Secure communication protocol for hidden approximate nearest neighbor search

Abstract

The invention relates to the field of encrypted search, and discloses a secure communication protocol for hidden approximate nearest neighbor search. The protocol comprises the following steps: generating a first key and a second key based on query data submitted by a user through a client; respectively sending the first key and the second key to a first server and a second server; the first server and the second server are non-collusion; calculating, by the first server, a first secret sharing value based on the first key and the index table set; performing hidden filtering on the first secret sharing value, screening out a first non-zero component as a first result sharing value, and returning the first result sharing value to the client; the index table set comprises a hash table constructed by a plurality of position sensitive hash functions based on different sensitivities; calculating, by the second server, a second secret sharing value based on the second key and the index table set; performing hidden filtering on the second secret sharing value, screening out a first non-zero component as a second result sharing value, and returning the second result sharing value to the client; the second result sharing value and the first result sharing value are different secret sharing values of the same query result; and summing the first result sharing value and the second result sharing value through the client to obtain a query result. By adopting the method, encrypted communication between the client and the server can be realized, and the security of user data and server data is ensured in an approximate nearest neighbor search process.

Description

Technical Field

[0001] The present application relates to the field of encrypted search, and in particular to a secure communication protocol for concealed approximate nearest neighbor search. Background Art

[0002] Approximate nearest neighbor search has a wide range of applications, including image retrieval, recommendation systems, natural language processing, question answering, document ranking, etc. For example, a user has an image or text, and through nearest neighbor search, the closest similar content (image or text) can be found from a large database on a remote server.

[0003] With the increasing application of approximate nearest neighbor search in recent years, the protection of data privacy has become an important issue. For example, in the application scenario of face retrieval, given an image of a person to search for similar faces, the face recognition system needs to extract the feature vector of the image, query the large database of the remote server, and find the nearest neighbor item of the feature vector. If the similarity between a database item and the given image exceeds the threshold, the recognition is successful. In this process, the query vector sent to the server contains private information that the user is unwilling to expose to strangers, which will cause the user's privacy data to be leaked. In addition, when the server returns the query results to the user, the result data may also be maliciously intercepted, resulting in database information leakage. Therefore, it is necessary to find a method that can protect the privacy of users and data in the database and can correctly obtain the nearest neighbor results. Summary of the invention

[0004] In view of this, the present application aims to propose a secure communication protocol for concealing approximate nearest neighbor search, so as to achieve security protection of user's privacy data and data in server database and avoid data leakage.

[0005] To achieve the above purpose, the technical solution of this application is as follows: In a first aspect, an embodiment of the present application provides a secure communication protocol for concealing approximate nearest neighbor search, the protocol comprising: Generate a first key and a second key based on query data submitted by a user through a client; send the first key and the second key to a first server and a second server respectively; the first server and the second server are non-collusive; By means of the first server, a first secret sharing value is calculated based on the first key and the index table set; the first secret sharing value is subjected to hidden filtering, a first non-zero component is screened out as a first result sharing value, and the result is returned to the client; the index table set includes: a hash table constructed based on multiple position-sensitive hash functions with different sensitivities; Calculate a second secret sharing value based on the second key and the index table set through the second server; perform anonymity filtering on the second secret sharing value, select the first non-zero component as the second result sharing value, and return it to the client; the second result sharing value and the first result sharing value are different secret sharing values ​​for the same query result; The first result sharing value and the second result sharing value are summed up through the client to obtain a query result.

[0006] Optionally, generating the first key and the second key based on the query data submitted by the user includes: Extract features from the query data submitted by the user and generate a query vector; Calculating a query index vector based on the query vector and the multiple position-sensitive hash functions of different sensitivities; wherein the order of each component in the query index vector corresponds one-to-one to the order of each position-sensitive hash function; Based on the query index vector, a first key and a second key are generated.

[0007] Optionally, calculating a query index vector based on the query vector and the multiple position-sensitive hash functions of different sensitivities includes: Calculate the corresponding hash value based on each locality-sensitive hash function in order as a component of the query index vector: ; in, q is the query vector, For the j A locality-sensitive hash function, L is the total number of locality-sensitive hash functions, The first j Quantity; Hash values ​​corresponding to all locality-sensitive hash functions , generate the query index vector It is expressed as: .

[0008] Optionally, generating a first key and a second key based on the query index vector includes: According to the query index vector, a distributed point function construction method is used to generate a first key and the second key : ; ; in, is the key generation function in the distributed point function construction method, The first key No. j Quantity, The second key No. j Quantity, The first j Quantity, It is the evaluation function in the distributed point function construction method.

