A data providing and querying method and device for protecting privacy

Abstract

This specification provides a privacy-protecting data provision and query method and apparatus. In the data provision method, during the preparation phase, the server receives first encrypted data from the client. This first encrypted data is obtained by homomorphically encrypting an n*n-dimensional permutation matrix corresponding to a predetermined permutation rule. Based on a first plaintext sequence consisting of n plaintext data held by the server and the first encrypted data, a ciphertext sequence consisting of n first ciphertexts is obtained. This ciphertext sequence corresponds to a second plaintext sequence, which is equivalent to the plaintext sequence obtained by permuting the first plaintext sequence based on the predetermined permutation rule. During the query phase, the server receives the target location of the target data to be queried from the client. This target location is the position after performing a permutation operation on the original position of the target data based on the predetermined permutation rule. The target ciphertext of the target location is read from the ciphertext sequence and sent to the client.

Description

Technical Field

[0001] The embodiments in this specification belong to the field of secure computing technology, and in particular relate to a method and apparatus for providing and querying data while protecting privacy. Background Technology

[0002] Privacy-preserving computing is an emerging technology that enables data to be used but not seen, maximizing data value while protecting data privacy. Privacy information retrieval (PIR) refers to a process where the queryer hides the identifier of their query target, and the data provider provides matching search results without revealing the specific object of the query. Specifically, PIR can be described as follows: a data provider owns a database with n records, and a queryer wants to retrieve the i-th record from this database, but the data provider does not know which record the queryer is referring to. Privacy information retrieval has important applications in fields such as healthcare and finance. For example, in the medical field, some patients search for symptoms of related diseases or the uses of medications on medical websites, but do not want to expose their diseases or medications to others; privacy information retrieval can solve this problem.

[0003] Privacy-preserving information retrieval requires various encryption methods to protect data privacy. This increases the computational load, which in turn affects query efficiency. Summary of the Invention

[0004] The purpose of this invention is to provide a method and apparatus for providing and querying data that protects privacy, which can greatly improve the efficiency of data querying.

[0005] This specification provides a privacy-protected data provision method, including a preparation phase and a query phase; the method is executed via a server, including:

[0006] During the preparation phase, first encrypted data is received from the client. This first encrypted data is obtained by homomorphically encrypting an n*n-dimensional permutation matrix corresponding to a predetermined permutation rule. Based on a first plaintext sequence consisting of n plaintext data held by the server and the first encrypted data, a ciphertext sequence consisting of n first ciphertexts is obtained. This ciphertext sequence corresponds to a second plaintext sequence, which is equivalent to the plaintext sequence obtained by permuting the first plaintext sequence based on the predetermined permutation rule.

[0007] During the query phase, the target location of the target data to be queried is received from the client. This target location is the position after performing a permutation operation on the original position of the target data based on the predetermined permutation rule. The target ciphertext of the target location is read from the ciphertext sequence. The target ciphertext is then sent to the client.

[0008] A second aspect of this specification provides a privacy-protecting data query method, including a preparation stage and a query stage; the method is executed through a client and includes:

[0009] In the preparation stage, an n*n dimensional permutation matrix corresponding to a predetermined permutation rule is constructed, and the permutation matrix is ​​homomorphically encrypted to obtain first encrypted data; the first encrypted data is then sent to the server.

[0010] During the query phase, based on the predetermined permutation rule, a permutation operation is performed on the original position of the target data to be queried to obtain the target position; the target position is sent to the server; the target ciphertext is received from the server based on the target position and read from its ciphertext sequence; the target ciphertext is homomorphically decrypted to obtain the target data.

[0011] A third aspect of this specification provides a privacy-protecting data provision device, disposed on a server, the device comprising:

[0012] The receiving unit is configured to receive first encrypted data from the client during the preparation phase, the first encrypted data being obtained by homomorphically encrypting an n*n-dimensional permutation matrix corresponding to a predetermined permutation rule;

[0013] The acquisition unit is used to obtain a ciphertext sequence consisting of n first ciphertexts based on a first plaintext sequence consisting of n plaintext data held by the server and the received first encrypted data. The ciphertext sequence corresponds to a second plaintext sequence, and the second plaintext sequence is equivalent to the plaintext sequence obtained by permuting the first plaintext sequence based on a predetermined permutation rule.

[0014] The receiving unit is also used to receive the target location of the target data to be queried from the client during the query phase. The target location is the location after performing a permutation operation on the original location of the target data based on a predetermined permutation rule.

[0015] The read unit is used to read the target ciphertext at the target location from the ciphertext sequence;

[0016] The sending unit is used to send the target ciphertext to the client.

