A method of data processing for privacy protection and a computing device

Abstract

A data processing method and computing device for protecting privacy, the method is performed by a first party, comprising: receiving a first ciphertext from a second party, the first ciphertext is obtained by homomorphic encryption on a binary vector corresponding to a one-hot vector; converting the first ciphertext into a first ciphertext vector, the first ciphertext vector includes l ciphertexts, the l is equal to the dimension of the binary vector; converting the first ciphertext vector into a second ciphertext vector, the second ciphertext vector includes n ciphertexts, the n is equal to the dimension of the one-hot vector.

Description

TECHNICAL FIELD

[0001] Embodiments of the present specification belong to the field of data processing, and particularly relate to a data processing method for protecting privacy and a computing device. BACKGROUND

[0002] Private information retrieval is an important component in cryptography and is widely used in many fields. One implementation of this technology includes that a client constructs a ciphertext vector of a one-hot vector based on additive homomorphic encryption, and then sends the ciphertext vector to a server. After receiving the ciphertext vector, the server performs an inner product operation on the ciphertext vector and its own database plaintext vector to obtain the ciphertext requested by the client for query, and returns the ciphertext to the client. In this technical solution, since the number of data in the database is large, the data amount of the one-hot vector corresponding to the number of data is large. For example, if the database includes tens of thousands of data, the one-hot vector needs to include tens of thousands of components, and the ciphertext vector corresponding to the one-hot vector also includes tens of thousands of ciphertext components, so that the communication data amount of the ciphertext vector sent by the client to the server is large, and the communication cost is high. SUMMARY

[0003] The purpose of the present application is to provide a data processing scheme for protecting privacy.

[0004] The first aspect of the present specification provides a data processing method for protecting privacy, executed by a first party, comprising:

[0005] receiving a first ciphertext from a second party, the first ciphertext being obtained by homomorphically encrypting a binary vector corresponding to a one-hot vector;

[0006] converting the first ciphertext into a first ciphertext vector, the first ciphertext vector including l ciphertexts, the l being equal to the dimension of the binary vector;

[0007] converting the first ciphertext vector into a second ciphertext vector, the second ciphertext vector including n ciphertexts, the n being equal to the dimension of the one-hot vector.

[0008] The second aspect of the present specification provides a data processing method for protecting privacy, executed by a second party, comprising:

[0009] generating a binary vector corresponding to a one-hot vector;

[0010] encrypting the binary vector based on a homomorphic encryption algorithm to obtain a first ciphertext;

[0011] sending the first ciphertext to a first party, so as to make the first party obtain a second ciphertext vector, the second ciphertext vector including n ciphertexts corresponding to n plaintexts in a one-hot vector.

[0012] The third aspect of the specification provides a computer readable storage medium, which stores a computer program, and when the computer program is executed in a computer, the computer program causes the computer to execute the method of the first aspect or the second aspect.

[0013] The fourth aspect of the specification provides a computing device, which includes a memory and a processor, the memory stores executable code, and when the processor executes the executable code, the method of the first aspect or the second aspect is implemented.

[0014] The fifth aspect of the specification provides a computer program product, which includes a computer program / instruction, and when the computer program / instruction is executed by a processor, the steps of the method of the first aspect or the second aspect are implemented.

[0015] In the scheme of the embodiments of the specification, the client converts the one-hot vector into a binary vector and then encrypts to obtain a ciphertext polynomial with a number of terms of a logarithmic level. For example, the one-hot vector includes n components, the binary vector corresponding to the one-hot vector includes a number of components of a logn level, and the ciphertext polynomial corresponding to the binary vector includes a number of terms of a logn level. Therefore, the ciphertext sent by the client to the server has a smaller data amount than the prior art, and the communication overhead is reduced. BRIEF DESCRIPTION OF DRAWINGS

[0016] In order to more clearly illustrate the technical solutions of the embodiments of the specification, the drawings needed in the embodiment description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments described in the specification, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.

[0017] Figure 1 A schematic diagram of a data processing system in an embodiment of the specification;

[0018] Figure 2 A flowchart of a privacy-protecting data processing method in an embodiment of the specification;

[0019] Figure 3 A process diagram for the second party to generate ciphertext in an embodiment of the specification;

[0020] Figure 4 A process diagram for converting ciphertext into a ciphertext vector corresponding to a one-hot vector in an embodiment of the specification;

[0021] Figure 5 A process diagram for ciphertext decoding based on a polynomial in an embodiment of the specification;

[0022] Figure 6A process diagram for directly decoding a first ciphertext vector to obtain a second ciphertext vector in an embodiment of the present specification. DETAILED DESCRIPTION

[0023] In order for those skilled in the art to better understand the technical solutions in the present specification, the technical solutions in the embodiments of the present specification will be clearly and completely described below in conjunction with the drawings in the embodiments of the present specification. Obviously, the described embodiments are only part of the embodiments of the present specification, not all. Based on the embodiments in the present specification, all other embodiments obtained by those skilled in the art without creative labor should be within the scope of protection of the present specification.