[0009] Optionally, calculating, by the first server, a first secret sharing value based on the first key and the index table set includes: ; in, is the jth component of the first secret shared value, is the index range of the hash table, For the j The first i The hash value corresponding to the hash bucket is The first key No. j Quantity; Further, generate a first secret sharing value , expressed as: ; Calculating, by the second server, a second secret sharing value based on the second key and the index table set, including: ; in, is the jth component of the second secret shared value, For the j The first i The hash value corresponding to the hash bucket is The second key No. j Quantity; Further, generate a second secret shared value , expressed as: .

[0010] Optionally, before calculating the first secret shared value or calculating the second secret shared value, the method further includes: Traverse each hash table in the index table set , based on the non-empty hash buckets in each hash table, correspondingly generate each component of the simplified set : ; Further, generate a simplified set S， It is expressed as: ; Based on the simplified set S, a first secret shared value or a second secret shared value is calculated.

[0011] Optionally, calculating a first secret sharing value based on the simplified set includes: ; in, is the jth component of the first secret shared value, For the j The first i The hash value corresponding to the hash bucket is The first key No. j Quantity; Further, generate a first secret sharing value , expressed as: ; Based on the simplified set, calculating a second secret sharing value comprises: ; in, is the jth component of the second secret shared value, For the j The first i The hash value corresponding to the hash bucket is The second key The jth component of Further, generate a second secret shared value , expressed as: .

[0012] Optionally, performing anonymity filtering on the first secret shared value, or performing anonymity filtering on the second secret shared value, includes: The first secret sharing value or the second secret sharing value is used as the target sharing value A, which is expressed as: ; The following steps are performed on the target share value A: Calculating vectors B : ; Among them, the components of vector B , expressed as: ; in Share value for a goal AThe first non-zero component in The index value of The following conditions are met: ; Further, calculate the vector C , where each component It is expressed as: ; Further, calculate the vector D， Each of the components The calculation is as follows: ; Further, determine the target sharing value A The first non-zero component in : .

[0013] Optionally, the secure communication protocol for concealing approximate nearest neighbor search further includes: Pre-building an index table set by the first server or the second server specifically includes: Construct multiple position-sensitive hash functions with different sensitivities and sort them from high to low in terms of sensitivity; Obtain all original data in the target database, and calculate corresponding hash values ​​based on the original data and each position-sensitive hash function; According to the order of each position-sensitive hash function, a hash table in the index table set is constructed accordingly, which is expressed as: ; Where L is the total number of locality-sensitive hash functions, and each hash table It includes multiple hash buckets, each of which corresponds to a hash value; According to the hash value corresponding to each original data, fill the ID of the original data into the corresponding hash bucket; Copy the ID in each hash bucket to the hash bucket adjacent to it; Traverse all non-empty hash buckets and randomly retain an ID in the hash bucket; The index table set is stored in the first server and the second server respectively.

[0014] Optionally, the first server and the second server are any two servers in a server cluster.

[0015] The secure communication protocol for concealing approximate nearest neighbor search provided by the present application is adopted to realize private search based on secret sharing. The user's private data is encrypted by the client, and two keys (first key and second key) are generated. The first key and the second key are sent to the first server and the second server respectively. The first server and the second server perform encryption calculations on the keys they receive respectively to obtain the corresponding secret sharing value (ciphertext). The secret sharing value is further hidden and filtered, and the first non-zero component is filtered out from the secret sharing value and returned to the client. The client performs a sum operation on the first result sharing value and the second result sharing value returned by the two servers to obtain the plaintext data of the query result.

[0016] The secure communication protocol for concealing approximate nearest neighbor search provided by the present application can protect the user's privacy data and the data security of the server at the same time. During the search process, the key received by the first server and the second server, the calculated secret sharing value, and the filtered first result sharing value (the first non-zero component) are all ciphertexts, so the server cannot obtain the user's privacy data in plaintext, thereby ensuring the security of the user's privacy data. Correspondingly, the first result sharing value and the second result sharing value received by the client are the ciphertext of the query result. Based on the two result sharing values, only the plaintext data of the query result can be restored, and other data in the database cannot be obtained, thereby ensuring the security of the server database. In addition, in the data communication process between the client and the server, ciphertext transmission is used, so it can avoid malicious interception by a third party and cause data leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments of the present application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0018] Figure 1 is a flow chart of a secure communication protocol for concealing approximate nearest neighbor search proposed in one embodiment of the present application; Figure 2 It is a schematic diagram of a server constructing an index table set in an embodiment of the present application; Figure 3 It is a schematic diagram of a process of executing a nearest neighbor query by a server in an embodiment of the present application; Figure 4 is a schematic diagram of a hidden approximate nearest neighbor search system proposed in an embodiment of the present application. DETAILED DESCRIPTION

[0019] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0020] It should be understood that the references to "one embodiment" or "an embodiment" throughout the specification mean that the specific features, structures, or characteristics associated with the embodiment are included in at least one embodiment of the present application. Therefore, the references to "in one embodiment" or "in an embodiment" appearing throughout the specification do not necessarily refer to the same embodiment. In addition, these specific features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0021] In the various embodiments of the present application, it should be understood that the size of the serial numbers of the following processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0022] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects as detailed in the present application.

