Privacy-protecting data providing and querying method and device

Abstract

The embodiment of the invention provides a privacy-protecting data providing and querying method and device.In the data providing method, in the preparation stage, a server receives first encrypted data from a client side, and the first encrypted data is obtained by conducting homomorphic encryption on an n * n-dimensional permutation matrix corresponding to a preset permutation rule. According to a first plaintext sequence formed by n pieces of plaintext data held by the server and the first encrypted data, a ciphertext sequence formed by n pieces of first ciphertext is obtained, the ciphertext sequence corresponds to a second plaintext sequence, and the second plaintext sequence is equal to a plaintext sequence obtained by replacing the first plaintext sequence based on a preset replacement rule. In the query stage, the target position of the target data to be queried is received from the client side, and the target position is the position obtained after the original position of the target data is subjected to replacement operation based on the preset replacement rule. And reading the target ciphertext of the target position from the ciphertext sequence, and sending the target ciphertext to the client.

Description

Technical Field

[0001] The embodiments of the present specification belong to the field of secure computing technology, and more particularly, to a method and device for providing and querying data with privacy protection. Background Art

[0002] Privacy computing is an emerging technology that can make data available but invisible, and maximize the value of data while protecting data privacy. Private information retrieval (PIR) means that the query party hides the query target identifier, and the data party provides matching query results but cannot know the specific query object. PIR can be specifically described as: the data party has a database with n data. The query party wants to query the i-th data in this database, but the data party does not know which data the query party is specifically looking for. Privacy information retrieval has important uses in the fields of medicine, finance, etc. For example, in the medical field, some patients search for symptoms of related diseases, uses of drugs, etc. on medical websites, but do not want to expose the diseases or drugs they have queried to others. At this time, this problem can be solved through private information retrieval.

[0003] Since privacy information retrieval needs to protect data privacy, it needs to process data through various encryption methods. In this way, the amount of data calculation increases, which affects the efficiency of data query. Summary of the invention

[0004] The purpose of the present invention is to provide a privacy-protected data provision and query method and device, which can greatly improve the efficiency of data query.

[0005] In a first aspect, the present specification provides a privacy-protected data providing method, including a preparation phase and a query phase; the method is executed by a server, including:

[0006] In the preparation stage, first encrypted data is received from a client, the first encrypted data being obtained by homomorphically encrypting an n*n dimensional permutation matrix corresponding to a predetermined permutation rule; a ciphertext sequence consisting of n first ciphertexts is obtained according to a first plaintext sequence consisting of n plaintext data held by the server and the first encrypted data, the ciphertext sequence corresponding to a second plaintext sequence, the second plaintext sequence being equivalent to a plaintext sequence obtained by permuting the first plaintext sequence based on the predetermined permutation rule;

[0007] In the query phase, a target position of the target data to be queried is received from the client, where the target position is the position after a substitution operation is performed on the original position of the target data based on the predetermined substitution rule; a target ciphertext of the target position is read from the ciphertext sequence; and the target ciphertext is sent to the client.

[0008] A second aspect of the present specification provides a privacy-protected data query method, including a preparation phase and a query phase; the method is executed by a client, including:

[0009] In the preparation stage, an n*n dimensional permutation matrix corresponding to a predetermined permutation rule is constructed, and the permutation matrix is ​​homomorphically encrypted to obtain first encrypted data; and the first encrypted data is sent to a server;

[0010] In the query phase, based on the predetermined substitution rule, a substitution operation is performed on the original position of the target data to be queried to obtain the target position; the target position is sent to the server; the server reads the target ciphertext from the ciphertext sequence it holds according to the target position; and the target ciphertext is homomorphically decrypted to obtain the target data.

[0011] A third aspect of the present specification provides a privacy-protected data providing device, which is disposed on a server, and includes:

[0012] A receiving unit, configured to receive first encrypted data from a client in a preparation phase, the first encrypted data being obtained by homomorphically encrypting an n*n dimensional permutation matrix corresponding to a predetermined permutation rule;

[0013] an acquisition unit, configured to obtain a ciphertext sequence consisting of n first ciphertexts according to a first plaintext sequence consisting of n plaintext data held by the server and the received first encrypted data, wherein the ciphertext sequence corresponds to a second plaintext sequence, and the second plaintext sequence is equivalent to a plaintext sequence obtained by replacing the first plaintext sequence based on a predetermined replacement rule;

[0014] The receiving unit is further used to receive the target position of the target data to be queried from the client in the query phase, where the target position is the position after performing a replacement operation on the original position of the target data based on a predetermined replacement rule;

[0015] A reading unit, used for reading a target ciphertext at a target position from a ciphertext sequence;

[0016] The sending unit is used to send the target ciphertext to the client.