[0017] A fourth aspect of this specification provides a privacy-protecting data query device, set on a client side, the device comprising:

[0018] The construction unit is used during the preparation phase to construct an n*n dimensional permutation matrix corresponding to a predetermined permutation rule.

[0019] The encryption unit is used to perform homomorphic encryption on the permutation matrix to obtain the first encrypted data.

[0020] The sending unit is used to send the first encrypted data to the server.

[0021] The permutation unit is used during the query phase to perform a permutation operation on the original position of the target data to be queried, based on a predetermined permutation rule, to obtain the target position.

[0022] The sending unit is also used to send the target location to the server.

[0023] The receiving unit is used to receive the target ciphertext read by the server from the ciphertext sequence it holds based on the target location.

[0024] The decryption unit is used to perform homomorphic decryption on the received target ciphertext to obtain the target data.

[0025] The fifth aspect of this specification provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method described in the first or second aspect.

[0026] A sixth aspect of this specification provides a computing device including a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method of the first or second aspect.

[0027] The seventh aspect of this specification provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the method of the first or second aspect.

[0028] This specification provides a privacy-preserving data provision method according to one or more embodiments, including a preparation phase and a query phase. In the preparation phase, the server obtains a sequence of n ciphertexts by running an unintentional permutation protocol with the client. Then, in the query phase, the client provides the server with the permuted target location of the target data to be queried. The server then reads the target ciphertext at that location from the ciphertext sequence and returns it to the client. In other words, in this scheme, during the query phase, the server does not need to perform any cryptographic operations, but only performs a simple data reading operation, thereby greatly improving the efficiency of data retrieval. Attached Figure Description

[0029] To more clearly illustrate the technical solutions of the embodiments in this specification, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0030] Figure 1This is a schematic diagram illustrating an implementation scenario of one of the embodiments disclosed in this specification;

[0031] Figure 2 This is an interaction diagram of a privacy-protecting data provision method in one embodiment of this specification;

[0032] Figure 3 This is a schematic diagram of a privacy-protecting data providing device in one embodiment of this specification;

[0033] Figure 4 This is a schematic diagram of a privacy-protecting data query device in one embodiment of this specification. Detailed Implementation

[0034] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0035] As mentioned earlier, to protect data privacy, various encryption methods are needed to process the data. Currently, the mainstream encryption method is homomorphic encryption, such as the SEALPIR scheme (a privacy information retrieval scheme based on additive homomorphism). In this scheme, the server needs to pre-encode the database to obtain a plaintext vector. Then, during the data query phase, the client provides a high-dimensional encrypted query vector, and the server performs the inner product operation of the plaintext and ciphertext vectors. However, because the query vector provided by the client has a high dimension, this results in a large amount of communication during the query and also increases the computation time.

[0036] Therefore, this specification proposes an improved scheme in its embodiments, comprising two phases: a preparation phase and a query phase. In the preparation phase, the server obtains a ciphertext sequence consisting of n ciphertexts by running an unintentional permutation protocol with the client. Specifically, the server receives first encrypted data from the client, which is obtained by homomorphically encrypting an n*n-dimensional permutation matrix corresponding to a predetermined permutation rule. Based on the first plaintext sequence consisting of n plaintexts and the first encrypted data, the server obtains a ciphertext sequence consisting of n first ciphertexts, which corresponds to a second plaintext sequence. This second plaintext sequence is equivalent to the plaintext sequence obtained by permuting the first plaintext sequence according to the predetermined permutation rule. Next, in the query phase, the client provides the server with the permuted target location of the target data to be queried. The server then reads the target ciphertext of that target location from the ciphertext sequence and returns it to the client. In other words, in this scheme, during the query phase, the server does not need to perform any cryptographic operations, only a simple data reading operation, thereby greatly improving data query efficiency. Furthermore, during the query phase, the client only needs to provide a target location, thus saving communication resources.

[0037] Figure 1 This is a schematic diagram illustrating an implementation scenario of one of the embodiments disclosed in this specification. Figure 1 In this context, the entire data provision or query process can be divided into two stages: the preparation stage and the query stage.

[0038] During the preparation phase, the client and server execute an unintentional permutation protocol, encrypting and permuting the n plaintext data held by the server to obtain a ciphertext sequence consisting of n ciphertexts. It should be noted that the specific permutation rules are provided by the client, and the server is unaware of these rules. During the query phase, the client, based on the predetermined permutation rules, performs a permutation operation on the original position of the target data C to be queried, obtaining the target position i, and sends this target position i to the server. The server reads the target ciphertext Enc(C) at target position i from the ciphertext sequence determined during the preparation phase and provides it to the client. The client homomorphically decrypts the received ciphertext data Enc(C) to obtain the target data C.

