Data processing method capable of protecting privacy and computing equipment

Abstract

A privacy-protecting data processing method and computing device, the method being executed by a first party, the method comprising: receiving a first ciphertext from a second party, the first ciphertext being obtained by homomorphic encryption of a binary vector corresponding to a one-hot vector; the first ciphertext is converted into a first ciphertext vector, the first ciphertext vector comprises l ciphertexts, and l is equal to the dimension of the binary vector; the first ciphertext vector is converted into a second ciphertext vector, the second ciphertext vector comprises n ciphertexts, and n is equal to the dimension of the one-hot vector.

Description

Technical Field

[0001] The embodiments of this specification belong to the field of data processing, and more particularly, to a data processing method and computing device for protecting privacy. Background Art

[0002] Privacy information retrieval is an important component in cryptography and has been widely used in many fields. One implementation of this technology includes that the client constructs a ciphertext vector of a one-hot vector based on additive homomorphic encryption, and then sends the ciphertext vector to the server. After receiving it, the server uses the ciphertext vector to perform an inner product operation with its own database plaintext vector to obtain the ciphertext requested by the client, and returns the ciphertext to the client. In this technical solution, due to the large number of data in the database, the amount of data of the one-hot vector corresponding to the number of data is large. For example, if the database includes tens of thousands of data, the one-hot vector needs to include tens of thousands of components, and the ciphertext vector corresponding to the one-hot vector also includes tens of thousands of ciphertext components. Therefore, the amount of communication data sent by the client to the server is large, and the communication cost is high. Summary of the invention

[0003] The purpose of the present invention is to provide a data processing solution for protecting privacy.

[0004] A first aspect of this specification provides a privacy protection data processing method, which is performed by a first party and includes:

[0005] receiving a first ciphertext from a second party, the first ciphertext being obtained by homomorphically encrypting a binary vector corresponding to the one-hot vector;

[0006] Convert the first ciphertext into a first ciphertext vector, wherein the first ciphertext vector includes l ciphertexts, where l is equal to the dimension of the binary vector;

[0007] The first ciphertext vector is converted into a second ciphertext vector, where the second ciphertext vector includes n ciphertexts, where n is equal to the dimension of the one-hot vector.

[0008] A second aspect of this specification provides a privacy protection data processing method, which is performed by a second party and includes:

[0009] Generate a binary vector corresponding to the one-hot vector;

[0010] Encrypting the binary vector based on a homomorphic encryption algorithm to obtain a first ciphertext;

[0011] The first ciphertext is sent to a first party so that the first party obtains a second ciphertext vector, wherein the second ciphertext vector includes n ciphertexts corresponding to the n plaintexts in the one-hot vector.

[0012] A third aspect of the specification provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method described in the first aspect or the second aspect.

[0013] A fourth aspect of the present specification provides a computing device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method described in the first aspect or the second aspect is implemented.

[0014] A fifth aspect of the present specification provides a computer program product, comprising a computer program / instruction, which, when executed by a processor, implements the steps of the method described in the first aspect or the second aspect.

[0015] In the scheme of the embodiments of this specification, the client converts the one-hot vector into a binary vector and then encrypts it. The number of terms of the polynomial of the obtained ciphertext is only logarithmic. For example, the one-hot vector includes n components, and the binary vector corresponding to the one-hot vector includes the number of components at the logn level, that is, the ciphertext polynomial corresponding to the binary vector includes the number of terms at the logn level. Therefore, the ciphertext sent by the client to the server has a smaller data volume than the prior art, reducing the communication overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions of the embodiments of this specification, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0017] Figure 1 is a schematic diagram of a data processing system in an embodiment of this specification;

[0018] Figure 2 A flowchart of a data processing method for protecting privacy in an embodiment of this specification;

[0019] Figure 3 A schematic diagram of a process of generating a ciphertext by a second party in an embodiment of this specification;

[0020] Figure 4 A schematic diagram of a process of converting a ciphertext into a ciphertext vector corresponding to a one-hot vector in an embodiment of this specification;

[0021] Figure 5 This is a schematic diagram of the process of performing secret decoding based on polynomials in the embodiments of this specification;