[0024] In view of the problems in the prior art, in a related technology, a client encrypts a one-hot vector based on a fully homomorphic encryption algorithm to obtain a ciphertext corresponding to the one-hot vector, and sends the ciphertext to a server. The server expands the one ciphertext into a plurality of ciphertexts arranged in sequence based on a SEAL PIR expansion algorithm, and the plurality of ciphertexts arranged in sequence can constitute a ciphertext vector corresponding to the one-hot vector. In this way, compared with the implementation manner described above, the amount of communication data is reduced. However, the number of terms of the ciphertext generated by the client is corresponding to the data entries in the database, so the data amount of the ciphertext is still in a linear relationship with the data entries in the database, and in the case of a large number of data entries, the data amount of the ciphertext generated by the client is still large.

[0025] An embodiment of the present specification provides a data processing scheme. Figure 1 A schematic diagram of a data processing system in an embodiment of the present specification is shown in FIG. 1. As shown in FIG. 1, the system can include a first party and a second party, wherein the second party wants to provide the first party with a ciphertext of a one-hot vector. Figure 1

[0026] Specifically, the second party is, for example, a client, and the first party is, for example, a server, and the server includes, for example, a database for the client to query data. In the second party, the one-hot vector can be converted into a binary vector, and the binary vector can be encrypted by a homomorphic encryption algorithm to obtain a ciphertext of the binary vector, and the ciphertext can be sent to the first party. In the first party, the ciphertext can be first expanded into a first ciphertext vector corresponding to the binary vector, and then the first ciphertext vector can be converted into a second ciphertext vector corresponding to the one-hot vector. After obtaining the second ciphertext vector, the first party can perform data query based on the second ciphertext vector, so as to return the ciphertext data corresponding to the one-hot vector to the second party.

[0027] ​In this way, the client converts the one-hot vector into a binary vector and then encrypts the binary vector to obtain ciphertext, and the number of terms of the polynomial of the ciphertext is only logarithmic, for example, the one-hot vector includes n components, the binary vector corresponding to the one-hot vector includes logn components, and the ciphertext polynomial corresponding to the binary vector includes logn terms. Therefore, the ciphertext sent by the client to the server has a smaller data amount than the prior art, and the communication overhead is reduced.

[0028] The one-hot vector refers to a vector with only one non-zero component.

[0029] The homomorphic encryption algorithm in the embodiments of the present specification includes a fully homomorphic encryption algorithm. The fully homomorphic encryption algorithm is an encryption technology that allows any calculation to be performed on encrypted data. The fully homomorphic encryption algorithm includes, for example, BFV, CKKS, FV, BV, and the like, and is not limited thereto. The embodiments of the present specification are described by taking the BFV algorithm as an example.

[0030] The homomorphic encryption algorithm in the embodiments of the present specification may, for example, include the following six algorithms:

[0031] (1) Key generation algorithm (KeyGen), which is used to generate a private key sk and a public key pk.

[0032] Let the plaintext space be a polynomial space where the degree of the polynomial space is less than N, where N is a power of 2, for example, can take values of 4096, 8192, etc., and the coefficients are integers in [0, q). The ciphertext space corresponding to the plaintext space is R can be randomly generated by the key generation algorithm q A polynomial in R is used as the private key sk, and each coefficient of the polynomial is subject to a discrete Gaussian distribution with a standard deviation of χ σ . Then, the public key pk = (-a*sk + e, a) can be generated, where a is a randomly generated polynomial in R q , e <- χ σ .

[0033] (2) Encoding algorithm (Encode), which is used to convert the plaintext vector into a polynomial v ∈ R q , for example, [a0, a1, a2, …a N-1 ], then can be converted into a polynomial v = a0 + a1x + a2x 2 + … + a N-1 x N-1 .

[0034] (3) Encryption algorithm, used to encrypt plaintext polynomial v into ciphertext (the form of ciphertext is two polynomials) with public key. Specifically, let pk=(p0, p1), then ciphertext Herein, c1=u*p1+e1, wherein v is plaintext polynomial.

[0035] (4) Decryption algorithm, used to decrypt ciphertext into plaintext polynomial. Let ciphertext ct=(c0, c1), then is the decrypted plaintext polynomial.

[0036] (5) Decode algorithm, used to convert plaintext polynomial into plaintext vector.

[0037] (6) Homomorphic computation, including homomorphic addition, homomorphic multiplication, homomorphic substitution, etc.

