sharing scheme; and, performs secret recovery based on the secret shares of the confidential data fed back by the other two servers to obtain the target data.

[0185] In some embodiments, during the query process described in step S700 above, the query server needs to generate a new address for the target data after each equal value query, and share the new address with the other two servers through a three-party secret sharing scheme. The other two servers update their respective secret state index tables according to the secret share of the new address, and in the eviction phase described in step S702, update the secret share of the secret state data of the target data rewritten by the query server through the three-party secret sharing scheme to the corresponding position of their respective secret state oblivious random access machines according to the updated secret state index table.

[0186] Specifically, the query server generates a position update vector at each query, and shares the position update vector with the other two servers through a three-party secret sharing scheme. The other two servers update all data blocks on the path where the target data is located in their respective secret state oblivious random access machines according to the secret share of the position update vector, place the secret share of the target data in the root node, and place the other data blocks back to the original position of the data block. Then, in the eviction phase described in step S702, the target data in the root node is updated to the corresponding position of the respective secret state oblivious random access machines according to the updated secret state index table.

[0187] In some embodiments, the expulsion phase described in step S702 above can be implemented by a trusted third party. Specifically, the query server can calculate the number of equal value queries and enter the expulsion phase when the number of equal value queries reaches a preset threshold. In the expulsion phase, a confusing expulsion scheme can be used to implement data expulsion. The process of the confusing expulsion scheme is:

[0188] The first, second and third servers send their updated secret index tables to the trusted third party.

[0189] The trusted third party performs secret recovery based on the updated secret index tables of the first, second and third servers to obtain an updated index table.

[0190] The trusted third party generates a confusion matrix based on the updated index table.

[0191] The first, second, and third servers obtain the secret shares of the confusion matrix through a three-party secret sharing scheme, and according to the obtained secret shares of the confusion matrix, evict the data blocks stored in the root nodes of their respective secret oblivious random access machines to the locations specified by the updated secret index table, thereby completing data eviction and ensuring that the root nodes will not overflow.

[0192] Next, the three-party equivalence query method described above is described in detail by still taking the replication secret sharing protocol as an example. In the three-party equivalence query method described in this embodiment, each server stores two secret address leaf node position index tables and two secret oblivious random access machines:

[0193] Server 1 storage: ;

[0194] Server 2 storage: ;

[0195] Server 3 Storage: .

[0196] In the equivalent query, suppose that one of the three servers i wants to obtain all the data of the user with the attribute value x, i∈{1,2,3}. For example, server 1 wants to query all the data of the user with a salary of 6,000 yuan, and at this time the user or organization and other third-party institutions are offline. The server to be queried is referred to as the query server, and it is stipulated that the query server cannot be malicious. The specific steps of the three-party equivalent query include steps S800 to S810:

[0197] S800: Query Server Generate equal value address index query vector , new leaf node and position index .

[0198] Query Server Using a hash function Calculating property values Get address index , generate equal value address index query vector ,in the remaining . After that, the address index Randomly generate new leaf nodes , and calculate the new position index .

[0199] S802: Based on the replicated secret sharing algorithm, the secret leaf node query result and the location index query result are calculated, and the address leaf node location index table is updated.

[0200] Query server i uses the RSS.Create algorithm to index the query vector and new leaf nodes for the equivalent address. and position index Perform RSS secret sharing to obtain the RSS secret share of the equal-value address index query vector , the secret share of the new leaf node and the secret share of the new position index , .

[0201] Query Server Will Send to server , .

[0202] Query Server Will Send to server , .

[0203] server calculate and return To the server , and by calculating and as well as and Update your own secret address leaf node location index table.

[0204] Likewise, the server calculate and return To the server , and by calculating and as well as and Update your own secret address leaf node location index table.

[0205] S804: Query server i through the encrypted leaf node query result, and reconstruct and restore the leaf node and position index plaintext.

[0206] Query Server By running The algorithm is based on the secret query results obtained The RSS share is restored to get the leaf node , calculate the position index Since any two parties can recover the secret in a 2-out-of-3 replicated secret sharing scheme, this scheme can resist a malicious server.

[0207] S806: Query server Generate equal value query vector and the position update vector .

[0208] Query Server Generate equal value query vector and the position update vector , in ,the remaining .

[0209] S808: Query server Based on the replicated secret sharing algorithm, the confidential query result is calculated.