[0022] Figure 6Schematic diagram of the process of obtaining a second ciphertext vector by directly decoding a first ciphertext vector in an embodiment of this specification. DETAILED DESCRIPTION

[0023] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0024] In response to the problems existing in the prior art, in a related technology, the client encrypts the one-hot vector based on a fully homomorphic encryption algorithm, obtains a ciphertext corresponding to the one-hot vector, and sends the ciphertext to the server. The server expands the one ciphertext into multiple ciphertexts arranged in sequence based on the SEALPIR expansion algorithm, and the multiple ciphertexts arranged in sequence can constitute a ciphertext vector corresponding to the one-hot vector. In this way, compared with the implementation method described above, a certain amount of communication data is reduced. However, the number of terms in the ciphertext generated by the client is a polynomial corresponding to the data entries in the database. Therefore, the data volume of the ciphertext is still linearly related to the data entries in the database. When the data entries are large, the data volume of the ciphertext generated by the client is still large.

[0025] A data processing solution is provided in the embodiments of this specification. Figure 1 FIG. 1 is a schematic diagram of a data processing system in an embodiment of this specification. Figure 1 As shown in , a system may include a first party and a second party, wherein the second party wishes to provide a ciphertext of a one-hot vector to the first party.

[0026] Specifically, the second party is, for example, a client, and the first party is, for example, a server, and the server includes, for example, a database for the client to query data. On the second party, the one-hot vector can be converted into a binary vector, and the binary vector can be encrypted by a homomorphic encryption algorithm to obtain a ciphertext of the binary vector, and the ciphertext can be sent to the first party. On the first party, the ciphertext can first be expanded into a first ciphertext vector corresponding to the binary vector, and then the first ciphertext vector can be converted into a second ciphertext vector corresponding to the one-hot vector. After obtaining the second ciphertext vector, the first party can perform data query based on the second ciphertext vector, thereby returning the ciphertext data corresponding to the one-hot vector to the second party.

[0027] In this way, the client converts the one-hot vector into a binary vector and then encrypts it. The number of terms of the polynomial of the ciphertext obtained is only logarithmic. For example, the one-hot vector includes n components, and the binary vector corresponding to the one-hot vector includes logn-level components, that is, the ciphertext polynomial corresponding to the binary vector includes logn-level terms. Therefore, the ciphertext sent by the client to the server has a smaller data volume than the existing technology, reducing the communication overhead.

[0028] A one-hot vector is a vector that has only one non-zero component.

[0029] The homomorphic encryption algorithm in the embodiments of this specification includes a fully homomorphic encryption algorithm, which is an encryption technology that allows any calculation to be performed on encrypted data. The above-mentioned fully homomorphic encryption algorithms include, for example, BFV, CKKS, FV, BV, etc., which are not limited to this. The BFV algorithm is used as an example for description in the embodiments of this specification.

[0030] The homomorphic encryption algorithms in the embodiments of this specification may include, for example, the following six algorithms:

[0031] (1) Key generation algorithm (KeyGen), which is used to generate private key sk and public key pk.

[0032] Let the plaintext space be a polynomial space The degree of the polynomial space is less than N, where N is a power of 2, such as 4096, 8192, etc. The coefficient is an integer in [0, q). The ciphertext space corresponding to the plaintext space is R can be randomly generated by the key generation algorithm q A polynomial in is used as the private key sk. Each coefficient of the polynomial is subject to a standard deviation of x. σ Then, the public key pk = (-a*sk+e, a) can be generated, where a is R q A randomly generated polynomial in , e←χ σ .

[0033] (2) Encoding algorithm (Encode), used to convert the plaintext vector Convert to polynomial v∈R q ,For example, is [a0, a1, a2, …a N-1 ], you can Convert to polynomial v = a0 + a1x + a2x 2 +…+a N-1 x N-1 .

[0034] (3) Encryption algorithm, used to encrypt the plaintext polynomial v into ciphertext (the ciphertext is in the form of two polynomials) using the public key. Specifically, let pk = (p0, p1), then the ciphertext Here c1=u*p1+e1, in v is the plaintext polynomial.