[0017] A fourth aspect of the present specification provides a privacy-protected data query device, which is disposed on a client, and includes:

[0018] The construction unit is used to construct an n*n dimensional permutation matrix corresponding to a predetermined permutation rule in a preparation stage.

[0019] The encryption unit is used to perform homomorphic encryption on the permutation matrix to obtain first encrypted data.

[0020] The sending unit is used to send the first encrypted data to the server.

[0021] The replacement unit is used to perform a replacement operation on the original position of the target data to be queried based on a predetermined replacement rule during the query phase to obtain the target position.

[0022] The sending unit is also used to send the target location to the server.

[0023] The receiving unit is used for receiving the target ciphertext read by the server from the ciphertext sequence held by the server according to the target position.

[0024] The decryption unit is used to homomorphically decrypt the received target ciphertext to obtain target data.

[0025] A fifth aspect of the present specification provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method described in the first or second aspect.

[0026] A sixth aspect of the present specification provides a computing device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method of the first or second aspect is implemented.

[0027] A seventh aspect of the present specification provides a computer program product, comprising a computer program / instruction, which implements the steps of the first or second aspect method when executed by a processor.

[0028] The privacy-protected data provision method provided by one or more embodiments of the present specification includes a preparation phase and a query phase, wherein in the preparation phase, the server obtains a ciphertext sequence consisting of n ciphertexts by running an oblivious permutation protocol with the client. Then, in the query phase, the client provides the server with the permuted target position of the target data to be queried, and then the server reads the target ciphertext of the target position from the ciphertext sequence and returns it to the client. That is to say, in this solution, in the query phase, the server does not need to perform any secret state operations, but only needs to perform simple data reading operations, thereby greatly improving the efficiency of data query. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions of the embodiments of this specification, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0030] Figure 1It is a schematic diagram of an implementation scenario of an embodiment disclosed in this specification;

[0031] Figure 2 is an interactive diagram of a privacy-protected data providing method in an embodiment of this specification;

[0032] Figure 3 is a schematic diagram of a data providing device for protecting privacy in an embodiment of the present specification;

[0033] Figure 4 It is a schematic diagram of a data query device for protecting privacy in one embodiment of this specification. DETAILED DESCRIPTION

[0034] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0035] As mentioned above, in order to achieve data privacy protection, the data needs to be processed through various encryption methods. At present, the mainstream encryption method is homomorphic encryption, such as the SEALPIR scheme (a privacy information retrieval scheme based on additive homomorphism). In this scheme, the server needs to complete the encoding of the database in advance to obtain the plaintext vector. Then in the data query stage, the client provides a high-dimensional encrypted query vector, and then the server side performs the inner product operation of the plaintext vector and the ciphertext vector. However, due to the high dimension of the query vector provided by the client, this will result in a large amount of communication during the query and increase the computing time.

[0036] To this end, in an embodiment of the present specification, an improved scheme is proposed, which includes two stages: a preparation stage and a query stage. In the preparation stage, the server obtains a ciphertext sequence consisting of n ciphertexts by running an inadvertent permutation protocol with the client. Specifically, the server receives first encrypted data from the client, and the first encrypted data is obtained by homomorphically encrypting an n*n dimensional permutation matrix corresponding to a predetermined permutation rule. The server obtains a ciphertext sequence consisting of n first ciphertexts based on the first plaintext sequence consisting of n plaintext data held by it and the first encrypted data, and the ciphertext sequence corresponds to the second plaintext sequence, and the second plaintext sequence is equivalent to the plaintext sequence obtained by permuting the first plaintext sequence based on the predetermined permutation rule. Then, in the query stage, the client provides the server with the permuted target position of the target data to be queried, and then the server reads the target ciphertext of the target position from the ciphertext sequence and returns it to the client. That is to say, in this scheme, in the query stage, the server does not need to perform any secret state operation, but only performs a simple data reading operation, thereby greatly improving the query efficiency of the data. In addition, in the query stage, the client only needs to provide a target position, thereby saving communication resources.

[0037] Figure 1 It is a schematic diagram of an implementation scenario of an embodiment disclosed in this specification. Figure 1 In the data provision or query process, the entire data provision or query process can be divided into two stages: preparation stage and query stage.

[0038] In the preparation phase, the client and the server run an oblivious permutation protocol so that the n plaintext data held by the server are encrypted and permuted, thereby obtaining a ciphertext sequence consisting of n ciphertexts. It should be noted that the specific permutation rule is provided by the client, and the server is unaware of the permutation rule. In the query phase, the client performs a permutation operation on the original position of the target data C to be queried based on the predetermined permutation rule, obtains the target position i, and sends the target position i to the server. The server reads the target ciphertext Enc(C) of the target position i from the ciphertext sequence determined in the preparation phase, and provides it to the client. The client performs homomorphic decryption on the received ciphertext data Enc(C) to obtain the target data C.