[0023] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application may be combined with each other.

[0024] In the current nearest neighbor search scheme, there are problems of user privacy data leakage and database privacy leakage. For example, in the face recognition scenario, given a person's face image, using the current nearest neighbor search scheme, the system will extract the feature vector of the image through deep learning methods, and then query the large database of the remote server to find the nearest neighbor items of the query vector. If the measured similarity index of an item in the database and the given image exceeds a threshold, the recognition is successful. In this process, the query data sent to the server contains private information (face image) that the user is unwilling to expose. In this case, even if the server is trustworthy, the data stored on the server may be stolen by malicious attackers, resulting in the leakage of user private data. In addition, after the server obtains the result of the query, it returns the result directly to the client, which may also be intercepted by a malicious third party in the middle, resulting in the leakage of database information.

[0025] This application implements approximate nearest neighbor search through a secret sharing-based approach, ensuring the security of the user's privacy data and data in the database on the basis of correct retrieval.

[0026] The present application will be described in detail below with reference to the accompanying drawings and in combination with embodiments.

[0027] Figure 1 1 is a flow chart of a secure communication protocol for concealing approximate nearest neighbor search proposed in one embodiment of the present application. Figure 1 As shown, the protocol includes: S1: Generate a first key and a second key based on query data submitted by a user through a client; send the first key and the second key to a first server and a second server respectively; the first server and the second server are non-collusive; S2: Calculate a first secret sharing value based on the first key and the index table set through the first server; perform hidden filtering on the first secret sharing value, select the first non-zero component as the first result sharing value, and return it to the client; the index table set includes: a hash table constructed based on multiple position-sensitive hash functions with different sensitivities; S3: Calculate a second secret sharing value based on the second key and the index table set through the second server; perform hidden filtering on the second secret sharing value, select the first non-zero component as the second result sharing value, and return it to the client; the second result sharing value and the first result sharing value are different secret sharing values ​​for the same query result; S4: Through the client, sum the first result sharing value and the second result sharing value to obtain a query result.

[0028] In this embodiment, encrypted search is implemented by two non-collusive servers. In this embodiment, the first server and the second server follow the non-collusive principle, and the servers will not collude to obtain the plaintext data of the query party (client), including: query data, query index and query results.

[0029] The client encrypts the query data (plaintext) sent by the user based on secret sharing, generates a first key and a second key respectively, and sends the first key and the second key to the first server and the second server respectively. The first server and the second server store the same index table set, which includes multiple hash tables, each of which is constructed based on a position-sensitive hash function with different sensitivities. The first server calculates the candidate items corresponding to each hash table in the index table set based on the index table set and the received first key, that is, the first secret sharing value. Correspondingly, the second server calculates the candidate items corresponding to each hash table based on the index table set and the received second key, that is, the second secret sharing value. Further, the two servers perform hidden filtering on the first secret sharing value and the second secret sharing value respectively, and filter out the first non-zero component (that is, the ciphertext fragment corresponding to the query result) from the secret sharing value, and return it to the client as the result sharing value. It is worth noting that the first result sharing value obtained by the first server and the second result sharing value obtained by the second server are ciphertext fragments corresponding to the same query result (plaintext). The client recovers the plaintext data of the query result based on the two received result sharing values.

[0030] In this embodiment, the first key and the second key are processed by two servers respectively, and the secret sharing value is obtained by performing ciphertext search in the index table set respectively, and the first non-zero component is screened and returned to the client as the result sharing value. In this process, since the keys received by the first server and the second server, the calculated secret sharing value, and the filtered first result sharing value (the first non-zero component) are all ciphertext, the server cannot obtain the user's private data in plaintext, thereby ensuring the security of the user's private data. Correspondingly, the first result sharing value and the second result sharing value received by the client are the ciphertext of the query result. Based on the two result sharing values, the client can only obtain the plaintext data of the query result and cannot obtain other data in the database, thereby ensuring the security of the server database. In addition, in the data communication process between the client and the server, ciphertext transmission is adopted, so that data leakage caused by malicious interception by a third party can be avoided, and data security can be ensured while correctly obtaining the query result.

[0031] As an implementation manner of the present application, the first server and the second server are any two servers in a server cluster.

[0032] In one embodiment, the first server and the second server may be any two servers in a server cluster. For example, each server node in the server cluster is deployed as a distributed node to provide search services, and the same set of index tables is stored on each server in the cluster. Before sending the first key and the second key, the client first selects two server nodes with lower current load as the first node and the second node, and then sends the first key and the second key to the first server and the second server respectively. By storing the same set of index tables on each server in the server cluster, the data processing requirements in large-scale search scenarios can be met, thereby improving search efficiency.