[0039] Figure 2 This is an interactive diagram of a privacy-protecting data provision method in one embodiment of this specification. Figure 2 The method may include two phases: a preparation phase and a query phase. The preparation phase may include the following steps:

[0040] In step S202, the client constructs an n*n-dimensional permutation matrix corresponding to the predetermined permutation rule, and performs homomorphic encryption on the permutation matrix to obtain the first encrypted data.

[0041] The aforementioned pre-defined permutation rule π is used to rearrange multiple elements in an element sequence, replacing each element from one position to another, with each position having a unique element corresponding to it.

[0042] In one embodiment, the predetermined replacement rule described above can be as follows:

[0043] [1,2,3,4,5]->[4,5,2,1,3].

[0044] The predetermined permutation rule states that the first position in the sequence is mapped to the fourth position, the second position to the fifth position, the third position to the second position, the fourth position to the first position, and the fifth position to the third position. Specifically, mapping the first position to the fourth position means permuting the element at the first position to the fourth position.

[0045] A permutation matrix can be used to represent the rearrangement or transformation of rows or columns in a matrix. It can be a square binary matrix with only one 1 in each row or column and the rest as 0. Specifically, a permutation matrix can be a matrix obtained by exchanging certain rows or columns of the identity matrix. It should be understood that the identity matrix itself is a basic permutation matrix, and it does not perform any changes to the matrix.

[0046] Generally, for any predetermined permutation rule, a corresponding permutation matrix can be constructed. This means viewing the mapping between positions in the sequence as row or column transformations. Specifically, when viewing the mapping between positions as row transformations, the permutation matrix corresponding to the predetermined permutation rule in the previous example (hereinafter also referred to as the permutation matrix focusing on row permutations) can be as follows:

[0047]

[0048] It should be understood that the permutation matrix is ​​obtained through the following steps: the mapping from the 1st position to the 4th position is regarded as a transformation from the 1st row to the 4th row in the identity matrix; the mapping from the 2nd position to the 5th position is regarded as a transformation from the 2nd row to the 5th row in the identity matrix; the mapping from the 3rd position to the 2nd position is regarded as a transformation from the 3rd row to the 2nd row; the mapping from the 4th position to the 1st position is regarded as a transformation from the 4th row to the 1st row; and the mapping from the 5th position to the 3rd position is regarded as a transformation from the 3rd row to the 3rd row.

[0049] Furthermore, when the mapping between positions in the sequence is viewed as a column transformation, the permutation matrix corresponding to the predetermined permutation rule in the aforementioned example can be as follows:

[0050]

[0051] It should be noted that in this scheme, either additive homomorphic encryption or fully homomorphic encryption can be used to encrypt the permutation matrix. Examples of additive homomorphic encryption algorithms include the Paillier algorithm, while examples of fully homomorphic encryption algorithms include the BFV (Brakerski / Fan-Vercauteren) algorithm or the CKKS algorithm.

[0052] More specifically, the client can pre-generate the corresponding public and private keys for either additive homomorphic encryption or fully homomorphic encryption algorithms, and then use the public key to encrypt the permutation matrix. For simplicity, the following description directly refers to performing additive homomorphic encryption or fully homomorphic encryption on the permutation matrix.

[0053] In the addition homomorphic encryption algorithm, each matrix element in the permutation matrix can be homomorphically encrypted to obtain an n*n dimensional dense matrix.

[0054] Taking the permutation matrix of the row permutation mentioned above as an example, the corresponding dense state matrix can be as follows:

[0055]

[0056] Taking the Paillier algorithm as an example of additive homomorphic encryption, the matrix element in the i-th row and j-th column of the aforementioned encrypted matrix is: Enc ij (a)=g a ·r n mod n 2 In this matrix, g and n constitute the public key of the Paillier algorithm, r is a random integer with a value in the range 1 ≤ r ≤ n-1, and a is a matrix element, which is either 0 or 1. It should be noted that because a random number r is introduced when encrypting matrix elements using the Paillier algorithm, the various encrypted elements in the above encrypted matrix are all different. For example, Enc... 11 (0) and Enc 12 (0) is inconsistent.

[0057] It should be noted that when using the additive homomorphic encryption algorithm, the n*n dimensional encrypted matrix is ​​the first encrypted data mentioned above.

[0058] When using a fully homomorphic encryption algorithm, the permutation matrix can be homomorphically encrypted according to rows or columns to obtain n ciphertexts corresponding to each row or column.