[0035] (4) Decryption algorithm: This decryption algorithm is used to decrypt the ciphertext into a plaintext polynomial. Suppose the ciphertext ct = (c0, c1), then is the decrypted plaintext polynomial.

[0036] (5) Decoding algorithm (Decode), which is used to convert the plaintext polynomial into a plaintext vector.

[0037] (6) Homomorphic computation, including homomorphic addition, homomorphic multiplication, homomorphic substitution, etc.

[0038] Specifically, in homomorphic addition, for plaintext polynomial m and plaintext polynomial t, E(m+t)=E(m)+E(t), where plaintext polynomial m and plaintext polynomial t are polynomials in the same polynomial space, and E() represents the ciphertext obtained by homomorphically encrypting the ciphertext polynomial; in homomorphic multiplication, E(t*m)=t*E(m), where t is the plaintext polynomial; in another homomorphic multiplication, E(n*m)=E(n)*E(m).

[0039] The following is a detailed description of the privacy-preserving data processing scheme in the embodiments of this specification.

[0040] Figure 2 The present invention is a flowchart of a data processing method for protecting privacy in an embodiment of the present specification.

[0041] As shown in the figure, in step S201, the second party generates a binary vector corresponding to the one-hot vector.

[0042] Figure 3 A schematic diagram of the process of generating ciphertext by the second party is shown. As described above, the dimension of the unique hot vector in the second party is usually the same as the data entry to be queried in the database, so as to indicate the number of data in the query database, and the number of data entries in the database is usually large. In order to facilitate the display of the scheme in the embodiment of this specification, it is assumed in this embodiment that there are 8 data in the database, that is, the unique hot vector includes 8 components. It can be understood that those skilled in the art can easily expand the scheme to unique hot vectors of larger dimensions.

[0043] like Figure 3As shown in , the one-hot vector [0,0,0,0,0,0,1,0] represents the sixth piece of data among the eight pieces of data arranged sequentially in the database. Figure 3 As shown in the serial number on the left side of the unique hot vector, the 8 pieces of data are counted from the 0th piece. By counting from the 0th piece, the 8 pieces of data can be matched one by one with the 3-bit binary number according to their number of pieces. For example, 0 can be represented as the binary number 000, so the 0th piece of data corresponds to the binary number 000, similarly, the 1st piece of data corresponds to the binary number 001, ... the 6th piece of data corresponds to the binary number 110, and the 7th piece of data corresponds to the binary number 111.

[0044] Therefore, the one-hot vector corresponding to each piece of data can be converted into a binary vector according to the binary number corresponding to the piece of data. Specifically, the three-digit values ​​(0 or 1) of the binary number corresponding to the one-hot vector can be arranged into a vector, the low-order values ​​are arranged in the lower dimension of the binary vector, and the high-order values ​​are arranged in the higher dimension of the binary vector, so as to obtain a binary vector. For example, Figure 3 As shown in , for the binary number 110 corresponding to the one-hot vector [0,0,0,0,0,0,1,0], the 0 at the 0th position is arranged in the 0th row of the binary vector, the 1 at the 1st position is arranged in the 1st row of the binary vector, and the 1 at the 2nd position is arranged in the 2nd row of the binary vector, so as to obtain the following Figure 3 The binary vector [0,1,1] shown in .

[0045] It can be understood that although it is mentioned here that the number of components of the one-hot vector n=8 is exactly a power of 2, the present specification is not limited to this. For an n-dimensional one-hot vector, when n is not a power of 2, the smallest m can be first determined, where m is a power of 2 and m≥n, that is, m is the minimum value among powers greater than or equal to 2. Then the n-dimensional one-hot vector can be converted into a binary vector of logm dimensions. For example, when n=7, it can be determined that m=8, so the 7-dimensional one-hot vector can be converted into a binary vector of log8=3 dimensions.

[0046] In step S203, the second party encrypts the binary vector based on a homomorphic encryption algorithm to obtain a ciphertext.