[0033] As an implementation mode of the present application, the secure communication protocol for concealing approximate nearest neighbor search is characterized by further comprising: Pre-building an index table set by the first server or the second server specifically includes: Construct multiple position-sensitive hash functions with different sensitivities and sort them from high to low in terms of sensitivity; Obtain all original data in the target database, and calculate corresponding hash values ​​based on the original data and each position-sensitive hash function; According to the order of each position-sensitive hash function, a hash table in the index table set is constructed accordingly, which is expressed as: ; Where L is the total number of locality-sensitive hash functions, and each hash table It includes multiple hash buckets, each of which corresponds to a hash value; According to the hash value corresponding to each original data, fill the ID of the original data into the corresponding hash bucket; Copy the ID in each hash bucket to the hash bucket adjacent to it; Traverse all non-empty hash buckets and randomly retain an ID in the hash bucket; The index table set is stored in the first server and the second server respectively.

[0034] In this application, in order to ensure the data security of the database, a set of index tables that can be used for encrypted search is pre-built by the server based on the plaintext data in the target database. The index table set can be pre-built by any server and then synchronized to all servers for storage. In this application, the plaintext data stored in the target database can be feature vectors extracted from data in different forms such as images, text, audio, etc., and each plaintext data corresponds to a unique ID.

[0035] Figure 2 FIG. 1 is a schematic diagram of a server constructing an index table set in an embodiment of the present application. Figure 2 As shown, the process of the server building an index table set is as follows: (1) Construct multiple position-sensitive hash functions with different sensitivities , and sort the hash functions from high to low according to their sensitivity. That is, the hash function The sensitivity is greater than It is worth noting that, in this embodiment, the sorted locality-sensitive hash function is open to both the server and the client.

[0036] (2) Build a set of index tables and sort the hash tables in the set according to the sorting of the position-sensitive hash function. That is, the accuracy of each hash table in the index table set is arranged from high to low. Each hash table includes multiple hash buckets, each hash bucket corresponds to a hash value, and the hash bucket is used to store the ID of the original data corresponding to the hash value.

[0037] The output range of the locality-sensitive hash function , determined as the index range corresponding to each hash table (that is, the range of hash values ​​corresponding to the hash bucket). For example, the hash function The output range of is [0,550], then the hash table The index range is [0,550]; (3) Obtain the original data in the target database based on each position-sensitive hash function , respectively calculate the hash value corresponding to each original data. Specifically, the original data in the target database The hash index in the jth hash table is . According to the hash value corresponding to each original data, fill the original data ID into the corresponding hash bucket. For example, the hash table The index range is [0,550], and the ID of the original data "ABC" is "123". The calculated hash value is 500, then its corresponding ID "123" is recorded in the hash table The index (hash value corresponding to the hash bucket) is "500".

[0038] It is worth noting that the higher the sensitivity of the locality-sensitive hash function, the more accurate the calculation result, and the higher the accuracy of the corresponding hash table query result, but the probability of data collision during the query process will also be lower (that is, it is easier for users to retrieve empty hash buckets when querying); (4) Back up the IDs recorded in adjacent hash buckets. That is, fill the IDs recorded in each hash bucket into the adjacent hash buckets so that the IDs recorded in the adjacent hash buckets are the same. Specifically, according to the preset distance threshold of the adjacent hash buckets, the index of the adjacent hash bucket of each hash bucket is determined, and then the ID is backed up. By backing up the IDs of adjacent buckets, the sparseness rate of the hash table is reduced, the collision probability in the query process is increased, and users can more easily obtain query results in the approximate nearest neighbor search process.

[0039] For example, according to the distance threshold of 1, it is determined that the adjacent hash buckets of "hash bucket 499" are "hash bucket 498" and "hash bucket 500", then the ID recorded in "hash bucket 499" is copied to the adjacent hash buckets. Correspondingly, the IDs recorded in "hash bucket 498" and "hash bucket 500" are also copied to "hash bucket 499".

[0040] (5) Remove redundant data from the index table set. Specifically, traverse the non-empty hash buckets in each hash table and randomly retain an ID of its record as the unique query result corresponding to the index. That is, the query result obtained by the user query is the ID corresponding to the plaintext data of the nearest neighbor corresponding to the query data entered by the user. In other words, each hash table stores the corresponding relationship of "index (hash value)-ID".

[0041] (6) Synchronize the index table set to all servers so that the first server and the second server perform calculations based on the same index table set when querying, thereby ensuring that the first result sharing value and the second result sharing value returned by the first server and the second server are different secret shards of the same query result.