[0210] Query Server use The algorithm performs RSS secret sharing on the equal-value query vector and the position update vector to obtain the RSS secret share of the equal-value query vector. , and the RSS secret share of the position update vector .

[0211] Query Server Send equal value query vector , position update vector And leaf nodes To the server , send And leaf nodes To the server .

[0212] server Get your own storage At the leaf node All data blocks stored on this path are obtained ,calculate and ,return To the server , and then use the position update vector to calculate and ,Will Put back the leaf node The original position on this path will Place it at the root node of the tree.

[0213] server Get your own storage At the leaf node All data blocks stored on this path are obtained ,calculate and ,return To the server , and then use the position update vector to calculate and ,Will Put back the leaf node The original position on this path will Place it at the root node of the tree.

[0214] in, the remaining . for At the leaf node All data blocks stored on this path.

[0215] S810: Query server The query result is reconstructed and restored based on the confidential query result.

[0216] Query Server By running The algorithm is based on the secret query results obtained The RSS share of the query results is restored , and finally the attribute value is All data of users .

[0217] After the three-party equivalence query, data expulsion is also required. In this embodiment, the query server i maintains a global variable , which is used to record the number of equal value queries. After each equal value query, this variable is calculated .when , the data block is expelled and confused.

[0218] In the above three-party equivalence query process, after each equivalence query, the queried data block will be placed in the root node. Because each server only stores 2 RSS shares of the data block, 2 RSS shares cannot reconstruct the data block, so placing it in the root node will not leak the content of the data block. In this embodiment, in order to avoid root node overflow, each time after accessing the data block on the encrypted random access machine, it is necessary to update the leaf node and position index corresponding to the address index of the data block, that is, update the leaf node position index table. When the number of equivalence queries reaches After that, the expulsion method of this embodiment (abbreviated as ) The data blocks stored in the root node are driven out to the corresponding positions according to the leaf nodes and position indexes corresponding to the address indexes of each data block. The data driving method of this embodiment yes ORAM's eviction algorithm The improved version of Figure 8 As shown, specifically including:

[0219] The three servers send their own secret address leaf node location index table To a trusted third party.

[0220] The trusted third party runs The algorithm is based on the obtained secret address leaf node position index table Restore the address leaf node location index table .

[0221] Trusted third party indexes the leaf node location based on the address pass Generate a confusion matrix and then send it to three servers. The servers use the confusion matrix to The algorithm evicts the data blocks stored in the root node to the corresponding positions according to the leaf nodes and position indexes corresponding to the address indexes of each data block.

[0222] From the above three-party equivalence query method, we can see that Ring ORAM and Path ORAM both operate on encrypted data ciphertext. ORAM operates on the Shamir secret sharing share of the encrypted data ciphertext, and after recovering the secret using the secret recovery algorithm, it also needs to decrypt the secret. Specifically, The server in ORAM needs to perform addition operations based on Shamir secret sharing in the backfill algorithm. Since Shamir secret sharing is not homomorphic to multiplication, it is necessary to introduce the Secure Multiplication Protocol (SMP). For the above reasons, they cannot be directly applied to the TECC system. The three-party equivalence query solution provided in this embodiment operates on the secret sharing share of the data, rather than the encrypted ciphertext of the data, and can be directly applied to the Ant Group TECC system.

[0223] The above is a three-party equivalence query method described in one or more embodiments of this specification. Based on the same idea, this specification also provides a corresponding three-party equivalence query device, such as Fig. 9 shown. Fig. 9 The structure diagram of a three-party equivalence query device is schematically shown. It should be noted that the three-party equivalence query method described in one or more embodiments of the present application can rely on Fig. 9 The three-party equivalent query device shown is implemented, but not limited to this device.

[0224] It should be noted that the above three-party equivalence query device can be applied to the first server, the second server or the third server. The three servers share the oblivious random access machine and its index table storing the user's private data in a tree structure through a three-party secret sharing scheme to obtain their own secret index table and secret oblivious random access machine. Below, the device is described by taking the application of the device to the first server as a query server as an example.

[0225] Please refer to Fig. 9 , the device comprises:

[0226] The data acquisition module 901 is configured to acquire equivalent query information.

[0227] The data query module 902 is configured to share the equal-value query information with the other two servers through a three-party secret sharing scheme during the query phase, and perform secret recovery based on the query result secret shares fed back by the other two servers to obtain the target data.