[0039] Figure 2 This is an interactive diagram of a privacy-protected data providing method in one embodiment of this specification. Figure 2 The method may include two phases: a preparation phase and a query phase, wherein the preparation phase may include the following steps:

[0040] Step S202: The client constructs an n*n dimensional permutation matrix corresponding to a predetermined permutation rule, and performs homomorphic encryption on the permutation matrix to obtain first encrypted data.

[0041] The predetermined permutation rule π is used to rearrange multiple elements in the element sequence, and each element is permuted from one position to another position, and each position has a unique element corresponding to it.

[0042] In one embodiment, the above predetermined replacement rule may be as follows:

[0043] [1,2,3,4,5]->[4,5,2,1,3].

[0044] The predetermined replacement rule indicates that the first position in the sequence is mapped to the fourth position, the second position is mapped to the fifth position, the third position is mapped to the second position, the fourth position is mapped to the first position, and the fifth position is mapped to the third position. Mapping the first position to the fourth position means replacing the element at the first position to the fourth position.

[0045] A permutation matrix can be used to represent the operation of rearranging or transforming rows or columns in a matrix. It can be a square binary matrix with only one 1 in each row or column and the others are 0. Specifically, a permutation matrix can be a matrix obtained by swapping some rows or columns of the identity matrix. It should be understood that the identity matrix itself is a most basic permutation matrix, which does not do any processing on the matrix.

[0046] Generally speaking, for any predetermined permutation rule, a permutation matrix corresponding thereto can be constructed. That is, the mapping between positions in the sequence is regarded as a row or column transformation. Among them, when the mapping between positions in the sequence is regarded as a row transformation, the permutation matrix corresponding to the predetermined permutation rule in the above example (hereinafter also referred to as the permutation matrix focusing on row permutation) can be as follows:

[0047]

[0048] It should be understood that the permutation matrix is ​​specifically obtained through the following steps: the mapping from the 1st position to the 4th position is regarded as the transformation from the 1st row to the 4th row in the unit matrix, the mapping from the 2nd position to the 5th position is regarded as the transformation from the 2nd row to the 5th row in the unit matrix, the mapping from the 3rd position to the 2nd position is regarded as the transformation from the 3rd row to the 2nd row, the mapping from the 4th position to the 1st position is regarded as the transformation from the 4th row to the 1st row, and the mapping from the 5th position to the 3rd position is regarded as the transformation from the 3rd row to the 3rd row.

[0049] Furthermore, when the mapping between positions in the sequence is regarded as a column transformation, the permutation matrix corresponding to the predetermined permutation rule in the above example can be as follows:

[0050]

[0051] It should be noted that in this solution, an additive homomorphic encryption algorithm or a fully homomorphic encryption algorithm can be used to encrypt the permutation matrix. The additive homomorphic encryption algorithm can be, for example, the Paillier algorithm, and the fully homomorphic encryption algorithm can be, for example, the BFV (Brakerski / Fan-Vercauteren) algorithm or the CKKS algorithm.

[0052] More specifically, the client can generate the corresponding public key and private key for the additive homomorphic encryption algorithm or the fully homomorphic encryption algorithm in advance, and then use the public key to encrypt the permutation matrix. To simplify the description, the following is directly described as performing additive homomorphic encryption or fully homomorphic encryption on the permutation matrix.

[0053] Among them, when the additive homomorphic encryption algorithm is adopted, each matrix element in the permutation matrix can be homomorphically encrypted separately, so that an n*n dimensional dense matrix can be obtained.

[0054] Taking the above permutation matrix of row permutation as an example, the corresponding dense matrix can be as follows:

[0055]

[0056] Take the Paillier algorithm as an example, where the matrix element in the i-th row and j-th column of the above encrypted matrix: Enc ij (a) = g a ·r n mod n 2 , where g and n constitute the public key of the Paillier algorithm, r is a random integer with a value range of 1≤r≤n-1, and a is a matrix element, which is 0 or 1. It should be noted that since the random number r is introduced when encrypting the matrix elements using the Paillier algorithm, the secret state elements in the above secret state matrix are inconsistent. For example, Enc 11 (0) and Enc 12 (0) is inconsistent.

[0057] It should be noted that when the additive homomorphic encryption algorithm is adopted, the n*n dimensional secret state matrix is ​​the above-mentioned first encrypted data.

[0058] When a fully homomorphic encryption algorithm is used, the permutation matrix can be homomorphically encrypted according to rows or columns to obtain n ciphertexts corresponding to each row or column.