[0047] After the second party converts the one-hot vector into a binary vector as described above, it can homomorphically encrypt the binary vector using the homomorphic encryption algorithm described above. Specifically, taking the BFV algorithm as an example, first convert the binary vector [0,1,1] into a polynomial x 2 +x, and then encrypt the polynomial to obtain the ciphertext Enc(x 2 +x). Figure 3 As shown in the Figure 3The blue square in the figure shows the ciphertext Enc(x 2 +x). For ease of understanding, Figure 3 to Figure 6 In the figure, a white square represents a plaintext, and a non-white square represents a ciphertext. Correspondingly, multiple white squares represent multiple plaintexts, and multiple non-white squares represent multiple ciphertexts.

[0048] In step S205, the second party sends the ciphertext to the first party.

[0049] As mentioned above, the ciphertext polynomial corresponding to the one-hot vector [0,0,0,0,0,0,1,0] includes 8 terms, while the ciphertext polynomial Enc(x 2 +x) only includes 3 items, which greatly reduces the amount of ciphertext data compared to the ciphertext polynomial corresponding to the one-hot vector [0,0,0,0,0,0,1,0].

[0050] For an n-dimensional one-hot vector, it can be converted into a binary vector of l=logm dimension (where m is the minimum value among the powers of 2 that are ≥n), so that the ciphertext polynomial of the binary vector only includes logm terms, thereby greatly reducing the amount of communication data relative to the n-term ciphertext polynomial corresponding to the n-dimensional one-hot vector.

[0051] In step S207, after receiving the ciphertext, the first party converts the ciphertext into a first ciphertext vector corresponding to the binary vector.

[0052] Specifically, for example, when the first party receives the ciphertext Enc(x 2 +x), the ciphertext is converted into l ciphertexts arranged in sequence, where l is equal to the dimension of the binary vector, and here l = 3. Afterwards, the first party can arrange the l ciphertexts arranged in sequence into a first ciphertext vector, where the plaintexts corresponding to the ciphertexts in the first ciphertext vector are the plaintexts in the above binary vector.

[0053] Figure 4 Schematic diagram of the process of converting ciphertext into a ciphertext vector (i.e., a second ciphertext vector) corresponding to a one-hot vector in the embodiment of this specification. Figure 4 As shown in the left part, the first party converts the ciphertext Enc(x 2+x) is converted into a ciphertext vector (i.e., a first ciphertext vector) corresponding to a binary vector. The first ciphertext vector includes three ciphertexts, and the numbers in the blue squares corresponding to the three ciphertexts are used to indicate the plaintexts corresponding to the ciphertexts. For example, the plaintext corresponding to the ciphertext of the 0th row of the first ciphertext vector is the value 0, the plaintext corresponding to the ciphertext of the 1st row is the value 1, and the plaintext corresponding to the ciphertext of the 2nd row is the value 1. In the embodiments of the present specification, the ciphertext of the numerical value may be equivalent to the ciphertext of the polynomial that only includes constant terms. It can be understood that according to the homomorphic encryption algorithm, although the ciphertext of the 1st row and the ciphertext of the 2nd row in the first ciphertext vector are both ciphertexts of the value 1, they include different polynomials.

[0054] In one embodiment, the ciphertext may be converted into l ciphertexts corresponding to each component of the binary vector by the SEALPIR expansion algorithm described above. Although in the related art, the ciphertext corresponding to the one-hot vector is converted into multiple ciphertexts corresponding to each component of the one-hot vector by the SEALPIR expansion algorithm, the SEALPIR expansion algorithm is innovatively used to expand the ciphertext of an arbitrary bit vector in the embodiments of this specification, and it has been verified that the l ciphertexts obtained by expanding the ciphertext of an arbitrary bit vector of l dimensions by the SEALPIR expansion algorithm are exactly the ciphertexts of the l plaintext bits included in the arbitrary vector, wherein each component of the bit vector is 1 or 0.