[0228] The data eviction module 903 is configured to share the eviction plan with the second and third servers through a three-party secret sharing plan during the eviction phase, and perform the eviction operation according to the eviction plan.

[0229] In some embodiments, the three-party secret sharing scheme implemented by the above apparatus supports additive homomorphism and multiplicative homomorphism for at least two secret shares of the shared secret under the three-party secret sharing.

[0230] In some implementations, the first, second, and third servers may run in a local area network or a wide area network.

[0231] In some embodiments, the device may further include a trusted execution environment, which is used to store a confidential index table and a confidential oblivious random access machine of the device.

[0232] Optionally, for the above-mentioned data acquisition module 901, the module can be specifically used to share the oblivious random access machine and the index table with the second and third servers through a three-party secret sharing scheme to obtain the secret index table and the secret oblivious random access machine of the device.

[0233] The above-mentioned method for constructing an oblivious random access machine may specifically include: obtaining user privacy data. Based on the attributes of the user privacy data, using hash calculation, establishing an address index for each attribute data of the user privacy data. Randomly generating a leaf node and a position index for each address index to obtain an index table. Taking each attribute data of the user privacy data as a data block, according to the index table, storing the user privacy data in a binary tree to obtain an oblivious random access machine.

[0234] Optionally, for the above-mentioned data query module 902, the module can be specifically used to determine the target address index through hash calculation according to the target attribute value specified in the equal value query request during the query phase. The target address index is shared with the other two servers through a three-party secret sharing scheme, and secret recovery is performed based on the secret address shares fed back by the other two servers to obtain the leaf node and position index corresponding to the target address index. A data query vector is generated based on the leaf node and position index and shared with the other two servers through a three-party secret sharing scheme; and, secret recovery is performed based on the secret data secret shares fed back by the other two servers to obtain the target data.

[0235] Optionally, the above-mentioned data query module 902 can also be used to generate a new address for the target data after each equal value query, and share the new address with the other two servers through the three-party secret sharing scheme. The other two servers update their respective secret index tables according to the secret share of the new address, and in the eviction phase, update the secret share of the secret data of the target data rewritten by the query server through the three-party secret sharing scheme to the corresponding position of their respective secret oblivious random access machines according to the updated secret index table.

[0236] Specifically, the data query module 902 generates a location update vector each time a query is made, and shares the location update vector with the other two servers through a three-party secret sharing scheme; the other two servers update all data blocks on the path where the target data is located in their respective secret oblivious random access machines according to the secret share of the location update vector, place the secret share of the secret data of the target data in the root node, and put the remaining data blocks back to the original position of the data block.

[0237] Optionally, for the above-mentioned data eviction module 903, the data eviction module is specifically used to calculate the number of equivalent queries, and when the number of equivalent queries reaches a preset threshold, enter the eviction phase. In the eviction phase, the data eviction module sends the updated secret state index table to the trusted third party, and evicts the data block stored in the secret state inadvertent random access machine root node to the location specified by the updated secret state index table according to the secret share of the confusion matrix shared by the trusted third party through the three-party secret sharing scheme.

[0238] The above confusion matrix is ​​generated by the trusted third party based on the updated index table. The updated index table is obtained by the trusted third party through secret recovery based on the data eviction module and the updated secret index tables of the second and third servers.

[0239] For the above-mentioned three-party equivalence query device, taking a module as an example of a software functional unit, the data acquisition module 901 may include code running on a computing instance. Among them, the computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Further, the above-mentioned computing instance may be one or more. For example, the data acquisition module 901 may include code running on multiple hosts / virtual machines / containers. The multiple hosts / virtual machines / containers used to run the code may be distributed in the same region (region) or in different regions. Furthermore, the multiple hosts / virtual machines / containers used to run the code may be distributed in the same availability zone (AZ) or in different AZs, each AZ including a data center or multiple data centers with close geographical locations. Among them, usually a region may include multiple AZs.

[0240] Similarly, multiple hosts / virtual machines / containers used to run the code can be distributed in the same virtual private cloud (VPC) or in multiple VPCs. Usually, a VPC is set up in a region. For cross-region communication between two VPCs in the same region and between VPCs in different regions, a communication gateway needs to be set up in each VPC to achieve interconnection between VPCs through the communication gateway.