[0059] Taking the above permutation matrix of the focus row permutation as an example, the 5 ciphertexts corresponding to the 5 rows of the permutation matrix can be as follows:

[0060]

[0061] Among them, p i is the plaintext polynomial obtained based on the matrix elements of the i-th row in the permutation matrix. The corresponding calculation formula can be as follows: Among them, a ij is the matrix element in the i-th row and j-th column, where j is the position of the matrix element. i (p i ) is for p i The ciphertext polynomial obtained by performing full homomorphic encryption, taking the CKKS algorithm as an example, Enc i (p i )=(c0,c1), where c1=u*p1+e1, c0=u*p0+e0+p i . Among them, u is a random polynomial, e0 and e1 are noise polynomials, and p0 and p1 are public keys. It can be seen that when using the CKKS algorithm to encrypt the plaintext polynomial, the random polynomial u will be introduced, which makes the corresponding homomorphic encryption results inconsistent even if the two polynomials are the same.

[0062] When a fully homomorphic encryption algorithm is used, the above n ciphertexts are the first encrypted data.

[0063] Step S204: the client sends the first encrypted data to the server.

[0064] Step S206: The server obtains a ciphertext sequence consisting of n ciphertexts according to the plaintext sequence s1 consisting of n plaintext data held by it and the first encrypted data.

[0065] In this solution, the lengths of the n bit strings corresponding to the n plaintext data are equal. In an example, the plaintext sequence s1 can be expressed as: {d1, d2, d3, d4, d5}.

[0066] When the first encrypted data is the above-mentioned n*n-dimensional secret matrix, that is, when the permutation matrix is ​​encrypted using the additive homomorphic encryption algorithm, the plaintext sequence s1 consisting of n plaintext data can be converted into an n-dimensional plaintext vector. Afterwards, a homomorphic multiplication operation is performed on the n-dimensional plaintext vector and the secret matrix to obtain the above-mentioned ciphertext sequence.

[0067] It should be noted that, since the above n-dimensional plaintext vector is plaintext and the above-mentioned secret state matrix is ​​ciphertext, the above-mentioned multiplication operation is actually a multiplication operation of plaintext and ciphertext.

[0068] In the above example, when the n-dimensional plaintext vector can be represented as: (v1, v2, v3, v4, v5), the above multiplication operation can be expressed as follows:

[0069]

[0070] Thus, the following five calculation results can be obtained:

[0071] v1*Enc 11 (0)+v2*Enc 12 (0)+v3*Enc 13 (0)+v4*Enc 14 (1)+v5*Enc 15 (0);

[0072] v1*Enc 21 (0)+v2*Enc 22 (0)+v3*Enc 23 (1)+v4*Enc 24 (0)+v5*Enc 25 (0);

[0073] v1*Enc 31 (0)+v2*Enc 32 (0)+v3*Enc 33 (0)+v4*Enc 34 (0)+v5*Enc 35 (1);

[0074] v1*Enc 41 (1)+v2*Enc 42 (0)+v3*Enc 43 (0)+v4*Enc 44 (0)+v5*Enc 45 (0);

[0075] v1*Enc 51 (0)+v2*Enc 52 (1)+v3*Enc 53 (0)+v4*Enc 54 (0)+v5*Enc 55 (0).

[0076] Among them, the five operation results are the five ciphertexts that constitute the secret sequence.

[0077] It should be understood that since the multiplication operation between plaintext and ciphertext can be converted into an addition operation, for the above operation result: k *Enc ij (a), which can be converted to v k Enc ij (a) Add, therefore, according to the rules of homomorphic addition, we can get, v k *Enc ij (a) = Enc ij (vk *a).

[0078] Therefore, for the first operation result mentioned above, it is actually the homomorphic encryption result of the following formula: v1*0+v2*0+v3*0+v4*1+v5*0=v4*1, specifically expressed as: Enc(v4), and the other four operation results are respectively equivalent to: Enc(v3), Enc(v5), Enc(v1), Enc(v2).

[0079] That is to say, the above-mentioned encrypted sequence can be equivalent to the following sequence: {Enc(v4), Enc(v3), Enc(v5), Enc(v1), Enc(v2)}. It should be understood that the encrypted sequence corresponds to the following plaintext sequence s2: {d4, d3, d5, d1, d2}, and the plaintext sequence s2 is obtained by permuting the plaintext sequence s1 based on the predetermined permutation rule. It can be seen that the ciphertext sequence obtained by this scheme satisfies the above-mentioned predetermined permutation rule. Since the client only sends the encrypted matrix of the permutation matrix to the server, and the server only performs the encrypted calculation between the encrypted matrix and the plaintext vector, the server completes the permutation of the plaintext vector without knowing the permutation rule and obtains the ciphertext sequence, that is, the plaintext vector is inadvertently permuted.