[0059] Taking the permutation matrix of the row of interest mentioned above as an example, the 5 ciphertexts corresponding to the 5 rows of the permutation matrix can be as follows:

[0060]

[0061] Where, p i The plaintext polynomial obtained based on the matrix elements in the i-th row of the permutation matrix can be calculated using the following formula: Among them, a ij Let be the matrix element in the i-th row and j-th column, where j is the position of the matrix element. i (p i ) for p i The ciphertext polynomial obtained by performing fully homomorphic encryption, taking the CKKS algorithm as an example, is Enc i (p i ) = (c0, c1), where c1 = u*p1 + e1, c0 = u*p0 + e0 + p i Here, u is a random polynomial, e0 and e1 are noise polynomials, and p0 and p1 are public keys. It is evident that when using the CKKS algorithm to encrypt a plaintext polynomial, a random polynomial u is introduced, which means that even if two polynomials are identical, their corresponding homomorphic encryption results will be inconsistent.

[0062] When using a fully homomorphic encryption algorithm, the above n ciphertexts constitute the first encrypted data.

[0063] In step S204, the client sends the first encrypted data to the server.

[0064] In step S206, the server obtains a ciphertext sequence consisting of n ciphertexts based on the plaintext sequence s1 composed of n plaintext data and the first encrypted data it holds.

[0065] In this scheme, the n bit strings corresponding to the aforementioned n plaintext data are all of equal length. In one example, the plaintext sequence s1 can be represented as: {d1,d2,d3,d4,d5}.

[0066] Specifically, when the first encrypted data is the aforementioned n*n dimensional dense state matrix, that is, when encrypting the permutation matrix using the additive homomorphic encryption algorithm, the plaintext sequence s1 consisting of n plaintext data can be converted into an n-dimensional plaintext vector. Then, a homomorphic multiplication operation is performed between the n-dimensional plaintext vector and the dense state matrix to obtain the aforementioned ciphertext sequence.

[0067] It should be noted that since the above n-dimensional plaintext vector is plaintext and the above encrypted matrix is ​​ciphertext, the above multiplication operation is actually a multiplication operation between plaintext and ciphertext.

[0068] In the previous example, when the n-dimensional plaintext vector can be represented as (v1, v2, v3, v4, v5), the above multiplication operation can be represented as follows:

[0069]

[0070] Therefore, we can obtain the following 5 calculation results:

[0071] v1*Enc 11 (0)+v2*Enc 12 (0)+v3*Enc 13 (0)+v4*Enc 14 (1)+v5*Enc 15 (0);

[0072] v1*Enc 21 (0)+v2*Enc 22 (0)+v3*Enc 23 (1)+v4*Enc 24 (0)+v5*Enc 25 (0);

[0073] v1*Enc 31 (0)+v2*Enc 32 (0)+v3*Enc 33 (0)+v4*Enc 34 (0)+v5*Enc 35 (1);

[0074] v1*Enc 41 (1)+v2*Enc 42 (0)+v3*Enc 43 (0)+v4*Enc 44 (0)+v5*Enc 45 (0);

[0075] v1*Enc 51 (0)+v2*Enc 52 (1)+v3*Enc 53 (0)+v4*Enc 54 (0)+v5*Enc 55 (0).

[0076] The results of these five operations constitute the five ciphertexts that make up the dense state sequence.

[0077] It should be understood that since multiplication between plaintext and ciphertext can be converted into addition, the result of the above operation can be: v k *Enc ij (a), which can be converted to v k Enc ij (a) Add them together. Therefore, according to the rules of homomorphic addition, we can obtain v k *Enc ij (a)=Enc ij (vk *a).

[0078] Therefore, the first operation result is actually the homomorphic encryption result of the following formula: v1*0+v2*0+v3*0+v4*1+v5*0=v4*1, specifically represented as: Enc(v4), and the other four operation results are equivalent to: Enc(v3), Enc(v5), Enc(v1), and Enc(v2), respectively.

[0079] In other words, the aforementioned encrypted sequence is equivalent to the following sequence: {Enc(v4),Enc(v3),Enc(v5),Enc(v1),Enc(v2)}. It should be understood that this encrypted sequence corresponds to the following plaintext sequence s2: {d4,d3,d5,d1,d2}, which is obtained by permuting the plaintext sequence s1 based on a predetermined permutation rule. Therefore, the ciphertext sequence obtained by this scheme satisfies the aforementioned predetermined permutation rule. Since the client only sends the encrypted matrix of the permutation matrix to the server, and the server only performs encrypted calculations between the encrypted matrix and the plaintext vector, the server completes the permutation of the plaintext vector without knowing the permutation rule, thus obtaining the ciphertext sequence—that is, the plaintext vector is unintentionally permuted.