[0055] Specifically, assuming that the ciphertext vector ciphertexts is initially [Enc(x 2 +x)], that is, there is only one ciphertext component, and assuming that k is the sequence number of the component in ciphertexts, in order to expand ciphertexts to include n ciphertext components, we can first determine the minimum t=2 s , and t ≥ l, then the following loop can be performed to expand the dimension of the ciphertext vector ciphertexts:

[0056] For j = 0 to s - 1 do

[0057] For k=0to 2 j -1do

[0058] c0←ciphertests[k]

[0059]

[0060]

[0061]

[0062]

[0063] for j=0to l-1do

[0064] o j ←ciphertests[j]﹒ 1 / t

[0065] Return output←[o0,o1,…,o l-1 ]

[0066] In the above loop, Sub(c,s) represents a replacement operation. Specifically, assuming that the ciphertext c=p(x), s is an odd number, Sub(c,s) returns p=(x s ), that is, use x s Replace x to do the calculation.

[0067] In the above loop, each loop expands the number of ciphertext vectors to twice the original number. Taking t=4, l=3 as an example, the above algorithm will perform 2 rounds of ciphertext generation in total, where the first round generates a pair of ciphertexts: (c′0, c′1), and the second round generates two pairs of ciphertexts: (c′0, c′2) and (c′1, c′3). Afterwards, by taking the first 3 ciphertexts c′0, c′1, c′2 of the 4 generated ciphertexts and multiplying the 3 ciphertexts by 1 / 4 respectively, we can get the following: Figure 4 The first ciphertext vector shown in .

[0068] like Figure 4 As shown in , the first ciphertext vector includes three ciphertexts, the ciphertext in the 0th row is Enc(0), the ciphertext in the 1st row is Enc(1), and the ciphertext in the 2nd row is Enc(1). The plaintext corresponding to Enc(0) is 0, and the plaintext corresponding to Enc(1) is 1.

[0069] It can be understood that after the first party obtains the first ciphertext vector as described above, the first party performs the ciphertext [Enc(x 2 +x)] is expanded to obtain the first ciphertext vector, so the first party cannot know to which plaintext polynomial each ciphertext in the first ciphertext vector corresponds.

[0070] In step S209, the first party converts the first ciphertext vector into a second ciphertext vector corresponding to the one-hot vector.

[0071] In one implementation, secret decoding may be performed based on a polynomial.

[0072] Figure 5 Schematic diagram of the process of performing secret decoding based on polynomials in the embodiments of this specification.

[0073] like Figure 5As shown, the first ciphertext vector corresponding to the binary vector [0,1,1] is represented as the ciphertext vector L, where L[i] represents the component of the i-th row of L. Specifically, the ciphertext L[0] of the 0th row in the ciphertext vector L is Enc(0), the ciphertext L[1] of the 1st row is Enc(1), and the ciphertext L[2] of the 2nd row is Enc(1). It can be understood that since different random polynomials are used for encryption each time the same plaintext is homomorphically encrypted according to the homomorphic encryption algorithm, the ciphertext Enc(1) of L[1] and the ciphertext Enc(1) of L[2] are different polynomials.

[0074] The ciphertext vector R can be calculated based on the ciphertext vector L, where the ciphertext vector R is added to the first ciphertext vector L to obtain the ciphertext vector corresponding to the vector [1,1,1]. Specifically, the first party can use the public key of the second party to homomorphically encrypt each component of the vector [1,1,1] to obtain the ciphertext vector corresponding to the vector [1,1,1], that is, [Enc(1), Enc(1), Enc(1)]. It can be understood that according to the homomorphic encryption algorithm, each time 1 is homomorphically encrypted, a different random polynomial is used for encryption, so the ciphertext Enc(1) corresponding to each component is a different polynomial. Then, [Enc(1), Enc(1), Enc(1)] is subtracted from the vector L to obtain the vector R, where the vector R includes three ciphertexts, R[0] = Enc(1), R[1] = Enc(0), and R[2] = Enc(0).

[0075] Then, the first party can use the ciphertext vector L and the ciphertext vector R as the input of the algorithm shown in the rectangular box, through Figure 5 The algorithm shown in obtains the output (Output) T.