[0080] In addition, in the case where the first encrypted data is n ciphertexts, each ciphertext is expanded into n ciphertexts (hereinafter referred to as extended ciphertexts) based on a preset algorithm to form an n*n dimensional secret state matrix, wherein the secret state matrix includes n*n extended ciphertexts, and the preset algorithm makes the plaintext matrix corresponding to the secret state matrix equivalent to the permutation matrix. The plaintext sequence s1 is converted into an n-dimensional plaintext vector, and a homomorphic multiplication operation is performed on the n-dimensional plaintext vector and the secret state matrix to obtain a ciphertext sequence.

[0081] In an example, the preset algorithm may be, for example, the SEALPIR algorithm, and the ciphertext expansion process based on the algorithm may be as follows:

[0082] 1:function EXPAND(query=Enc(x j ))

[0083] 2: find the smallest such that m≥n

[0084] 3:ciphertexts←[query]

[0085] 4:for

[0086] 5: for k = 0 to 2 j -1do

[0087] 6:c0←ciphertexts[k]

[0088] 7:

[0089] 8:c′ k ←c0+Sub(c0,N / 2 j +1)

[0090] 9:

[0091] 10:

[0092] 11: inverse←m -1 (mod t)

[0093] 12: for j = 0 to n - 1 do

[0094] 13:o j ←ciphertexts[j]·inverse

[0095] 14:return output←[o0,...,o n-1 ]

[0096] Among them, Enc(x j ) is the ciphertext to be expanded, O0, O1, ..., O n-1 Based on Enc(x j ) is the n extended ciphertexts. In addition, Sub(c,s) represents a substitution operation. Specifically, assuming that the ciphertext c = p(x), s is an odd number, Sub(c,s) returns p = (x s ), that is, use x s Replace x to do the calculation.

[0097] Taking m=8, n=5 as an example, the above algorithm will perform a total of 3 rounds of ciphertext generation, where the first round generates a pair of ciphertexts: (c′0, c1′), the second round generates two pairs of ciphertexts: (c′0, c2′) and (c1′, c3′), and the third round generates 4 pairs of ciphertexts: (c′0, c′4), (c1′, c′5), (c2′, c′6) and (c3′, c′7). It should be noted that ciphertexts with the same subscript will be overwritten. For example, c′0 generated in the second round will overwrite c′0 generated in the first round. Afterwards, by dividing the first 5 ciphertexts of the 8 generated ciphertexts by m, 5 extended ciphertexts can be obtained.

[0098] In the above example, in the above five ciphertexts Enc i (p i) After the ciphertext is expanded, the following n*n-dimensional secret state matrix (including n*n extended ciphertexts) can be obtained:

[0099]

[0100] Among them, the 5 extended ciphertexts in the first row are: 11 -O 15 , obtained by expanding the ciphertext of Enc1(p1); the 5 expanded ciphertexts in the second row: 21 -O 25 , obtained by ciphertext expansion of Enc2(p2); and so on.

[0101] In addition, it should be understood that for the 5 ciphertexts in the first row: 11 -O 15 After homomorphic decryption, we can get the 5 matrix elements of the first row of the permutation matrix of the concerned row permutation; for the 5 ciphertexts of the second row: 21 -O 25 After homomorphic decryption, we can get the 5 matrix elements of the second row of the permutation matrix of the concerned row permutation; and so on. In other words, the plaintext matrix corresponding to the above n*n dense matrix is ​​equivalent to the permutation matrix.

[0102] It should be noted that in this solution, the above formula can also be used: The five plaintext data held by the server are converted into five polynomials. Specifically, when the five polynomials are represented as: m1, m2, m3, m4, m5, the multiplication operation can be expressed as follows:

[0103]

[0104] Thus, the following five calculation results can be obtained:

[0105] m1*O 11 +m2*O 12 +m3*O 13 +m4*O 14 +m5*O 15 ;

[0106] m1*O 21 +m2*O 22 +m3*O 23 +m4*O 24 +m5*O 25 ;

[0107] m1*O 31 +m2*O 32 +m3*O 33 +m4*O 34 +m5*O35 ;

[0108] m1*O 41 +m2*O 42 +m3*O 43 +m4*O 44 +m5*O 45 ;

[0109] m1*O 51 +m2*O 52 +m3*O 53 +m4*O 54 +m5*O 55 ;

[0110] Similar to what was mentioned above, since the fully homomorphic encryption algorithm has the above-mentioned additive homomorphic property, the first operation result mentioned above is actually the homomorphic encryption result of the following formula: m1*0+m2*0+m3*0+m4*1+m5*0=m4, specifically expressed as: Enc(m4), and the other four operation results are respectively equivalent to: Enc(m3), Enc(m5), Enc(m1), and Enc(m2).