[0080] Furthermore, given that the first encrypted data consists of n ciphertexts, each ciphertext is expanded into n ciphertexts (hereinafter referred to as expanded ciphertexts) based on a preset algorithm, forming an n*n dimensional encrypted matrix. This encrypted matrix includes n*n expanded ciphertexts. The preset algorithm ensures that the plaintext matrix corresponding to the encrypted matrix is ​​equivalent to a permutation matrix. The plaintext sequence s1 is converted into an n-dimensional plaintext vector, and a homomorphic multiplication operation is performed between the n-dimensional plaintext vector and the encrypted matrix to obtain the ciphertext sequence.

[0081] In one example, the aforementioned preset algorithm could be, for instance, the SEALPIR algorithm, and the ciphertext expansion process based on this algorithm could be as follows:

[0082] 1:function EXPAND(query=Enc(x j ))

[0083] 2: find smallest such that m≥n

[0084] 3: ciphertexts ← [query]

[0085] 4:for

[0086] 5: for k = 0 to 2 j -1do

[0087] 6:c0←ciphertexts[k]

[0088] 7:

[0089] 8:c′ k ←c0+Sub(c0,N / 2 j +1)

[0090] 9:

[0091] 10:

[0092] 11:inverse←m -1 (mod t)

[0093] 12:for j=0to n-1do

[0094] 13:o j ←ciphertexts[j]·inverse

[0095] 14: return output ← [o0,...,o n-1 ]

[0096] Among them, Enc(x) in the above algorithm j ) represents the ciphertext to be expanded, O0, O1, ..., O n-1 For Enc(x) j The extended ciphertext is obtained from n ciphertexts. Furthermore, Sub(c,s) represents a substitution operation; specifically, assuming ciphertext c = p(x) and s is odd, Sub(c,s) returns p = (x...). s ), that is, using x s Replace x in the calculation.

[0097] Taking m=8 and n=5 as an example, the above algorithm will perform a total of 3 rounds of ciphertext generation. The first round generates one pair of ciphertexts: (c′0, c1′); the second round generates two pairs of ciphertexts: (c′0, c2′) and (c1′, c3′); and the third round generates four pairs of ciphertexts: (c′0, c′4), (c1′, c′5), (c2′, c′6), and (c3′, c′7). It should be noted that ciphertexts with the same index will be overwritten; for example, c′0 generated in the second round will overwrite c′0 generated in the first round. Then, by dividing the first 5 of the 8 generated ciphertexts by m, 5 extended ciphertexts can be obtained.

[0098] In the aforementioned example, regarding the five ciphertexts Enc mentioned above... i (p iAfter ciphertext expansion, the following n*n dimensional secret state matrix can be obtained (which includes n*n expanded ciphertexts):

[0099]

[0100] The first line contains 5 extended ciphertext characters: O 11 -O 15 This is obtained by ciphertext expansion of Enc1(p1); the five expanded ciphertexts in the second line are: O 21 -O 25 It is obtained by ciphertext expansion of Enc2(p2); and so on.

[0101] Furthermore, it should be understood that the five ciphertexts in the first line: O 11 -O 15 After homomorphic decryption, we can obtain the 5 matrix elements in the first row of the permutation matrix of interest; for the 5 ciphertext elements in the second row: O 21 -O 25 After homomorphic decryption, we can obtain the 5 matrix elements in the second row of the permutation matrix of the row of interest; and so on. In other words, the plaintext matrix corresponding to the above n*n dense state matrix is ​​equivalent to the permutation matrix.

[0102] It should be noted that this solution can also be based on the formula mentioned above: The five plaintext data points held by the server are converted into five polynomials. Specifically, when these five polynomials are represented as m1, m2, m3, m4, and m5, the above multiplication operation can be expressed as follows:

[0103]

[0104] Therefore, we can obtain the following 5 calculation results:

[0105] m1*O 11 +m2*O 12 +m3*O 13 +m4*O 14 +m5*O 15 ;

[0106] m1*O 21 +m2*O 22 +m3*O 23 +m4*O 24 +m5*O 25 ;

[0107] m1*O 31 +m2*O 32 +m3*O 33 +m4*O 34 +m5*O35 ;

[0108] m1*O 41 +m2*O 42 +m3*O 43 +m4*O 44 +m5*O 45 ;

[0109] m1*O 51 +m2*O 52 +m3*O 53 +m4*O 54 +m5*O 55 ;

[0110] Similar to the above, since the fully homomorphic encryption algorithm has the above-mentioned additive homomorphic property, the first operation result is actually the homomorphic encryption result of the following formula: m1*0+m2*0+m3*0+m4*1+m5*0=m4, specifically represented as: Enc(m4), and the other four operation results are equivalent to: Enc(m3), Enc(m5), Enc(m1), and Enc(m2), respectively.