[0076] Specifically, Figure 5 As shown in the algorithm, through multiple cycles, the components T[j] of each row of the ciphertext vector T are calculated:

[0077] T[j]←j2×L[2]+(1-j2)×R[2]+

[0078] j1×L[1]+(1-j1)×R[1]+

[0079] j0×L[0]+(1-j0)×R[0]

[0080] Where j represents the number of rows in the vector T, and j2, j1, and j0 are the bits in the binary number j2j1j0 corresponding to j.

[0081] Thus, we can obtain the ciphertext vector T as shown on the right side of the figure. The ciphertext vector T includes 8 ciphertexts T[j], j∈[0,7]. The numbers in the blocks corresponding to each ciphertext vector represent the plaintext corresponding to the ciphertext vector.

[0082] from Figure 5 It can be seen that the plaintext of the ciphertext vector T is not a one-hot vector, but according to Figure 5 The algorithm shown in can determine that the plaintext value range corresponding to each ciphertext component in the ciphertext vector T should be in [0, logm], and there is only one position for logm, where m = 8. Therefore, the polynomial can be constructed by interpolation method The polynomial satisfies that the value of the polynomial is 1 only when x=logm. Then, each ciphertext component T[j] of the ciphertext vector T can be substituted into f(x) for calculation to obtain the ciphertext component T′[j] of the ciphertext vector T′ (i.e., the second ciphertext vector). Since T[j] is a fully homomorphic encrypted ciphertext, according to the fully homomorphic algorithm, substituting the ciphertext component T[j] into f(x) is equivalent to substituting the plaintext corresponding to T[j] into the ciphertext obtained by calculating f(x). Therefore, the plaintext corresponding to T′[j] must be the component of the jth row in the one-hot vector [0,0,0,0,0,0,1,0]. That is, the decryption result of the ciphertext vector T′ is the one-hot vector [0,0,0,0,0,0,1,0].

[0083] Understandably, Figure 5 Although the binary vector with 3 rows and the one-hot vector with 8 rows are used as examples, Figure 5 The algorithm shown can be applied to binary vectors of other dimensions and one-hot vectors of other dimensions corresponding to the binary vectors. In addition, the dimension of the one-hot vector does not have to be 2. l , where l is the dimension of the binary vector. For example, in the case where the dimension of the one-hot vector is 7, we can Figure 5 The algorithm shown only calculates T[0] to T[6], resulting in a 7-dimensional one-hot vector.

[0084] Specifically, for a first ciphertext vector of dimension l and a dimension n of an expected one-hot vector, the first ciphertext vector and the inverted ciphertext vector of the first ciphertext necklace can be combined based on binary numbers corresponding to values ​​0 to n-1, respectively, to obtain a third ciphertext vector, wherein the third ciphertext vector includes n ciphertexts, wherein the maximum value of the n ciphertexts in the third ciphertext vector is logm, where m is the minimum value of n to the power of 2 greater than or equal to n; each component of the third ciphertext vector is substituted into a polynomial constructed based on an interpolation algorithm to obtain the second ciphertext vector.

[0085] In another implementation, the first party may obtain the second ciphertext vector by directly decoding the first ciphertext vector.

[0086] Figure 6 Schematic diagram of the process of obtaining a second ciphertext vector by directly decoding a first ciphertext vector in an embodiment of this specification.

[0087] like Figure 6 As shown in , assuming that the first ciphertext vector is the above ciphertext vector L, the ciphertext vector L can be used as Figure 6 The input of the algorithm shown in the figure is used to calculate the output of the algorithm, that is, the ciphertext r = Enc(x i ), where i=6.

[0088] Specifically, for a 3-row ciphertext vector L, c[j] can be calculated by 3 cycles:

[0089] c[j]=x 0 (1-R[j])+x 2j R[j]

[0090] Where j is the number of rows of the ciphertext vector L, j = 0, 1, 2, and then r = c[0] × c[1] × c[2] can be calculated.

[0091] It has been verified that the plaintext vector corresponding to the ciphertext r is a one-hot vector [0,0,0,0,0,0,1,0]. Therefore, the ciphertext r can be expanded to a ciphertext vector corresponding to the one-hot vector [0,0,0,0,0,0,1,0] based on the SEALPIR expansion algorithm. When the dimension n of the desired one-hot vector is less than 8, for example, n=7, the first 7 rows of components can be taken from the expanded 8-dimensional ciphertext vector to obtain the final second ciphertext vector.