[0241] As an example of a hardware functional unit, the data acquisition module 901 may include at least one computing device, such as a server, etc. Alternatively, the data acquisition module 901 may also be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be a complex programmable logical device (CPLD), a field programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof.

[0242] The multiple computing devices included in the data acquisition module 901 can be distributed in the same region or in different regions. The multiple computing devices included in the data acquisition module 901 can be distributed in the same AZ or in different AZs. Similarly, the multiple computing devices included in the data acquisition module 901 can be distributed in the same VPC or in multiple VPCs. The multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0243] In other embodiments, the data acquisition module 901 can be used to execute any step in the above three-party equivalence query method, the data query module 902 can be used to execute any step in the above three-party equivalence query method, and the data expulsion module 903 can be used to execute any step in the above three-party equivalence query method. The steps that the data acquisition module 901, the data query module 902, and the data expulsion module 903 are responsible for implementing can be specified as needed, and the data acquisition module 901, the data query module 902, and the data expulsion module 903 respectively implement different steps in the above three-party equivalence query method to implement all the functions of the above three-party equivalence query device.

[0244] In this implementation, the device can be applied to a server or the like, or to a computing device cluster including at least one computing device, to implement the specific functions of the three-party equivalence query device.

[0245] In some embodiments, an electronic device is also provided for implementing the above-mentioned three-party equivalent query device. Fig.10 The electronic device includes: a bus 1001, a processor 1002, a memory 1003 and a communication interface 1004. The processor 1002, the memory 1003 and the communication interface 1004 communicate with each other through the bus 1001. It should be understood that the present application does not limit the number of processors and memories in the electronic device.

[0246] The bus 1001 may be a peripheral component interconnect (PCI) bus, or an extended industry standard architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.10 The bus 1001 is represented by only one line, but it does not mean that there is only one bus or one type of bus. The bus 1001 may include a path for transmitting information between various components of the electronic device (for example, the processor 1002, the memory 1003, and the communication interface 1004).

[0247] The processor 1002 may include any one or more processors such as a CPU, a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0248] The memory 1003 may include a non-volatile memory (non-volatile memory), such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0249] The memory 1003 stores executable program codes, and the processor 1002 executes the executable program codes to implement the functions of the aforementioned three-party equivalence query device.

[0250] The communication interface 1004 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the electronic device and other devices or a communication network.

[0251] In some embodiments, a computer-readable storage medium is further provided, on which a computer program is stored. When the computer program is executed by a processor, the processor implements the functions of the above-mentioned three-party equivalence query device.

[0252] The computer-readable storage medium may be any available medium that can be stored in the electronic device or a data storage device such as a data center that includes one or more available media. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk). The computer-readable storage medium includes instructions that instruct the electronic device to execute the three-party equivalence query method to be executed by the three-party equivalence query device.

[0253] It is to be understood that the structure illustrated in the embodiments of this specification does not constitute a specific limitation on the system of the embodiments of this specification. In other embodiments of the specification, the above system may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0254] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0255] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0256] It should be noted that the above examples are only specific embodiments of the present invention, and the present invention is obviously not limited to the above examples, and there are many similar variations. All variations directly derived or associated from the contents disclosed by the technicians in this field should fall within the protection scope of the present invention.

Claims

1. A dense, inadvertently distributed data storage system, comprising: An oblivious random access machine storing a number of data in a tree structure and an index table of the oblivious random access machine, wherein the index table is used to describe the correspondence between the address index, leaf node and position index of a data block in the tree structure; The first, second and third servers are each configured to obtain a secret share of the index table and a secret share of the oblivious random access machine through a three-party secret sharing scheme as their respective secret state index table and secret state oblivious random access machine; In the query phase, any one of the first, second and third servers is used as a query server; The query server shares the address index of the target data with the other two servers through the three-party secret sharing scheme, and performs secret recovery based on the secret address shares fed back by the other two servers to obtain the leaf node and location index of the target data; The query server generates a data query vector based on the leaf node and position index of the target data and shares it with the other two servers through the three-party secret sharing scheme; And, performing secret recovery according to the secret shares of the confidential data fed back by the other two servers to obtain the target data; After each query, the query server generates a new address for the target data, and shares the new address with the other two servers through the three-party secret sharing scheme; The remaining two servers update their respective secret state index tables according to the secret share of the new address; In the eviction phase, the remaining two servers update the secret shares of the target data rewritten by the query server through the three-party secret sharing scheme to the corresponding positions of their respective secret oblivious random access machines according to the updated secret index table.