[0111] In other words, the aforementioned encrypted sequence is equivalent to the following sequence: {Enc(m4),Enc(m3),Enc(m5),Enc(m1),Enc(m2)}. It should be understood that this encrypted sequence corresponds to the following plaintext sequence s2: {d4,d3,d5,d1,d2}, which is obtained by permuting the plaintext sequence s1 according to a predetermined permutation rule. Therefore, the encrypted sequence obtained by this scheme satisfies the aforementioned predetermined permutation rule.

[0112] This completes the preparation phase, allowing us to proceed to the query phase. The following describes the methods and steps involved in the query phase:

[0113] In step S208, the client performs a substitution operation on the original position of the target data to be queried based on the predetermined substitution rules to obtain the target position.

[0114] For example, suppose a client wants to query the second plaintext data out of five plaintext data held by the server, that is, the original position is 2, and suppose the predetermined permutation rule is: [1,2,3,4,5]->[4,5,2,1,3], then the corresponding target position can be calculated as: 5.

[0115] Step S210: The client sends the target location to the server.

[0116] In step S212, the server reads the target ciphertext at the target location from its cipher sequence.

[0117] For example, from the ciphertext sequence y = {Enc(v4), Enc(v3), Enc(v5), Enc(v1), Enc(v2)} obtained by addition homomorphic encryption, the target ciphertext at the 5th position is read: Enc(v2).

[0118] For example, from the ciphertext sequence obtained based on fully homomorphic encryption: y = {Enc(m4), Enc(m3), Enc(m5), Enc(m1), Enc(m2)}, the target ciphertext at the 5th position is read: Enc(m2).

[0119] In step S214, the server sends the read target ciphertext to the client.

[0120] In step S216, the client performs homomorphic decryption on the received target ciphertext to obtain the target data.

[0121] Here, the client can use its pre-generated private key for either additive homomorphic encryption or fully homomorphic encryption to decrypt the received ciphertext data.

[0122] For example, when the received target ciphertext is Enc(v2), the client first decrypts it using its private key to obtain the plaintext encoding: v2. Then, the client performs decoding processing on v2 under additive homomorphic encryption to obtain the corresponding plaintext data: d2.

[0123] For example, when the received target ciphertext is Enc(m2), the client first decrypts it using its private key to obtain the plaintext polynomial: m2. Then, it can convert it into the corresponding plaintext data: d2.

[0124] In summary, the privacy-protecting data provision and query method provided in the embodiments of this specification has the following advantages: 1) It moves the main computational work to the preparation stage, thereby avoiding the large-scale computational load required in the query stage. 2) It introduces an unintentional permutation protocol, so that in the real-time query stage, the client only needs to provide the permutation position of the query position, while the server does not need to perform any encrypted operations, but only performs constant-level computations. This can improve the server's computing performance, thereby improving the practicality of this solution.

[0125] Corresponding to the above-described method for providing privacy-protected data, one embodiment of this specification also provides a privacy-protected data providing device, configured on a server, such as... Figure 3 As shown, the device may include:

[0126] The receiving unit 302 is used to receive first encrypted data from the client during the preparation phase. The first encrypted data is obtained by homomorphically encrypting an n*n-dimensional permutation matrix corresponding to a predetermined permutation rule.

[0127] The acquisition unit 304 is used to obtain a ciphertext sequence composed of n first ciphertexts based on the first plaintext sequence composed of n plaintext data held by the server and the first encrypted data received. The ciphertext sequence corresponds to a second plaintext sequence, and the second plaintext sequence is equivalent to the plaintext sequence obtained by permuting the first plaintext sequence based on a predetermined permutation rule.

[0128] The receiving unit 302 is also used to receive the target location of the target data to be queried from the client during the query phase. The target location is the location after performing a permutation operation on the original location of the target data based on a predetermined permutation rule.

[0129] The reading unit 306 is used to read the target ciphertext at the target location from the ciphertext sequence.

[0130] The sending unit 308 is used to send the target ciphertext to the client.

[0131] In one embodiment, the first encrypted data is an n*n dimensional dense state matrix;

[0132] The acquisition unit 304 is specifically used for:

[0133] Convert the first plaintext sequence consisting of n plaintext data held by the server into an n-dimensional plaintext vector;

[0134] A homomorphic multiplication operation is performed on the n-dimensional plaintext vector and the encrypted matrix to obtain the ciphertext sequence.

[0135] In another embodiment, the first encrypted data includes n second ciphertexts corresponding to each row or column in the permutation matrix;

[0136] The acquisition unit 304 is specifically used for:

[0137] Based on a preset algorithm, each second ciphertext is expanded into n third ciphertexts to form an n*n dimensional secret state matrix, wherein the secret state matrix includes n*n third ciphertexts. The preset algorithm makes the plaintext matrix corresponding to the secret state matrix equivalent to the permutation matrix.