[0038] Specifically, in homomorphic addition, for plaintext polynomial m and plaintext polynomial t, E(m+t)=E(m)+E(t), wherein plaintext polynomial m and plaintext polynomial t are polynomials in the same polynomial space, and E() represents ciphertext obtained by homomorphic encryption on ciphertext polynomial; in homomorphic multiplication, E(t*m)=t*E(m), wherein t is plaintext polynomial; in another homomorphic multiplication, E(n*m)=E(n)*E(m).

[0039] The data processing scheme for protecting privacy in the embodiments of the present specification is described in detail below.

[0040] Figure 2 is a flowchart of a data processing method for protecting privacy in the embodiments of the present specification.

[0041] As shown in the figure, in step S201, the second party generates a binary vector corresponding to the one-hot vector.

[0042] Figure 3 A process diagram for the second party to generate ciphertext is shown. As described above, the dimension of the one-hot vector in the second party is usually the same as the number of data entries in the database to be queried, for indicating which data in the database is queried, and the number of data entries in the database is usually large. In order to facilitate the presentation of the scheme in the embodiments of the present specification, it is assumed in the embodiments that there are 8 data in the database, i.e., the one-hot vector includes 8 components. It can be understood that those skilled in the art can easily extend the scheme to one-hot vectors of larger dimensions.

[0043] As Figure 3As shown in the diagram, the one-hot vector [0,0,0,0,0,0,1,0] represents the 6th data item in a sequentially arranged list of 8 data items in the database. Wherein, as... Figure 3 As shown by the index on the left side of the hot vector, these 8 data points are counted starting from the 0th point. By counting from the 0th point, these 8 data points can be mapped one-to-one with a 3-bit binary number according to their number. For example, 0 can be represented as the binary number 000, so the 0th data point corresponds to the binary number 000. Similarly, the 1st data point corresponds to the binary number 001, ... the 6th data point corresponds to the binary number 110, and the 7th data point corresponds to the binary number 111.

[0044] Therefore, the one-hot vector corresponding to each data point can be converted into a binary vector based on the binary number corresponding to that data point. Specifically, the three bits (0 or 1) of the binary number corresponding to the one-hot vector can be arranged into a vector, with the lower-order bits arranged in the lower dimension and the higher-order bits arranged in the higher dimension, thus obtaining the binary vector. For example... Figure 3 As shown, for the binary number 110 corresponding to the one-hot vector [0,0,0,0,0,0,1,0], the 0th bit is arranged in the 0th row of the binary vector, the 1st bit is arranged in the 1st row of the binary vector, and the 2nd bit is arranged in the 2nd row of the binary vector, thus obtaining the following... Figure 3 The binary vector shown is [0,1,1].

[0045] It is understandable that while this example exemplifies a one-hot vector with n = 8 components, which is exactly a power of 2, this specification is not limited to this. For an n-dimensional one-hot vector, when n is not a power of 2, we can first determine the smallest m, where m is a power of 2 and m ≥ n, i.e., m is the smallest value greater than or equal to a power of 2. Then, this n-dimensional one-hot vector can be converted into a logm-dimensional binary vector. For example, when n = 7, we can determine m = 8, thus converting a 7-dimensional one-hot vector into a log8 = 3-dimensional binary vector.

[0046] In step S203, the second party encrypts the binary vector based on a homomorphic encryption algorithm to obtain ciphertext.

[0047] After converting the one-hot vector into a binary vector as described above, the second party can perform homomorphic encryption on the binary vector using the homomorphic encryption algorithm described above. Specifically, taking the BFV algorithm as an example, the binary vector [0,1,1] is first converted into a polynomial x. 2 +x, then encrypt the polynomial to obtain the ciphertext Enc(x) corresponding to the binary vector. 2 +x). For example Figure 3 As shown, in non-white ( Figure 3The block in blue color shows the ciphertext Enc(x 2 For the convenience of understanding, in the present specification Figures 3 to 6 In the present specification, a white block represents a plaintext, and a non-white block represents a ciphertext. Correspondingly, a plurality of white blocks represent a plurality of plaintexts, and a plurality of non-white blocks represent a plurality of ciphertexts.

[0048] In step S205, the second party sends the ciphertext to the first party.

[0049] As mentioned above, the ciphertext polynomial corresponding to the one-hot vector [0, 0, 0, 0, 0, 0, 1, 0] includes 8 terms, while the ciphertext polynomial Enc(x 2 +x) corresponding to the 3-bit binary vector includes only 3 terms, which greatly reduces the amount of ciphertext data compared to the ciphertext polynomial corresponding to the one-hot vector [0, 0, 0, 0, 0, 0, 1, 0].