[0092] After obtaining the second ciphertext vector, the first party may perform data query based on the second ciphertext vector similar to the prior art.

[0093] In one implementation, the first party can use the second ciphertext vector to perform an inner product with the plaintext vectors corresponding to the first party's multiple data, and the result of the inner product is the ciphertext of the data that the second party wants to query. The first party can return the ciphertext of the data to the second party, and the second party decrypts the ciphertext using the homomorphically encrypted private key to obtain the data. In this process, the first party cannot know which data the second party is querying, thereby achieving private information query.

[0094] In another embodiment, the second party may send a plurality of ciphertexts arranged in sequence to the first party, and the plurality of ciphertexts arranged in sequence are obtained by homomorphically encrypting vectors of multiple rows or columns of a permutation matrix. The permutation matrix can be used to represent the operation of rearranging or transforming rows or columns in a matrix, and it can be a square binary matrix with only one 1 in each row or column and the others are 0. Specifically, the permutation matrix can be a matrix obtained by exchanging certain rows or columns of a unit matrix. It should be understood that the unit matrix itself is a most basic permutation matrix, which does not perform any processing on the matrix.

[0095] The first party may convert the plurality of ciphertexts arranged in sequence into a plurality of second ciphertext vectors arranged in sequence as described above, thereby obtaining a ciphertext permutation matrix corresponding to the permutation matrix. The first party may multiply the ciphertext permutation matrix by the plaintext vectors corresponding to the plurality of data of the first party, thereby obtaining the permuted ciphertext vector. In this process, since the first party performs homomorphic operations between the ciphertext and the plaintext, the first party cannot know the specific permutation matrix, that is, cannot know which data each component in the ciphertext vector corresponds to.

[0096] When the second party queries data, it can first use the same permutation matrix to permute the one-hot vector corresponding to the index value i, and then send the permuted index value j to the first party. The first party sends the jth row of ciphertext data in the ciphertext vector to the second party. The second party decrypts the ciphertext data to obtain the i-th row of data in the above plaintext vector.

[0097] In the 1990s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the method flow). However, with the development of technology, many improvements to the method flow today can be regarded as direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0098] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0099] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, the present application does not exclude that with the development of computer technology in the future, the computer that implements the functions of the above embodiments may be, for example, a personal computer, a laptop computer, a vehicle-mounted human-computer interaction device, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0100] Although one or more embodiments of the present specification provide method operation steps as described in the embodiments or flow charts, more or less operation steps may be included based on conventional or non-creative means. The order of steps listed in the embodiments is only one way of executing the order of many steps, and does not represent the only execution order. When the device or terminal product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiments or the drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The term "include", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or equipment including a series of elements includes not only those elements, but also includes other elements that are not explicitly listed, or also includes elements inherent to such a process, method, product or equipment. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or equipment including the elements. For example, if the words first, second, etc. are used to represent the name, they do not represent any specific order.

[0101] For the convenience of description, the above devices are described in various modules according to their functions. Of course, when implementing one or more of the present specification, the functions of each module can be implemented in the same or more software and / or hardware, or the module implementing the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0102] The present invention is described with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0103] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0104] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0105] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0106] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0107] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage, graphene storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0108] It should be understood by those skilled in the art that one or more embodiments of the present specification may be provided as a method, system or computer program product. Therefore, one or more embodiments of the present specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, one or more embodiments of the present specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0109] One or more embodiments of the present specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. One or more embodiments of the present specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0110] Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. In the description of this specification, the description of the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of this specification. In this specification, the schematic representation of the above terms does not necessarily target the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples without contradiction.

[0111] The above description is only an example of one or more embodiments of the present specification and is not intended to limit one or more embodiments of the present specification. For those skilled in the art, one or more embodiments of the present specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification shall be included in the scope of the claims.