[0138] Convert the first plaintext sequence consisting of n plaintext data held by the server into an n-dimensional plaintext vector;

[0139] The ciphertext sequence is obtained by performing a homomorphic multiplication operation on the n-dimensional plaintext vector and the encrypted matrix.

[0140] Among them, homomorphic encryption is fully homomorphic encryption;

[0141] The acquisition unit 304 is also specifically used for:

[0142] The n plaintext data in the first plaintext sequence are converted into n polynomials, and these n polynomials form an n-dimensional plaintext vector.

[0143] The functions of each functional unit of the apparatus in the above embodiments of this specification can be implemented through the steps of the above method embodiments. Therefore, the specific working process of the apparatus provided in one embodiment of this specification will not be repeated here.

[0144] This specification provides a privacy-protecting data providing device according to one embodiment, which can greatly improve data query efficiency.

[0145] Corresponding to the above-described privacy-protecting data query method, one embodiment of this specification also provides a privacy-protecting data query device, which is set on a client side, such as... Figure 4 As shown, the device may include:

[0146] Construction unit 402 is used to construct an n*n dimensional permutation matrix corresponding to a predetermined permutation rule during the preparation phase.

[0147] Encryption unit 404 is used to perform homomorphic encryption on the permutation matrix to obtain the first encrypted data.

[0148] The sending unit 406 is used to send the first encrypted data to the server.

[0149] The replacement unit 408 is used to perform a replacement operation on the original position of the target data to be queried based on a predetermined replacement rule during the query phase, so as to obtain the target position.

[0150] The sending unit 406 is also used to send the target location to the server.

[0151] The receiving unit 410 is used to receive the target ciphertext read by the server from the ciphertext sequence it holds based on the target location.

[0152] The decryption unit 412 is used to perform homomorphic decryption on the received target ciphertext to obtain the target data.

[0153] In one embodiment, the encryption unit 404 is specifically used for:

[0154] Homomorphic encryption is performed on each element of the permutation matrix to obtain an n*n dimensional dense matrix.

[0155] The n*n dimensional dense state matrix is ​​determined as the first encrypted data.

[0156] In another embodiment, the encryption unit 404 is specifically used for:

[0157] Homomorphic encryption is performed on the permutation matrix according to rows or columns to obtain n second ciphertexts corresponding to each row or column;

[0158] n second ciphertexts are used as the first encrypted data.

[0159] In one embodiment, the client has a pre-configured public and private key corresponding to a homomorphic encryption algorithm; the encryption unit 404 is specifically used for:

[0160] Homomorphic encryption of the permutation matrix is ​​performed using the public key;

[0161] Decryption unit 412 is specifically used for:

[0162] Using the private key, homomorphic decryption is performed on the target ciphertext.

[0163] The functions of each functional unit of the apparatus in the above embodiments of this specification can be implemented through the steps of the above method embodiments. Therefore, the specific working process of the apparatus provided in one embodiment of this specification will not be repeated here.

[0164] This specification provides a privacy-protecting data query device according to one embodiment, which can greatly improve data query efficiency.

[0165] According to another embodiment, a computer-readable storage medium is also provided, on which a computer program is stored, which, when executed in a computer, causes the computer to perform a combination Figure 2 The method described.

[0166] According to another embodiment, a computing device is also provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, it implements a combination... Figure 2 The method described.

[0167] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the medium or device embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0168] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0169] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0170] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or physical entities, or by products with certain functions. A typical implementation device is a server system. Of course, this application does not exclude the possibility that, with the future development of computer technology, the computer implementing the functions of the above embodiments can be, for example, a personal computer, a laptop computer, an in-vehicle human-machine interaction device, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or any combination of these devices.

[0171] While one or more embodiments of this specification provide the operational steps of the methods described in the embodiments or flowcharts, more or fewer operational steps may be included based on conventional or non-inventive means. The order of steps listed in the embodiments is merely one possible order of execution among many steps and does not represent the only possible order. In actual device or end product execution, the methods shown in the embodiments or drawings may be executed sequentially or in parallel (e.g., in a parallel processor or multi-threaded processing environment, or even a distributed data processing environment). The terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, product, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, product, or apparatus. Without further limitations, the presence of other identical or equivalent elements in the process, method, product, or apparatus that includes the elements is not excluded. For example, the use of terms such as "first," "second," etc., is to denote names and does not indicate any particular order.