[0050] For an n-dimensional one-hot vector, it can be converted into an l = logm-dimensional binary vector (where m is the minimum value of the power of 2 that is greater than or equal to n), so that the ciphertext polynomial of the binary vector includes only logm terms, thereby greatly reducing the amount of communication data compared to the n-term ciphertext polynomial corresponding to the n-dimensional one-hot vector.

[0051] In step S207, after receiving the ciphertext, the first party converts the ciphertext into a first ciphertext vector corresponding to a binary vector.

[0052] Specifically, for example, after receiving the ciphertext Enc(x 2 +x), the first party converts the one ciphertext into a sequence of l ciphertexts, where l is equal to the dimension of the binary vector, and here l = 3. Then, the first party can arrange the sequence of l ciphertexts into a first ciphertext vector, where each ciphertext in the first ciphertext vector corresponds to a plaintext in the binary vector.

[0053] Figure 4 A process diagram for converting the ciphertext into a ciphertext vector corresponding to a one-hot vector (i.e., a second ciphertext vector) in the embodiments of the present specification. As shown in the left part of Figure 4 In step S207, after receiving the ciphertext, the first party converts the ciphertext into a first ciphertext vector corresponding to a binary vector. 2+x) converting into a binary vector corresponding ciphertext vector (i.e. a first ciphertext vector), the first ciphertext vector including three ciphertexts, the numbers in the blue square corresponding to the ciphertexts are used to indicate the plaintext corresponding to the ciphertexts. For example, the ciphertext corresponding to the plaintext of the 0th row of the first ciphertext vector is the number 0, the ciphertext corresponding to the plaintext of the 1st row is the number 1, and the ciphertext corresponding to the plaintext of the 2nd row is the number 1. In the embodiments of the present specification, the ciphertext of the number can be equivalent to the ciphertext of the polynomial including only the constant term. It can be understood that according to the homomorphic encryption algorithm, the ciphertexts in the 1st row and the 2nd row of the first ciphertext vector are both ciphertexts of the number 1, but they include different polynomials.

[0054] In an implementation, the ciphertexts can be converted into l ciphertexts corresponding to each component of the binary vector by the SEAL PIR expansion algorithm described above. Although in the related art, the ciphertexts corresponding to the one-hot vector are converted into a plurality of ciphertexts corresponding to each component of the one-hot vector by the SEAL PIR expansion algorithm, the embodiments of the present specification innovatively use the SEAL PIR expansion algorithm to expand the ciphertexts of an arbitrary bit vector, and it has been verified that the l ciphertexts obtained by expanding the ciphertexts of an arbitrary bit vector of dimension l by the SEAL PIR expansion algorithm are exactly the ciphertexts of the l plaintext bits included in the arbitrary vector, wherein each component of the bit vector is 1 or 0.

[0055] Specifically, it is assumed that the ciphertext vector ciphertexts is initially [Enc(x 2 +x)], that is, there is only one ciphertext component, and it is assumed that k is the serial number of the component in ciphertexts. In order to expand ciphertexts to include n ciphertext components, the smallest t = 2 s can be determined first, and t ≥ l, and then the following loop can be performed to expand the dimension of the ciphertext vector ciphertexts:

[0056] For j = 0 to s-1 do

[0057] For k = 0 to 2 j -1 do

[0058] c0←ciphertests[k]

[0059]

[0060]

[0061]

[0062]

[0063] for j = 0 to l-1 do

[0064] o j ←ciphertests[j]﹒1 / t

[0065] Return output←[o0,o1,…,o l-1 ]

[0066] where, in the above loop, Sub(c,s) represents a substitution operation, specifically, assuming that the ciphertext c = p(x), s is an odd number, Sub(c,s) returns p = (x s ), that is, x s is replaced by x to perform calculation.

[0067] In the above loop, each loop expands the number of ciphertext vectors to twice the original number. Taking t = 4 and l = 3 as an example, the above algorithm will perform 2 rounds of ciphertext generation in total, wherein the first round generates a pair of ciphertexts: (c'0, c'1), and the second round generates two pairs of ciphertexts: (c'0, c'2) and (c'1, c'3). Then, by taking the first three ciphertexts c'0, c'1, c'2 from the four generated ciphertexts and multiplying the three ciphertexts by 1 / 4 respectively, the first ciphertext vector as shown in Figure 4 can be obtained.

[0068] As shown in Figure 4 , the first ciphertext vector includes three ciphertexts, the ciphertext in the 0th row is Enc(0), the ciphertext in the 1st row is Enc(1), and the ciphertext in the 2nd row is Enc(1). Among them, the plaintext corresponding to Enc(0) is 0, and the plaintext corresponding to Enc(1) is 1.

[0069] It can be understood that after the first party obtains the first ciphertext vector as described above, since the first party obtains the first ciphertext vector by expanding the ciphertext [Enc(x 2 +x)] based on the SEALPIR expansion algorithm, the first party cannot know what plaintext polynomial each ciphertext in the first ciphertext vector corresponds to.