Claims

1. A privacy-preserving data processing method, performed by a first party, comprising: receiving a first ciphertext from a second party, the first ciphertext being obtained by homomorphically encrypting a binary vector corresponding to the one-hot vector; Convert the first ciphertext into a first ciphertext vector, wherein the first ciphertext vector includes l ciphertexts, where l is equal to the dimension of the binary vector; The first ciphertext vector is converted into a second ciphertext vector, where the second ciphertext vector includes n ciphertexts, where n is equal to the dimension of the one-hot vector.

2. According to the method of claim 1, converting the first ciphertext into a first ciphertext vector comprises: Based on the SEALPIR extended algorithm, the first ciphertext is converted into the first ciphertext vector.

3. The method according to claim 1, wherein converting the first ciphertext vector into a second ciphertext vector comprises: Obtaining a first inverted ciphertext vector of a first ciphertext vector, wherein a plaintext vector corresponding to a sum of the first ciphertext vector and the first inverted ciphertext vector is an all-1 plaintext vector; Combining the first ciphertext vector and the first inverted ciphertext vector based on binary numbers corresponding to values ​​0 to n-1, respectively, to obtain a third ciphertext vector, the third ciphertext vector including n ciphertexts, wherein a maximum value of the n ciphertexts in the third ciphertext vector is logm, where m is a minimum value greater than or equal to a power of 2 of n; Substitute each component of the third ciphertext vector into a preset polynomial to obtain the second ciphertext vector.

4. The method according to claim 3, wherein obtaining a first inverted ciphertext vector of the first ciphertext vector comprises: Obtaining a homomorphically encrypted public key from the second party; Use the public key to encrypt each component of the all-1 plaintext vector to obtain a fourth ciphertext vector; The first ciphertext vector is subtracted from the fourth ciphertext vector to obtain the first negated ciphertext vector.

5. The method according to claim 2, wherein converting the first ciphertext vector into a second ciphertext vector comprises: Converting the first ciphertext vector into a second ciphertext, wherein the second ciphertext corresponds to the one-hot vector; Based on the SEALPIR secret state expansion technology, the second ciphertext is converted into the second ciphertext vector.

6. The method according to claim 1, wherein the first side comprises a data vector consisting of n pieces of data arranged in sequence, the one-hot vector corresponds to the i-th piece of data, and the method further comprises: Calculate the inner product of the second ciphertext vector and the data vector to obtain ciphertext data corresponding to the i-th data; The ciphertext data is returned to the second party.

7. The method according to claim 6, wherein receiving the first ciphertext from the second party comprises: A plurality of first ciphertexts arranged in sequence are received from a second party, wherein converting the first ciphertext vectors into a second ciphertext vector comprises converting the plurality of first ciphertext vectors into a plurality of second ciphertext vectors, thereby obtaining the second ciphertext vectors arranged in sequence, and the method further comprises: A ciphertext matrix is ​​obtained based on the second ciphertext vectors arranged in the sequence, wherein the plaintext corresponding to the ciphertext matrix is ​​a permutation matrix; Multiplying the ciphertext matrix by the data vector to obtain a permuted fifth ciphertext vector; receiving a value j to be queried from the second party, wherein j is determined by performing row permutation on the one-hot vector corresponding to i using the permutation matrix; The j-th row of ciphertext in the fifth ciphertext vector is returned to the second party.

8. A privacy-preserving data processing method, performed by a second party, comprising: Generate a binary vector corresponding to the one-hot vector; Encrypting the binary vector based on a homomorphic encryption algorithm to obtain a first ciphertext; The first ciphertext is sent to a first party so that the first party obtains a second ciphertext vector, wherein the second ciphertext vector includes n ciphertexts corresponding to the n plaintexts in the one-hot vector.

9. The method according to claim 8, wherein generating a binary vector corresponding to the one-hot vector comprises: A binary number corresponding to the one-hot vector is obtained, and a plurality of bits included in the binary number are arranged into a binary vector, wherein the number of bits in the binary number corresponds to the number of rows of the binary vector.

10. A computing device, comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method according to any one of claims 1 to 9 is implemented.

Images