[0111] That is to say, the above encrypted sequence can be equivalent to the following sequence: {Enc(m4), Enc(m3), Enc(m5), Enc(m1), Enc(m2)}. It should be understood that the encrypted sequence corresponds to the following plaintext sequence s2: {d4, d3, d5, d1, d2}, and the plaintext sequence s2 is obtained by replacing the plaintext sequence s1 based on the predetermined replacement rule. It can be seen that the ciphertext sequence obtained by this scheme satisfies the above predetermined replacement rule.

[0112] At this point, the preparation phase is complete, and we can enter the query phase. The following is a description of the method steps included in the query phase:

[0113] Step S208: the client performs a replacement operation on the original position of the target data to be queried based on a predetermined replacement rule to obtain the target position.

[0114] For example, suppose the client wants to query the second plaintext data among the five plaintext data held by the server, that is, the original position is 2, and suppose the predetermined replacement rule is: [1,2,3,4,5]->[4,5,2,1,3], then the corresponding target position can be calculated: 5.

[0115] Step S210: the client sends the target location to the server.

[0116] Step S212: The server reads the target ciphertext at the target location from its cipher sequence.

[0117] For example, from the ciphertext sequence obtained based on additive homomorphic encryption: y = {Enc(v4), Enc(v3), Enc(v5), Enc(v1), Enc(v2)}, read the target ciphertext at the 5th position: Enc(v2).

[0118] For another example, from the ciphertext sequence obtained based on fully homomorphic encryption: y = {Enc(m4), Enc(m3), Enc(m5), Enc(m1), Enc(m2)}, read the target ciphertext at the 5th position: Enc(m2).

[0119] Step S214: the server sends the read target ciphertext to the client.

[0120] Step S216: The client performs homomorphic decryption on the received target ciphertext to obtain the target data.

[0121] Here, the client can use the private key generated in advance for the additive homomorphic encryption algorithm or the fully homomorphic encryption algorithm to decrypt the received ciphertext data.

[0122] For example, when the target ciphertext received is: Enc(v2), the client first uses the private key to decrypt it and obtains the plaintext code: v2. Then, the client performs a decoding process under additive homomorphic encryption on v2 to obtain the corresponding plaintext data: d2.

[0123] For another example, when the target ciphertext received is: Enc(m2), the client first uses the private key to decrypt it and obtains the plaintext polynomial: m2. Then, it can be converted into the corresponding plaintext data: d2.

[0124] In summary, the privacy-preserving data provision and query method provided by the embodiments of this specification has the following advantages: 1) The main computing work is uniformly moved into the preparation stage, thereby avoiding the need for large-scale immediate computing in the query stage. 2) The introduction of the oblivious replacement protocol allows the client to only provide the replacement position of the query position in the real-time query stage, and the server does not need to perform any secret operations, but only needs to perform constant-level computing, which can improve the computing performance of the server and thus improve the practicality of this solution.

[0125] Corresponding to the above-mentioned privacy-protected data providing method, an embodiment of the present specification also provides a privacy-protected data providing device, which is arranged on a server, such as Figure 3 As shown, the device may include:

[0126] The receiving unit 302 is used to receive first encrypted data from a client in a preparation stage, where the first encrypted data is obtained by homomorphically encrypting an n*n dimensional permutation matrix corresponding to a predetermined permutation rule.

[0127] The acquisition unit 304 is used to obtain a ciphertext sequence consisting of n first ciphertexts based on a first plaintext sequence consisting of n plaintext data held by the server and the received first encrypted data, wherein the ciphertext sequence corresponds to a second plaintext sequence, and the second plaintext sequence is equivalent to a plaintext sequence obtained by permuting the first plaintext sequence based on a predetermined permutation rule.

[0128] The receiving unit 302 is further configured to receive a target position of the target data to be queried from the client during the query phase, where the target position is a position obtained by performing a replacement operation on the original position of the target data based on a predetermined replacement rule.

[0129] The reading unit 306 is used to read the target ciphertext at the target position from the ciphertext sequence.

[0130] The sending unit 308 is used to send the target ciphertext to the client.

[0131] In one embodiment, the first encrypted data is an n*n dimensional secret state matrix;

[0132] The acquisition unit 304 is specifically used for:

[0133] Convert a first plaintext sequence consisting of n plaintext data held by the server into an n-dimensional plaintext vector;

[0134] Perform homomorphic multiplication on the n-dimensional plaintext vector and the secret matrix to obtain a ciphertext sequence.