[0070] In step S209, the first party converts the first ciphertext vector into a second ciphertext vector corresponding to a one-hot vector.

[0071] In an embodiment, ciphertext decoding based on a polynomial can be performed.

[0072] Figure 5 A process diagram for ciphertext decoding based on a polynomial in an embodiment of the present specification.

[0073] As shown in Figure 5As shown, the first ciphertext vector corresponding to the binary vector [0, 1, 1] is denoted as a ciphertext vector L, where L[i] represents the component of the ith row of L, specifically, the ciphertext L[0] of the 0th row in the ciphertext vector L is Enc(0), the ciphertext L[1] of the 1st row is Enc(1), and the ciphertext L[2] of the 2nd row is Enc(1). It can be understood that, since different random polynomials are used for homomorphic encryption each time the same plaintext is homomorphic encrypted according to the homomorphic encryption algorithm, the ciphertext Enc(1) of L[1] and the ciphertext Enc(1) of L[2] are different polynomials.

[0074] The ciphertext vector R can be calculated based on the ciphertext vector L, where the ciphertext vector R added with the first ciphertext vector L is a ciphertext vector corresponding to the vector [1, 1, 1]. Specifically, the first party can use the public key of the second party to homomorphic encrypt each component of the vector [1, 1, 1] to obtain a ciphertext vector corresponding to the vector [1, 1, 1], that is, [Enc(1), Enc(1), Enc(1)]. It can be understood that, according to the homomorphic encryption algorithm, different random polynomials are used for homomorphic encryption each time 1 is homomorphic encrypted, and thus the ciphertext Enc(1) corresponding to each component is a different polynomial. Then, [Enc(1), Enc(1), Enc(1)] is subtracted from the vector L, and thus the vector R can be obtained, where the vector R includes three ciphertexts, R[0] = Enc(1), R[1] = Enc(0), and R[2] = Enc(0).

[0075] Then, the first party can take the ciphertext vector L and the ciphertext vector R as the input (Input) of the algorithm shown in the rectangular box, and obtain the output (Output) T through Figure 5

[0076] Specifically, as shown in the algorithm in Figure 5 , the components T[j] of each row of the ciphertext vector T are calculated through multiple loops:

[0077] T[j]←j2×L[2]+(1-j2)×R[2]+

[0078] j1×L[1]+(1-j1)×R[1]+

[0079] j0×L[0]+(1-j0)×R[0]

[0080] where j represents the row number in the vector T, and j2, j1, and j0 are the bits in the binary number j2j1j0 corresponding to j.

[0081] ​Thus, the ciphertext vector T, which includes eight ciphertexts T[j], j∈[0, 7], can be obtained as shown on the right side of the figure, and each ciphertext corresponds to a number in the block, which represents the plaintext corresponding to the ciphertext.

[0082] From Figure 5 It can be seen that the plaintext of the ciphertext vector T is not a one-hot vector, but according to the algorithm shown in Figure 5 It can be determined that the value range of the plaintext corresponding to each ciphertext component in the ciphertext vector T should be in [0, logm], and only one position is logm, where m = 8. Therefore, a polynomial f(x) can be constructed by the interpolation method The polynomial satisfies that the value of the polynomial is 1 only when x = logm. Then, each ciphertext component T[j] of the ciphertext vector T is substituted into f(x) to obtain the ciphertext component T'[j] of the ciphertext vector T' (i.e., the second ciphertext vector). Since T[j] is a fully homomorphic encryption ciphertext, according to the fully homomorphic algorithm, substituting the ciphertext component T[j] into f(x) is equivalent to substituting the ciphertext of the result obtained by substituting the plaintext corresponding to T[j] into f(x), so the plaintext corresponding to T'[j] must be the component of the jth row in the one-hot vector [0, 0, 0, 0, 0, 0, 1, 0], that is, the decryption result of the ciphertext vector T' is the one-hot vector [0, 0, 0, 0, 0, 0, 1, 0].

[0083] It can be understood that Figure 5 Although the three-row binary vector and the eight-row one-hot vector are described as examples in Figure 5 The algorithm shown can be applied to binary vectors of other dimensions and one-hot vectors corresponding to the binary vectors. In addition, the dimension of the one-hot vector does not have to be 2 l where l is the dimension of the binary vector. For example, in the case of a seven-dimensional one-hot vector, only T[0]~T[6] can be calculated based on the algorithm shown in Figure 5 , thereby obtaining a seven-dimensional one-hot vector.