[0042] Since the traditional search method uses a search method that traverses the target database and calculates data similarity, for large databases, huge computing resources are consumed in the case of encryption. However, by constructing a hash index table, the server's computing data volume is compressed to the index range of the hash index table, which greatly reduces the server's computing volume, saves computing resources, and improves search efficiency.

[0043] As an implementation mode of the present application, generating a first key and a second key based on query data submitted by a user includes: Extract features from the query data submitted by the user and generate a query vector; Calculating a query index vector based on the query vector and the multiple position-sensitive hash functions of different sensitivities; wherein the order of each component in the query index vector corresponds one-to-one to the order of each position-sensitive hash function; Based on the query index vector, a first key and a second key are generated.

[0044] In one embodiment, the query data (plain text) submitted by the user obtained by the client may be a picture, text or audio data. Feature extraction is performed on the query data to generate a query vector. Based on the query vector and multiple pre-built and sorted position-sensitive hash functions, a query index vector is calculated, the number of components of the vector is the same as the number of hash functions, and the sorting position of each component corresponds to the sorting position of each hash function. Further, based on the query index vector, a first key and a second key are generated by secret sharing.

[0045] As an implementation manner of the present application, the query index vector is calculated based on the query vector and the multiple position-sensitive hash functions of different sensitivities, including: Calculate the corresponding hash value based on each locality-sensitive hash function in order as a component of the query index vector: ; in, q is the query vector, For the j A locality-sensitive hash function, L is the total number of locality-sensitive hash functions, The first j Quantity; Hash values ​​corresponding to all locality-sensitive hash functions , generate the query index vector It is expressed as: .

[0046] In one embodiment, the specific steps of calculating the query index vector by the client are as follows: (1) Calculate the components of the query index vector. Specifically, based on the locality-sensitive hash function , calculate the hash value corresponding to the query vector q, that is, get the query vector q in the hash table Index in .

[0047] (2) Arrange the components according to the order of the hash function to generate a query index vector: .

[0048] As an implementation manner of the present application, generating a first key and a second key based on the query index vector includes: According to the query index vector, a distributed point function construction method is used to generate a first key and the second key : ; ; in, is the key generation function in the distributed point function construction method, The first key No. j Quantity, The second key No. j Quantity, The first j Quantity, It is the evaluation function in the distributed point function construction method.

[0049] In one embodiment, the client uses a distributed point function (DPF) scheme to generate keys sent to two servers. The first key and the second key . The solution has two basic functions and , for a component of the query index vector , whose corresponding key component , pass Functions and Function determination: ; Generated key components and The following relationship is satisfied: .

[0050] After getting all the key components Afterwards, the client sends the first key to the first server and the second server respectively , Second Key .

[0051] As an implementation manner of the present application, calculating a first secret sharing value based on the first key and the index table set by the first server includes: ; in, is the jth component of the first secret shared value, is the index range of the hash table, For the j The first i The hash value corresponding to the hash bucket is The first key No. j Quantity; Further, generate a first secret sharing value , expressed as: ; Calculating, by the second server, a second secret sharing value based on the second key and the index table set, including: ; in, is the jth component of the second secret shared value, For the j The first i The hash value corresponding to the hash bucket is The second key No. j Quantity; Further, generate a second secret shared value , expressed as: .

[0052] In this embodiment, the calculation steps executed by the first server and the second server are the same. The following description is based on the calculation process of the first server, and the second server is not repeated.

[0053] For the first server, firstly, based on the received first key, a query is performed in the index table set to obtain the ciphertext of the query results in all hash tables, that is, to obtain the first secret sharing value. Each component in the first secret sharing value represents the ciphertext of the candidate item obtained from each hash table. Specifically, each component of the first secret sharing value is calculated by the following expression: .

[0054] It should be noted that during the server retrieval process, if a hash table If no corresponding index value is found in And calculate the weight of the first secret shared value .

[0055] The first server calculates and obtains the first secret sharing value, which is expressed as: .

[0056] As an implementation manner of the present application, performing anonymity filtering on the first secret shared value, or performing anonymity filtering on the second secret shared value, includes: The first secret sharing value or the second secret sharing value is used as the target sharing value A, which is expressed as: ; The following steps are performed on the target share value A: Calculating vectors B : ; Among them, the components of vector B , expressed as: ; in Share value for a goal A The first non-zero component in The index value of The following conditions are met: ; Further, calculate the vector C , where each component It is expressed as: ; Further, calculate the vector D， Each of the components The calculation is as follows: ; Further, determine the target sharing value A The first non-zero component in : .

[0057] Based on the relationship between the first key and the second key in the above client key generation process, it can be known that by summing the first secret sharing value and the second secret sharing value, all the candidates of the hash table in the index table set can be restored. Candidates For example, the way to restore the candidate items through summation operation is as follows: .