[0135] In another embodiment, the first encrypted data includes n second ciphertexts corresponding to each row or column in the permutation matrix;

[0136] The acquisition unit 304 is specifically used for:

[0137] Based on a preset algorithm, each second ciphertext is expanded into n third ciphertexts to form an n*n dimensional secret state matrix, wherein the secret state matrix includes n*n third ciphertexts, and the preset algorithm makes the plaintext matrix corresponding to the secret state matrix equivalent to the permutation matrix;

[0138] Convert a first plaintext sequence consisting of n plaintext data held by the server into an n-dimensional plaintext vector;

[0139] A homomorphic multiplication operation is performed on the n-dimensional plaintext vector and the cipher state matrix to obtain the ciphertext sequence.

[0140] Among them, homomorphic encryption is fully homomorphic encryption;

[0141] The acquisition unit 304 is further specifically configured to:

[0142] The n plaintext data in the first plaintext sequence are respectively converted into n polynomials, and the n polynomials form an n-dimensional plaintext vector.

[0143] The functions of the functional units of the device in the above-mentioned embodiment of this specification can be implemented through the steps of the above-mentioned method embodiment. Therefore, the specific working process of the device provided by one embodiment of this specification will not be repeated here.

[0144] A privacy-protected data providing device provided by an embodiment of the present specification can greatly improve data query efficiency.

[0145] Corresponding to the above-mentioned privacy-protected data query method, an embodiment of the present specification also provides a privacy-protected data query device, which is arranged on a client, such as Figure 4 As shown, the device may include:

[0146] The construction unit 402 is used to construct an n*n dimensional permutation matrix corresponding to a predetermined permutation rule in the preparation stage.

[0147] The encryption unit 404 is used to perform homomorphic encryption on the permutation matrix to obtain first encrypted data.

[0148] The sending unit 406 is configured to send the first encrypted data to the server.

[0149] The replacement unit 408 is used to perform a replacement operation on the original position of the target data to be queried based on a predetermined replacement rule during the query phase to obtain the target position.

[0150] The sending unit 406 is further configured to send the target location to the server.

[0151] The receiving unit 410 is used to receive the target ciphertext read by the server from the ciphertext sequence held by the server according to the target position.

[0152] The decryption unit 412 is used to perform homomorphic decryption on the received target ciphertext to obtain target data.

[0153] In one embodiment, the encryption unit 404 is specifically used for:

[0154] Perform homomorphic encryption on each matrix element in the permutation matrix to obtain an n*n dimensional secret matrix;

[0155] An n*n dimensional secret state matrix is ​​determined as first encrypted data.

[0156] In another embodiment, the encryption unit 404 is specifically used for:

[0157] Homomorphically encrypt the permutation matrix according to rows or columns to obtain n second ciphertexts corresponding to each row or column;

[0158] The n second ciphertexts are determined as first encrypted data.

[0159] In one embodiment, the client is pre-set with a public key and a private key corresponding to the homomorphic encryption algorithm; the encryption unit 404 is specifically used for:

[0160] Using the public key, the permutation matrix is ​​homomorphically encrypted;

[0161] The decryption unit 412 is specifically used for:

[0162] Use the private key to homomorphically decrypt the target ciphertext.

[0163] The functions of the functional units of the device in the above-mentioned embodiment of this specification can be implemented through the steps of the above-mentioned method embodiment. Therefore, the specific working process of the device provided by one embodiment of this specification will not be repeated here.

[0164] A privacy-protected data query device provided by an embodiment of the present specification can greatly improve data query efficiency.

[0165] According to another embodiment, there is also provided a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute a combination of Figure 2 The method described.

[0166] According to another embodiment of the present invention, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the Figure 2 The method described.

[0167] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the medium or device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0168] In the 1990s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the method flow). However, with the development of technology, many improvements to the method flow today can be regarded as direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0169] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0170] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, the present application does not exclude that with the development of computer technology in the future, the computer that implements the functions of the above embodiments may be, for example, a personal computer, a laptop computer, a vehicle-mounted human-computer interaction device, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0171] Although one or more embodiments of the present specification provide method operation steps as described in the embodiments or flow charts, more or less operation steps may be included based on conventional or non-creative means. The order of steps listed in the embodiments is only one way of executing the order of many steps, and does not represent the only execution order. When the device or terminal product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiments or the drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The term "include", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or equipment including a series of elements includes not only those elements, but also includes other elements that are not explicitly listed, or also includes elements inherent to such a process, method, product or equipment. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or equipment including the elements. For example, if the words first, second, etc. are used to represent the name, they do not represent any specific order.