[0084] Specifically, for the first ciphertext vector of l dimensions and the dimension n of the desired one-hot vector, the first ciphertext vector and the negated ciphertext vector of the first ciphertext term can be combined based on the binary numbers corresponding to the numerical values 0 to n-1, respectively, to obtain a third ciphertext vector, which includes n ciphertexts, wherein the maximum value of the n ciphertexts in the third ciphertext vector is logm, where m is the minimum value of the power of 2 greater than or equal to n; and each component of the third ciphertext vector is substituted into a polynomial constructed based on an interpolation algorithm to obtain the second ciphertext vector.

[0085] In another embodiment, the first party can obtain the second ciphertext vector by directly decoding the first ciphertext vector.

[0086] Figure 6 This is a schematic diagram illustrating the process of obtaining the second ciphertext vector by directly decoding the first ciphertext vector in the embodiments of this specification.

[0087] like Figure 6 As shown, assuming the first ciphertext vector is the aforementioned ciphertext vector L, the ciphertext vector L can be used as... Figure 6 The algorithm is given as input, and its output, output, is calculated using this algorithm, i.e., the ciphertext r = Enc(x), is given as input. i ), where i = 6.

[0088] Specifically, for a 3-line ciphertext vector L, c[j] can be calculated through 3 loops:

[0089] c[j]=x 0 (1-R[j])+x 2j R[j]

[0090] Where j is the row number of the ciphertext vector L, j = 0, 1, 2, then r = c[0] × c[1] × c[2] can be calculated.

[0091] Verification shows that the plaintext vector corresponding to the ciphertext r is a one-hot vector [0,0,0,0,0,0,1,0]. Therefore, the ciphertext r can be similarly expanded into a ciphertext vector corresponding to the one-hot vector [0,0,0,0,0,0,1,0] using the SEALPIR expansion algorithm. When the dimension n of the desired one-hot vector is less than 8, for example, n=7, the first 7 rows of components can be taken from the expanded 8-dimensional ciphertext vector to obtain the final second ciphertext vector.

[0092] After obtaining the second ciphertext vector, the first party can perform data queries based on the second ciphertext vector, similar to existing technologies.

[0093] In one implementation, the first party can perform an inner product between the second ciphertext vector and the plaintext vectors corresponding to multiple data items of the first party. The result of this inner product is the ciphertext of the data that the second party wishes to query. The first party can then return the ciphertext of this data to the second party, who can then decrypt the ciphertext using a homomorphic encryption private key to obtain the data. During this process, the first party cannot know which data item the second party is querying, thus achieving privacy information retrieval.

[0094] In another embodiment, the second party can send to the first party a plurality of ciphertexts in a sequential order, which are obtained by homomorphically encrypting vectors of rows or columns of a permutation matrix respectively. The permutation matrix can be used to represent an operation of rearranging or transforming rows or columns in a matrix, which can be a square binary matrix with only one 1 in each row or column and 0s elsewhere. Specifically, the permutation matrix can be a matrix obtained by exchanging some rows or columns of an identity matrix. It should be understood that the identity matrix itself is a most basic permutation matrix, which does not process the matrix at all.

[0095] The first party can convert the plurality of ciphertexts in the sequential order into a plurality of second ciphertext vectors in a sequential order as described above, so as to obtain a ciphertext permutation matrix corresponding to the permutation matrix. The first party can multiply the ciphertext permutation matrix by a plaintext vector corresponding to the plurality of data of the first party, so as to obtain a permuted ciphertext vector. In this process, since the first party performs homomorphic operations between ciphertexts and plaintexts, the first party cannot know the specific permutation matrix, i.e., cannot know which data each component in the ciphertext vector corresponds to.

[0096] When querying data, the second party can first permute the one-hot vector corresponding to the index value i using the same permutation matrix, and then send the index value j obtained after the permutation to the first party, and the first party sends the jth row of ciphertext data in the ciphertext vector to the second party. The second party decrypts the ciphertext data, and obtains the ith row of data in the plaintext vector.

[0097] In the 1990s, it was quite obvious to distinguish whether an improvement in a technology was in hardware (e.g., improvement in circuit structures of diodes, transistors, switches, etc.) or in software (improvement in method flow). However, as technology has evolved, many improvements in method flow today can be considered as direct improvements in hardware circuit structures. Designers almost always obtain the corresponding hardware circuit structures by programming the improved method flow into hardware circuits. Therefore, it cannot be said that an improvement in a method flow cannot be implemented by hardware entity modules. For example, a programmable logic device (PLD) (e.g., a field programmable gate array (FPGA)) is an integrated circuit whose logic function is determined by user programming of the device. A digital system is "integrated" on a PLD by the designer programming it, rather than by asking a chip manufacturer to design and fabricate a custom integrated circuit chip. Moreover, instead of manually fabricating integrated circuit chips, this programming is now mostly implemented by "logic compiler" software, which is similar to software compilers used in program development, and the original code to be compiled is written in a specific programming language, which is called a hardware description language (HDL), and there are many such languages, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc., and the most commonly used are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should be aware that, as long as the method flow is logically programmed in the above-mentioned hardware description languages and programmed into an integrated circuit, a hardware circuit implementing the logical method flow can be easily obtained.