2. The system of claim 1, wherein the three-party secret sharing scheme supports additive homomorphism and multiplicative homomorphism for at least two secret shares of the shared secret under the three-party secret sharing.

3. The system as claimed in claim 1, wherein the three-party secret sharing scheme is a replicated secret sharing protocol.

4. The system as claimed in claim 1, wherein the first, second and third servers run in a local area network.

5. In the system as described in claim 1, the first, second and third servers are also configured to store the secret index table and the secret oblivious random access machine in a trusted execution environment, and perform data access operations on the secret index table and the secret oblivious random access machine in the trusted execution environment.

6. The system of claim 1, wherein the query phase further comprises: The query server generates a location update vector at each query, and shares the location update vector with the other two servers through the three-party secret sharing scheme; The other two servers update all data blocks on the path where the target data is located in their respective secret oblivious random access machines according to the secret share of the position update vector, place the secret share of the secret data of the target data in the root node, and put the remaining data blocks back to the original position of the data block.

7. The system according to claim 6, wherein the expulsion phase specifically comprises: The first, second and third servers send their updated secret index tables to a trusted third party; The trusted third party performs secret recovery according to the updated secret index tables of the first, second and third servers to obtain an updated index table; The trusted third party generates a confusion matrix according to the updated index table; The first, second and third servers obtain the secret shares of the confusion matrix through the three-party secret sharing scheme, and according to the obtained secret shares of the confusion matrix, evict the data blocks stored in the root nodes of their respective secret oblivious random access machines to the locations specified by the updated secret index table.

8. A three-party equivalence query method, applicable to a first server, wherein the first server shares an oblivious random access machine and its index table storing user private data in a tree structure with a second and third server through a three-party secret sharing scheme, and obtains their own secret index table and secret oblivious random access machine; The index table is used to describe the correspondence between the address index, leaf node and position index of the data block in the tree structure; the method comprises: In the query phase, the first server acts as a query server; the query server determines the target address index through hash calculation according to the target attribute value specified in the equal value query request; The query server shares the target address index with the other two servers through the three-party secret sharing scheme, and performs secret recovery based on the secret shares of the secret state address fed back by the other two servers to obtain the leaf node and position index corresponding to the target address index; the query server generates a data query vector based on the leaf node and position index and shares it with the other two servers through the three-party secret sharing scheme; and, performs secret recovery based on the secret shares of the secret state data fed back by the other two servers to obtain the target data; After each query, the query server generates a new address for the target data, and shares the new address with the other two servers through the three-party secret sharing scheme; the other two servers update their respective secret index tables according to the secret share of the new address; In the eviction phase, the remaining two servers update the secret shares of the target data rewritten by the query server through the three-party secret sharing scheme to the corresponding positions of their respective secret oblivious random access machines according to the updated secret index table.

9. The method of claim 8, wherein the three-party secret sharing scheme supports additive homomorphism and multiplicative homomorphism for at least two secret shares of the shared secret under the three-party secret sharing.

10. The method of claim 8, wherein the three-party secret sharing scheme is a replicated secret sharing protocol.

11. The method of claim 8, wherein the first, second and third servers are operated in a local area network.

12. According to the method as claimed in claim 8, the first, second and third servers are also configured to store the secret index table and the secret oblivious random access machine in a trusted execution environment, and perform data access operations on the secret index table and the secret oblivious random access machine in the trusted execution environment.

13. The method according to claim 8, wherein the method for constructing the oblivious random access machine comprises: Acquiring the user's private data; Based on the attributes of the user privacy data, a hash calculation is used to establish an address index for each attribute data of the user privacy data; Randomly generate a leaf node and a position index for each of the address indexes to obtain the index table; Each piece of attribute data of the user's private data is taken as a data block, and according to the index table, the user's private data is stored in a binary tree to obtain the oblivious random access machine.

14. According to the method as claimed in claim 8, the query server is also used to generate a location update vector at each query, and share the location update vector with the remaining two servers through the three-party secret sharing scheme; the remaining two servers update all data blocks on the path where the target data is located in their respective secret oblivious random access machines according to the secret share of the location update vector, place the secret share of the secret data of the target data in the root node, and put the remaining data blocks back to the original position of the data block.