[0172] For the convenience of description, the above devices are described in various modules according to their functions. Of course, when implementing one or more of the present specification, the functions of each module can be implemented in the same or more software and / or hardware, or the module implementing the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0173] The present invention is described with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0174] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0175] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0176] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0177] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0178] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage, graphene storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0179] It should be understood by those skilled in the art that one or more embodiments of the present specification may be provided as a method, system or computer program product. Therefore, one or more embodiments of the present specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, one or more embodiments of the present specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0180] One or more embodiments of the present specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. One or more embodiments of the present specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0181] Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. In the description of this specification, the description of the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of this specification. In this specification, the schematic representation of the above terms does not necessarily target the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples without contradiction.

[0182] The above description is only an example of one or more embodiments of the present specification and is not intended to limit one or more embodiments of the present specification. For those skilled in the art, one or more embodiments of the present specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification shall be included in the scope of the claims.

Claims

1. A privacy-preserving data provision method, including a preparation phase and a query phase ； The method is executed by a server and includes: In the preparation stage, first encrypted data is received from a client, the first encrypted data being obtained by homomorphically encrypting an n*n dimensional permutation matrix corresponding to a predetermined permutation rule; a ciphertext sequence consisting of n first ciphertexts is obtained according to a first plaintext sequence consisting of n plaintext data held by the server and the first encrypted data, the ciphertext sequence corresponding to a second plaintext sequence, the second plaintext sequence being equivalent to a plaintext sequence obtained by permuting the first plaintext sequence based on the predetermined permutation rule; In the query phase, a target position of the target data to be queried is received from the client, where the target position is the position after a substitution operation is performed on the original position of the target data based on the predetermined substitution rule; a target ciphertext of the target position is read from the ciphertext sequence; and the target ciphertext is sent to the client.

2. The method according to claim 1, in, The first encrypted data is an n*n dimensional secret matrix; The obtaining of a ciphertext sequence consisting of n first ciphertexts includes: Converting the first plaintext sequence into an n-dimensional plaintext vector; A homomorphic multiplication operation is performed on the n-dimensional plaintext vector and the cipher state matrix to obtain the ciphertext sequence.

3. The method according to claim 1, in, The first encrypted data includes n second ciphertexts corresponding to each row or column in the permutation matrix; The obtaining of a ciphertext sequence consisting of n first ciphertexts includes: Based on a preset algorithm, each of the second ciphertexts is expanded into n third ciphertexts to form an n*n dimensional secret state matrix, wherein the secret state matrix includes n*n third ciphertexts, and the preset algorithm makes the plaintext matrix corresponding to the secret state matrix equal to the permutation matrix; Converting the first plaintext sequence into an n-dimensional plaintext vector; A homomorphic multiplication operation is performed on the n-dimensional plaintext vector and the cipher state matrix to obtain the ciphertext sequence.

4. The method according to claim 3, in, The homomorphic encryption is fully homomorphic encryption; The converting the first plaintext sequence into an n-dimensional plaintext vector comprises: The n plaintext data in the first plaintext sequence are respectively converted into n polynomials, and the n polynomials form the n-dimensional plaintext vector.

5. A privacy-preserving data query method, including a preparation phase and a query phase ； The method is executed by a client and includes: In the preparation stage, an n*n dimensional permutation matrix corresponding to a predetermined permutation rule is constructed, and the permutation matrix is ​​homomorphically encrypted to obtain first encrypted data; and the first encrypted data is sent to a server; In the query phase, based on the predetermined substitution rule, a substitution operation is performed on the original position of the target data to be queried to obtain the target position; the target position is sent to the server; the server reads the target ciphertext from the ciphertext sequence it holds according to the target position; and the target ciphertext is homomorphically decrypted to obtain the target data.

6. The method according to claim 5, in, The performing homomorphic encryption on the permutation matrix includes: Homomorphically encrypt each matrix element in the permutation matrix to obtain an n*n dimensional secret matrix; The n*n dimensional secret state matrix is ​​determined as the first encrypted data.

7. The method according to claim 5, in, The performing homomorphic encryption on the permutation matrix includes: Homomorphically encrypt the permutation matrix according to rows or columns to obtain n second ciphertexts corresponding to each row or column; The n second ciphertexts are determined as the first encrypted data.

8. The method according to claim 5, in, The client is pre-installed with a public key and a private key corresponding to a homomorphic encryption algorithm; and the homomorphic encryption of the permutation matrix includes: Using the public key, homomorphically encrypting the permutation matrix; The homomorphic decryption of the target ciphertext includes: The target ciphertext is homomorphically decrypted using the private key.

9. A computer program product, comprising a computer program / instruction, which implements the steps of the method according to claim 1 when executed by a processor.

10. A computing device, comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method according to any one of claims 1 to 8 is implemented.

Images