[0098] The controller can be implemented in any suitable way, for example, the controller can take the form of, for example, a microprocessor or processor and a computer readable medium storing computer readable program code, such as software or firmware, executable by the (micro)processor, logic gates, switches, an application specific integrated circuit (ASIC), a programmable logic controller and an embedded microcontroller, examples of which include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20 and Silicone Labs C8051F320, the memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also know that, in addition to being implemented in pure computer readable program code form, the controller can perfectly well be implemented to perform the same functions in the form of logic gates, switches, an application specific integrated circuit, a programmable logic controller and an embedded microcontroller, etc. by means of logical programming of the method steps. Such a controller can thus be considered a hardware component, and the means comprised therein for performing the various functions can also be considered structures within the hardware component. Alternatively, or even, the means for performing the various functions can be considered both software modules implementing the method and structures within the hardware component.

[0099] The systems, apparatuses, modules or units illustrated by the above embodiments can be specifically implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, the present application does not exclude that with the development of computer technology in the future, computers implementing the functions of the above embodiments can be personal computers, laptop computers, vehicle-mounted human-computer interaction devices, cellular phones, camera phones, smart phones, personal digital assistants, media players, navigation devices, electronic mail devices, game consoles, tablet computers, wearable devices, or combinations of any of these devices.

[0100] Although the method operations of the embodiments of the present disclosure are described in a particular, sequential order, one or more of the method operations can be omitted, or the method operations can be performed in an order other than the described order. Additionally, one or more of the method operations can be performed concurrently, or with partial concurrence. Furthermore, one or more of the method operations can be performed by different entities, or over different time periods. The term "including" as used herein is intended to mean "comprising," such that the process, method, article, or apparatus that includes elements in addition to those specified. As used in this description, the term "coupled" means a direct or indirect connection, which can be physical or logical. The term "coupled" does not relate to a direct connection or wiring.

[0101] For the sake of description, the above-described apparatus is described as various modules to describe the functions of the apparatus. Of course, when implementing one or more embodiments of the present disclosure, the functions of the modules can be implemented in one or more software and / or hardware, or the modules implementing the same functions can be combined into a plurality of sub-modules or sub-units. The apparatus embodiments described above are merely illustrative, for example, the division of the units is merely a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units or components shown or discussed can be indirect coupling or communication connection through some interfaces, devices or units, and can be electrical, mechanical or other forms.

[0102] The present disclosure is described with reference to the flowcharts and / or block diagrams of the methods, apparatus (systems) and computer program products according to embodiments of the present disclosure. It should be understood that each flow and / or block in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing apparatus generate a means for implementing the functions specified in the flowcharts and / or block diagrams. Figure 1 The term "coupled" means a direct or indirect connection, which can be physical or logical. Figure 1 The term "coupled" means a direct or indirect connection, which can be physical or logical.

[0103] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the Figure 1 function specified in the flow or flows and / or blocks Figure 1 of the block or blocks.

[0104] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the Figure 1 function specified in the flow or flows and / or blocks Figure 1 of the block or blocks.

[0105] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0106] The memory can include non-persistent memory and / or volatile memory, such as random access memory (RAM) and / or cache memory, non-volatile memory, such as read-only memory (ROM), EPROM, and / or flash memory. The memory is an example of computer-readable media.

[0107] Computer-readable media includes permanent and non-permanent, moveable and non- moveable media that can be implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile discs (DVDs) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, graphene storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to computing devices. According to the definition herein, computer-readable media does not include transitory media, such as modulated data signals and carrier waves.

[0108] Those skilled in the art will appreciate that the one or more embodiments described herein can be provided as a method, a system or a computer program product. Accordingly, the one or more embodiments described herein can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the one or more embodiments described herein can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) embodying computer readable code.

[0109] The one or more embodiments described herein can be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform particular tasks or implement particular abstract data types. The one or more embodiments described herein can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules can be located in both local and remote computer storage media including memory storage devices.

[0110] The various embodiments described in this specification are described in the context of progressive embodiments, with each embodiment building on the previous one. The same or similar parts between embodiments are cross-referenced as appropriate. Each embodiment focuses on the differences between that embodiment and the previous one. In particular, the system embodiments are described relatively simply, as they are substantially similar to the method embodiments. In the description of the specification, the description of the terms "one embodiment", "some embodiments", "example", "specific example" or "some examples" means that the specific feature, structure, material or characteristic being described in connection with that embodiment or example is included in at least one embodiment or example in the specification. Illustrative representations of the above terms in the specification are not necessarily referring to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics being described can be combined in any suitable manner in one or more embodiments or examples. Furthermore, the skilled person can combine and combine features of different embodiments or examples and characteristics of different embodiments or examples in a manner that is not mutually contradictory.