15. The method according to claim 14, wherein the query server is further configured to calculate the number of equal value queries, and when the number of equal value queries reaches a preset threshold, enter the expulsion phase; In the expulsion phase, the first, second and third servers send their updated secret index tables to a trusted third party; The trusted third party performs secret recovery according to the updated secret index tables of the first, second and third servers to obtain an updated index table; The trusted third party generates a confusion matrix according to the updated index table; The first, second and third servers obtain the secret shares of the confusion matrix through the three-party secret sharing scheme, and according to the obtained secret shares of the confusion matrix, evict the data blocks stored in the root nodes of their respective secret oblivious random access machines to the locations specified by the updated secret index table.

16. A three-party equivalence query device, the device is applied to a first server, the first server and the second and third servers share an oblivious random access machine and its index table storing user privacy data in a tree structure through a three-party secret sharing scheme, and obtain their own secret index tables and secret oblivious random access machines; The index table is used to describe the correspondence between the address index, leaf node and position index of the data block in the tree structure; The device comprises: A data acquisition module is configured to acquire equivalent query information; and share the oblivious random access machine and the index table with the second and third servers through the three-party secret sharing scheme to obtain the secret index table and the secret oblivious random access machine of the device; The data query module is configured to determine the target address index by hash calculation according to the target attribute value specified in the equal value query request during the query phase; share the target address index with the other two servers through the three-party secret sharing scheme, and perform secret recovery according to the secret address secret shares fed back by the other two servers to obtain the leaf node and position index corresponding to the target address index; generate a data query vector based on the leaf node and position index and share it with the other two servers through the three-party secret sharing scheme; and perform secret recovery according to the secret data secret shares fed back by the other two servers to obtain the target data; After each equal value query, the data query module generates a new address for the target data, and shares the new address with the other two servers through the three-party secret sharing scheme; the other two servers update their respective secret index tables according to the secret share of the new address; The data eviction module is configured such that during the eviction phase, the other two servers update the secret data share of the target data rewritten by the data query module through the three-party secret sharing scheme to the corresponding positions of their respective secret oblivious random access machines according to the updated secret index table.

17. The apparatus of claim 16, wherein the three-party secret sharing scheme supports additive homomorphism and multiplicative homomorphism for at least two secret shares of a shared secret under the three-party secret sharing.

18. The apparatus of claim 16, wherein the three-party secret sharing scheme is a replicated secret sharing protocol.

19. The device as claimed in claim 16, wherein the first, second and third servers run in a local area network.

20. The device of claim 16, further comprising a trusted execution environment, wherein the trusted execution environment is used to store a confidential index table and a confidential oblivious random access machine of the device.

21. The apparatus of claim 16, wherein the method for constructing the oblivious random access machine comprises: Acquiring the user's private data; Based on the attributes of the user privacy data, a hash calculation is used to establish an address index for each attribute data of the user privacy data; Randomly generate a leaf node and a position index for each of the address indexes to obtain the index table; Each piece of attribute data of the user's private data is taken as a data block, and according to the index table, the user's private data is stored in a binary tree to obtain the oblivious random access machine.

22. In the device as described in claim 16, the data query module is also used to generate a position update vector at each query, and share the position update vector with the remaining two servers through the three-party secret sharing scheme; the remaining two servers update all data blocks on the path where the target data is located in their respective secret oblivious random access machines according to the secret share of the position update vector, place the secret share of the secret data of the target data in the root node, and put the remaining data blocks back to the original position of the data block.

23. The device according to claim 22, wherein the data eviction module is specifically used to calculate the number of equivalent queries, and when the number of equivalent queries reaches a preset threshold, enter the eviction phase; In the eviction phase, the data eviction module sends the updated secret state index table to the trusted third party, and evicts the data block stored in the secret state oblivious random access machine root node to the location specified by the updated secret state index table according to the secret share of the confusion matrix shared by the trusted third party through the three-party secret sharing scheme; The confusion matrix is ​​generated by the trusted third party according to the updated index table; the updated index table is obtained by the trusted third party through secret recovery according to the data eviction module and the updated secret index tables of the second and third servers.

24. A computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the method according to any one of claims 8 to 15 is implemented.

25. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 8 to 15 when executing the program.

Images