[0058] In order to protect the data security in the database, this application does not return the search results of all hash tables to the user, but only returns the nearest neighbor results to the user, that is, returns the candidate with the highest precision searched in the index table set. Since the hash table is pre-sorted from high to low according to sensitivity, the precision of the first non-zero component is the highest among all non-empty candidate items. Therefore, only the first non-zero component needs to be returned to the user. In this embodiment, by pre-sorting from high to low according to precision when constructing a position-sensitive hash function and an index table set, the process of sorting by precision after obtaining the candidate items corresponding to each hash table is omitted, further saving the computing resources of the server.

[0059] In order to prevent the client from obtaining other data except the query result and reduce the amount of communication data between the server and the client, before returning the result to the client, the server selects the first non-zero component from the first secret sharing value in advance and then sends the non-zero component to the client.

[0060] In one embodiment, after calculating the first secret sharing value and the second secret sharing value, the server further performs anonymity filtering on them to screen out the first non-zero component, that is, the secret sharing value of the query result finally obtained by the user. In this embodiment, the anonymity filtering is implemented based on the ZeroTest algorithm, which can detect the first secret sharing value and the second secret sharing value in ciphertext form, determine whether each component is a non-zero component, and thus extract the first non-zero component in the secret sharing value in ciphertext form.

[0061] Specifically, the first server and the second server perform the same steps of hidden filtering. In this embodiment, the hidden filtering process of the first secret sharing value is used as an example for explanation. The hidden filtering process of the second secret sharing value is not repeated. The process of the first server performing hidden filtering is as follows: (1) The first secret shared value is used as the target shared value A, expressed as a vector . You need to filter out the first non-zero element ( For elements To represent the case where there are no query results (i.e., all elements in A are zero), let and . Specifically, Index subscript The definition is as follows: .

[0062] (2) Further, define vector B as follows: ; Among them, the components of vector B ;Right now It is expressed as: ; in Share value for a goal A The first non-zero component in The index value of The following conditions are met: ; (3) Further, based on the ZeroTest algorithm, the secret sharing vector B is tested to determine whether the plaintext data corresponding to each of its components is a non-zero element: Execution Algorithm , we get vector C, which is defined as follows: ; Each of the components It is expressed as: ; (4) Further, define the vector D as follows: ; Each of the components The calculation is as follows: .

[0063] (5) According to the following expression, filter out the first non-zero component in vector A (i.e. the first result sharing value): .

[0064] The client obtains the first result sharing value and the second result sharing value returned by the two servers, and performs a sum operation to restore the secret sharing value to the plaintext data of the query result. In this embodiment, the plaintext data of the query result is the ID corresponding to the original data stored in the hash bucket. If it is 0, it means that no neighbor items are found in the database.

[0065] In this embodiment, the server performs a hidden filtering operation to screen out the secret sharing value (the first non-zero component) of the query result with the highest accuracy based on the secret sharing value (ciphertext) among the query candidates, so that the client can only obtain the query result that the user finally obtains, and will not obtain other information of the database, which greatly improves the security of the original data in the database and avoids information leakage of the database. At the same time, it also reduces the communication volume between the client and the server, saving communication overhead.

[0066] Figure 3 FIG. 1 is a flow chart of a server executing a nearest neighbor query in an embodiment of the present application. Figure 3As shown, the first server and the second server respectively obtain the first key (ciphertext) and the second key (ciphertext) sent by the client, perform nearest neighbor search based on the index table set (calculate the first and second secret sharing values), and then perform hidden filtering on the secret sharing value based on the ZeroTest algorithm to filter out the first non-zero component (i.e., the secret sharing value of the query result with the highest accuracy). The non-zero component is returned to the client as the first and second result sharing values. Since the two servers perform calculations based on the same index table set, it can be ensured that the calculated first and second result sharing values ​​are the ciphertext fragments of the same query result. On this basis, the client can restore the plaintext data of the query result based on the first and second result sharing values.

[0067] It is worth noting that in this embodiment, the server also pre-initializes the client to generate a key and the server to perform hidden filtering related parameters. Some parameters are jointly generated by the first and second servers.

[0068] Specifically, the secure computation process based on the distributed point function (DPF) is performed in a finite field. Model p is a prime number, among which is a statistical safety parameter (e.g. =40), is the bit length of the plaintext (e.g. =32). These parameters are used in the encrypted search process based on the distributed point function.

[0069] In addition to the above parameters, the server also executes the SPDZ setup protocol to obtain the relevant parameters and keys required to implement the multiplication of the secret shared value. Secure Multiparty Computation (MPC) aims to solve the problem of secure computing between multiple participants, with the goal of enabling each participant to complete the calculation without knowing the input information of other participants, and ensuring that the calculation process does not leak the input information. SPDZ is a protocol framework for MPC computing.