[0111] The above description merely provides examples of the one or more embodiments described in this specification and does not limit the one or more embodiments described in this specification. The one or more embodiments described in this specification can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the one or more embodiments described in this specification should be included in the scope of the claims.

Claims

1. A method for processing data with privacy protection, performed by a first party, comprising: receiving, from a second party, a first ciphertext obtained by homomorphically encrypting a binary vector corresponding to a one-hot vector; converting the first ciphertext into a first ciphertext vector, the first ciphertext vector comprising l ciphertexts, the l being equal to a dimension of the binary vector; converting the first ciphertext vector into a second ciphertext vector, the second ciphertext vector comprising n ciphertexts, the n being equal to a dimension of the one-hot vector.

2. The method of claim 1, the converting the first ciphertext to a first ciphertext vector comprising: converting the first ciphertext into the first ciphertext vector based on a SEAL PIR extension algorithm. 3.The method of claim 1, wherein the converting the first ciphertext vector into the second ciphertext vector comprises: obtaining a first negated ciphertext vector of the first ciphertext vector, a plaintext vector corresponding to a sum of the first ciphertext vector and the first negated ciphertext vector being an all-1 plaintext vector; combining the first ciphertext vector and the first negated ciphertext vector based on binary numbers corresponding to values 0 to n-1 respectively to obtain a third ciphertext vector, the third ciphertext vector comprising n ciphertexts, wherein a maximum value of the n ciphertexts in the third ciphertext vector is logm, wherein m is a minimum value in powers of 2 greater than or equal to n; substituting each component of the third ciphertext vector into a preset polynomial to obtain the second ciphertext vector. 4.The method of claim 3, wherein the obtaining the first negated ciphertext vector of the first ciphertext vector comprises: obtaining, from the second party, a homomorphically encrypted public key; encrypting each component of an all-1 plaintext vector using the public key to obtain a fourth ciphertext vector; subtracting the fourth ciphertext vector from the first ciphertext vector to obtain the first negated ciphertext vector. 5.The method of claim 2, wherein the converting the first ciphertext vector into the second ciphertext vector comprises: converting the first ciphertext vector into a second ciphertext corresponding to the one-hot vector; converting the second ciphertext into the second ciphertext vector based on a SEAL PIR ciphertext extension technique. 6.The method of claim 1, wherein the first party comprises a data vector comprising n pieces of data arranged in sequence, the one-hot vector corresponding to the i th piece of data, the method further comprising: calculating an inner product of the second ciphertext vector and the data vector to obtain ciphertext data corresponding to the i th piece of data; returning the ciphertext data to the second party.

7. The method of claim 6, the receiving the first ciphertext from the second party comprising: receiving, from a second party, a plurality of first ciphertexts arranged in sequence, the converting the first ciphertext vector into the second ciphertext vector comprising converting a plurality of first ciphertext vectors into a plurality of second ciphertext vectors to obtain a plurality of second ciphertext vectors arranged in sequence, the method further comprising: obtaining a ciphertext matrix based on the plurality of second ciphertext vectors arranged in sequence, the ciphertext matrix corresponding to a permutation matrix; multiplying the ciphertext matrix and the data vector to obtain a fifth ciphertext vector that is permuted; receiving, from the second party, a value j to be queried, the j being determined by performing row permutation on a one-hot vector corresponding to i using the permutation matrix. returning the jth row of the fifth ciphertext vector to the second party.

8. A data processing method for privacy protection, executed by a second party, comprising: generating a binary vector corresponding to a one-hot vector; encrypting the binary vector based on a homomorphic encryption algorithm to obtain a first ciphertext; sending the first ciphertext to a first party, for causing the first party to convert the first ciphertext into a first ciphertext vector, and convert the first ciphertext vector into a second ciphertext vector, the first ciphertext vector comprising l ciphertexts, the l being equal to a dimension of the binary vector; the second ciphertext vector comprising n ciphertexts corresponding to n plaintexts in the one-hot vector.

9. The method of claim 8, wherein the generating a binary vector corresponding to a one-hot vector comprises: obtaining a binary number corresponding to the one-hot vector, and arranging a plurality of bits included in the binary number into a binary vector, wherein a bit number of the bits in the binary number corresponds to a row number of the binary vector.

10. A computing device comprising a memory and a processor, the memory having stored therein executable code, the processor implementing the method of any one of claims 1-9 when executing the executable code.

Images