[0172] For ease of description, the above devices are described in terms of function, divided into various modules. Of course, when implementing one or more of these specifications, the functions of each module can be implemented in one or more software and / or hardware components, or a module that performs the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between devices or units, and may be electrical, mechanical, or other forms.

[0173] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0174] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0175] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0176] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0177] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0178] Computer-readable media include both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage, graphene storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0179] Those skilled in the art will understand that one or more embodiments of this specification can be provided as a method, system, or computer program product. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0180] One or more embodiments of this specification can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a particular task or implement a particular abstract data type. One or more embodiments of this specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0181] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, system embodiments are basically similar to method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments. In the description of this specification, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this specification. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described can be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0182] The above description is merely an embodiment of one or more embodiments of this specification and is not intended to limit the scope of these embodiments. Various modifications and variations can be made to these embodiments by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims.

Claims

1. A method for providing data while protecting privacy, comprising a preparation phase and a query phase; The method is executed via a server and includes: During the preparation phase, first encrypted data is received from the client. This first encrypted data is obtained by homomorphically encrypting an n*n-dimensional permutation matrix corresponding to a predetermined permutation rule. Based on a first plaintext sequence consisting of n plaintext data held by the server and the first encrypted data, a ciphertext sequence consisting of n first ciphertexts is obtained. This ciphertext sequence corresponds to a second plaintext sequence, which is equivalent to the plaintext sequence obtained by permuting the first plaintext sequence based on the predetermined permutation rule. During the query phase, the target location of the target data to be queried is received from the client. This target location is the position after performing a permutation operation on the original position of the target data based on the predetermined permutation rule. The target ciphertext of the target location is read from the ciphertext sequence. The target ciphertext is then sent to the client.

2. The method according to claim 1, wherein, The first encrypted data is an n*n dimensional dense state matrix; The process of obtaining a ciphertext sequence consisting of n first ciphertexts includes: Convert the first plaintext sequence into an n-dimensional plaintext vector; The ciphertext sequence is obtained by performing a homomorphic multiplication operation on the n-dimensional plaintext vector and the encrypted matrix.

3. The method according to claim 1, wherein, The first encrypted data includes n second ciphertexts corresponding to each row or column of the permutation matrix; The process of obtaining a ciphertext sequence consisting of n first ciphertexts includes: Based on a preset algorithm, each second ciphertext is expanded into n third ciphertexts to form an n*n dimensional dense state matrix, wherein the dense state matrix includes n*n third ciphertexts, and the preset algorithm makes the plaintext matrix corresponding to the dense state matrix equivalent to the permutation matrix; Convert the first plaintext sequence into an n-dimensional plaintext vector; The ciphertext sequence is obtained by performing a homomorphic multiplication operation on the n-dimensional plaintext vector and the encrypted matrix.

4. The method according to claim 3, wherein, The homomorphic encryption is fully homomorphic encryption; The step of converting the first plaintext sequence into an n-dimensional plaintext vector includes: The n plaintext data in the first plaintext sequence are converted into n polynomials, and the n polynomials form the n-dimensional plaintext vector.

5. A privacy-preserving data query method, comprising a preparation stage and a query stage; The method is executed via a client and includes: In the preparation stage, an n*n dimensional permutation matrix corresponding to a predetermined permutation rule is constructed, and the permutation matrix is ​​homomorphically encrypted to obtain first encrypted data; the first encrypted data is then sent to the server. During the query phase, based on the predetermined permutation rule, a permutation operation is performed on the original position of the target data to be queried to obtain the target position; the target position is sent to the server; the target ciphertext is received from the server based on the target position and read from its ciphertext sequence; the target ciphertext is homomorphically decrypted to obtain the target data.

6. The method according to claim 5, wherein, The homomorphic encryption of the permutation matrix includes: Homomorphic encryption is performed on each element of the permutation matrix to obtain an n*n dimensional dense matrix. The n*n dimensional dense state matrix is ​​determined as the first encrypted data.

7. The method according to claim 5, wherein, The homomorphic encryption of the permutation matrix includes: Homomorphic encryption is performed on the permutation matrix according to its rows or columns to obtain n second ciphertexts corresponding to each row or column; The n second ciphertexts are identified as the first encrypted data.

8. The method according to claim 5, wherein, The client is pre-configured with a public key and a private key corresponding to a homomorphic encryption algorithm; the homomorphic encryption of the permutation matrix includes: The permutation matrix is ​​homomorphically encrypted using the public key. The homomorphic decryption of the target ciphertext includes: The target ciphertext is homomorphically decrypted using the private key.

9. A computer program product comprising a computer program / instructions that, when executed by a processor, implement the steps of the method of claim 1.

10. A computing device comprising a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method of any one of claims 1-8.

Images