[0070] The first and second servers execute the random number generation protocol of SPDZ to generate the random numbers required for the multiplication of the secret sharing value during the hidden filtering process. In this scheme, the first and second servers only hold a secret sharing value of any random value, and only when both servers are maliciously controlled can the random value be cracked in the plaintext domain.

[0071] As an implementation manner of the present application, before calculating the first secret sharing value or calculating the second secret sharing value, the method further includes: Traverse each hash table in the index table set , based on the non-empty hash buckets in each hash table, correspondingly generate each component of the simplified set : ; Further, generate a simplified set S， It is expressed as: ; Based on the simplified set S, a first secret shared value or a second secret shared value is calculated.

[0072] As an implementation manner of the present application, calculating the first secret sharing value based on the simplified set includes: ; in, is the jth component of the first secret shared value, For the j The first i The hash value corresponding to the hash bucket is The first key No. j Quantity; Further, generate a first secret sharing value , expressed as: ; Based on the simplified set, calculating a second secret sharing value comprises: ; in, is the jth component of the second secret shared value, For the j The first i The hash value corresponding to the hash bucket is The second key The jth component of Further, generate a second secret shared value , expressed as: .

[0073] In the above embodiment, to calculate the first secret sharing value and the second secret sharing value, it is necessary to traverse all hash buckets in each hash table. However, there may be empty hash buckets in the hash table. When calculating, computing resources can be saved by skipping the empty hash buckets. Since the hash table is sparse, in one embodiment, before calculating the secret sharing value, the server generates a simplified set S based on the non-empty hash buckets in all hash tables in the index table set, and then calculates the secret sharing value based on the simplified set.

[0074] Specifically, traverse the non-empty hash buckets of each hash table and generate the corresponding simplified set components ,gather The amount of data contained is usually less than the original amount of data in the hash table .

[0075] Further, the two servers calculate the first and second secret sharing values ​​based on the simplified set S respectively: Based on L components, we get ; Based on L components, we get .

[0076] In this embodiment, by extracting non-empty hash buckets from each hash table and performing queries based on the non-empty buckets, server computing resources are further saved and search efficiency is improved.

[0077] Based on the same inventive concept, an embodiment of the present application provides a hidden approximate nearest neighbor search system. Figure 4 , Figure 4 Schematic diagram of a hidden approximate nearest neighbor search system proposed in one embodiment of the present application. Figure 4 As shown, the system includes: a target database, a server cluster and a client; The target database is used to store plaintext data; wherein each plaintext data has a unique ID; The server cluster includes: at least one first server and at least one second server; The client is used to generate a first key and a second key based on query data submitted by a user; send the first key and the second key to a first server and a second server respectively; the first server and the second server are non-collusive; The first server is used to calculate a first secret sharing value based on the first key and the index table set; perform hidden filtering on the first secret sharing value, select the first non-zero component as the first result sharing value, and return it to the client; the index table set includes: a hash table constructed based on multiple position-sensitive hash functions with different sensitivities; The second server is configured to calculate a second secret sharing value based on the second key and the index table set; perform anonymity filtering on the second secret sharing value, select the first non-zero component as the second result sharing value, and return it to the client; the second result sharing value and the first result sharing value are different secret sharing values ​​for the same query result; The client is further used to sum the first result sharing value and the second result sharing value to obtain a query result; the query result is an ID corresponding to the plaintext data in the target database.

[0078] Regarding the system in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the operation method of the protocol, and will not be elaborated here.

[0079] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application.

[0080] For the method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the order of the actions described, because according to the present application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and components involved are not necessarily required by the present application.

[0081] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0082] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0083] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1A function specified in one or more boxes.

[0084] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0085] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they are aware of the basic creative concepts. Therefore, the present application is interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present application.

[0086] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0087] The above is a detailed introduction to the secure communication protocol for concealing approximate nearest neighbor search provided by the present application. This article uses specific examples to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, based on the ideas of the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A secure communication protocol for concealing approximate nearest neighbor search, characterized in that: include: Generate a first key and a second key based on the query data submitted by the user through the client; Sending the first key and the second key to a first server and a second server respectively; The first server and the second server are non-collusive; Calculating, by the first server, a first secret sharing value based on the first key and the index table set; Performing hidden filtering on the first secret sharing value, selecting a first non-zero component as a first result sharing value, and returning the first non-zero component to the client; The index table set includes: a hash table constructed based on multiple position-sensitive hash functions of different sensitivities; Calculate a second secret sharing value based on the second key and the index table set through the second server; perform anonymity filtering on the second secret sharing value, select the first non-zero component as the second result sharing value, and return it to the client; the second result sharing value and the first result sharing value are different secret sharing values ​​for the same query result; The first result sharing value and the second result sharing value are summed up through the client to obtain a query result.

2. The secure communication protocol for concealed approximate nearest neighbor search according to claim 1, characterized in that: Generating a first key and a second key based on the query data submitted by the user, including: Extract features from the query data submitted by the user and generate a query vector; Calculating a query index vector based on the query vector and the multiple position-sensitive hash functions of different sensitivities; wherein the order of each component in the query index vector corresponds one-to-one to the order of each position-sensitive hash function; Based on the query index vector, a first key and a second key are generated.

3. The secure communication protocol for concealed approximate nearest neighbor search according to claim 2, characterized in that: Calculating a query index vector based on the query vector and the multiple position-sensitive hash functions of different sensitivities includes: Calculate the corresponding hash value based on each locality-sensitive hash function in order as a component of the query index vector: ； in, q is the query vector, For the j A locality-sensitive hash function, L is the total number of locality-sensitive hash functions, The first j Quantity; Hash values ​​corresponding to all locality-sensitive hash functions , generate the query index vector It is expressed as: 。 4. The secure communication protocol for concealed approximate nearest neighbor search according to claim 3, characterized in that: Generating a first key and a second key based on the query index vector includes: According to the query index vector, a distributed point function construction method is used to generate a first key and the second key : ； ； in, is the key generation function in the distributed point function construction method, The first key No. j Quantity, The second key No. j Quantity, The first j Quantity, It is the evaluation function in the distributed point function construction method.

5. The secure communication protocol for concealed approximate nearest neighbor search according to claim 1, characterized in that: Calculating, by the first server, a first secret sharing value based on the first key and the index table set, including: ； in, is the jth component of the first secret shared value, is the index range of the hash table, For the j The first i The hash value corresponding to the hash bucket is The first key No. j Quantity; Further, generate a first secret sharing value , expressed as: ； Calculating, by the second server, a second secret sharing value based on the second key and the index table set, including: ； in, is the jth component of the second secret shared value, For the j The first i The hash value corresponding to the hash bucket is The second key No. j Quantity; Further, generate a second secret shared value , expressed as: 。 6. The secure communication protocol for concealed approximate nearest neighbor search according to claim 2, characterized in that: Before calculating the first secret shared value or calculating the second secret shared value, the method further includes: Traverse each hash table in the index table set , based on the non-empty hash buckets in each hash table, correspondingly generate each component of the simplified set : ； Further, generate a simplified set S， It is expressed as: ; Based on the simplified set S, a first secret shared value or a second secret shared value is calculated.

7. The secure communication protocol for concealed approximate nearest neighbor search according to claim 6, characterized in that: Based on the simplified set, calculating a first secret sharing value comprises: ； in, is the jth component of the first secret shared value, For the j The first i The hash value corresponding to the hash bucket is The first key No. j Quantity; Further, generate a first secret sharing value , expressed as: ； Based on the simplified set, calculating a second secret sharing value comprises: ； in, is the jth component of the second secret shared value, For the j The first i The hash value corresponding to the hash bucket is The second key The jth component of Further, generate a second secret shared value , expressed as: 。 8. The secure communication protocol for concealed approximate nearest neighbor search according to claim 1, characterized in that: The step of performing anonymity filtering on the first secret shared value or performing anonymity filtering on the second secret shared value includes: The first secret sharing value or the second secret sharing value is used as the target sharing value A, which is expressed as: ； The following steps are performed on the target share value A: Calculating vectors B : ； Among them, the components of vector B , expressed as: ; in Share value for a goal A The first non-zero component in The index value of The following conditions are met: ； Further, calculate the vector C , where each component It is expressed as: ； Further, calculate the vector D， Each of the components The calculation is as follows: ； Further, determine the target sharing value A The first non-zero component in : 。 9. The secure communication protocol for concealed approximate nearest neighbor search according to claim 1, characterized in that: Also includes: Pre-building an index table set by the first server or the second server specifically includes: Construct multiple position-sensitive hash functions with different sensitivities and sort them from high to low in terms of sensitivity; Obtain all original data in the target database, and calculate corresponding hash values ​​based on the original data and each position-sensitive hash function; According to the order of each position-sensitive hash function, a hash table in the index table set is constructed accordingly, which is expressed as: ; Where L is the total number of locality-sensitive hash functions, and each hash table It includes multiple hash buckets, each of which corresponds to a hash value; According to the hash value corresponding to each original data, fill the ID of the original data into the corresponding hash bucket; Copy the ID in each hash bucket to the hash bucket adjacent to it; Traverse all non-empty hash buckets and randomly retain an ID in the hash bucket; The index table set is stored in the first server and the second server respectively.

10. The secure communication protocol for concealed approximate nearest neighbor search according to claim 1, characterized in that: The first server and the second server are any two servers in a server cluster.

Images