Private information retrieval method and system based on trusted execution environment

Abstract

Aiming at the problems of node string collusion privacy leakage and algorithm security in the existing private information retrieval, the invention provides an efficient private information retrieval method and system based on a trusted execution environment, and the method comprises the following specific steps: (1) generating a random vector and a retrieval vector; (2) constructing a query matrix; (3) encrypting a retrieval vector and a query vector; (4) decryption and verification; and (5) data decoding. Through combination of encryption and a trusted execution environment, a retrieval matrix and a query matrix are protected, and the sequence visibility of the retrieval matrix and the query matrix is kept, so that the privacy security of a user is comprehensively protected. According to the method, the query information is encrypted in the data transmission process, and sensitive information is ensured not to be leaked through the trusted execution environment in the data processing stage, so that a data holder is effectively prevented from acquiring a retrieval condition of a user, and the security of user data privacy is improved.

Description

Technical Field

[0001] The invention relates to a private information retrieval method and system based on a trusted execution environment, and belongs to the field of information retrieval. Background Art

[0002] In today's data-driven environment, private information retrieval technology plays a vital role. In distributed storage systems such as commercial competition, online transactions of digital products, and cloud computing, as the amount of user data continues to increase, protecting user data privacy and security has become an urgent task. The emergence of private information retrieval technology provides an important guarantee for user data privacy and security. It can effectively protect users' query information and prevent data holders from obtaining users' search conditions. Although these technologies bring many advantages, such as protecting user privacy and ensuring data security, they also face some severe challenges. These challenges include comprehensive consideration of data privacy and security, and timely response to new attacks and vulnerabilities. Therefore, the development of private information retrieval technology still needs to continue in-depth research and innovation to cope with the increasingly complex and severe challenges brought by data privacy and security. At present, private information retrieval mainly has the following three problems:

[0003] (1) Node collusion problem: It is usually assumed that storage nodes are honest, ignoring the possible node collusion problem. Collusive nodes may unite to attack or destroy the security of the system, threatening the privacy and data security of users.

[0004] (2) Privacy leakage risk: Some technical solutions have the risk of privacy leakage, especially in the process of searching and accessing encrypted data. Attackers may steal users’ query information or obtain sensitive content of encrypted data by monitoring communications or other means.

[0005] (3) Algorithm security weaknesses: Some technical solutions have security weaknesses in algorithm design or implementation, which allow attackers to exploit these weaknesses to crack encrypted data or perform other malicious actions. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] Figure 1 Diagram of the private information retrieval solution based on a trusted execution environment. Summary of the invention

[0007] In response to the node collusion privacy leakage and algorithm security issues in the existing private information retrieval, this application proposes a private information retrieval method and system based on a trusted execution environment, which encrypts and protects the retrieval matrix and query matrix to address the node collusion problem, and maintains the sequential visibility of the retrieval matrix and query matrix, thereby achieving user privacy security while ensuring retrieval efficiency and reducing communication consumption for uploading and downloading.

[0008] A private information retrieval method based on a trusted execution environment, the specific steps are as follows:

[0009] (1) Generate random vectors and search vectors: The user first generates k random vectors U1, U2, ..., U with length mα k , and k retrieval vectors of length mα, the random matrix U consists of k random vectors, and the retrieval matrix E l It consists of k retrieval vectors of length mα, and the retrieval matrix E l-1 The row vector in is shifted circularly.

[0010] (2) Constructing a query matrix: The user constructs a query matrix and sends it to the storage node for querying. The query matrix sent to node l is Q l .

[0011] (3) Retrieval matrix and query matrix encryption: The retrieval matrix and query matrix are encrypted during transmission.

[0012] (4) Decryption and verification: In the trusted execution environment, the decrypted query matrix and retrieval matrix are sent to the system node. The storage node performs shift and add operations on the data packet stored in itself to generate a new data packet and return it to the user.

[0013] (5) Data decoding.

[0014] Furthermore, in step (3), for the k×mα-dimensional search matrix E l and the query matrix Q l , 1≤l≤N, when encrypting, the security parameter λ∈N, N is the size of the plaintext space, N>0, integer d,n>0, d n ≥N, input is a variable-length reversible pseudo-random function PRF, F:{0,1} λ ×[n]→{0,1} λ , hash function H:{0,1} λ ×{0,1} λ →Z3,π:{0,1} λ ×[n]→[n].

[0015] 3.1 Left encryption: Input key sk = (key1, key2). Where key1 and key2 are two parts of the key sk, and the retrieval matrix sequence E = (E1, ..., E l ,...,E N ), output the left ciphertext matrix C L .

[0016] For the retrieval matrix E l , a random sequence x=π(F(key2,E l-1),E l ), the encrypted ciphertext of the current search vector is The encrypted retrieval matrix Add the left key matrix C L In. E is encrypted by key1 l Then get the ciphertext Then retrieve the symmetric encrypted ciphertext of the matrix sequence Enc indicates symmetric encryption.

[0017] 3.2 Right encryption: Input key sk = (key1, key2), query matrix sequence Q = (Q1, ..., Q l ,...,Q N ), output the right encrypted matrix C R .

[0018] A random sequence y=F(key2,Q l ), calculate z l,j =CMP(j * ,Q l )+(H(F(key1,Q l-1 ||j),y)(mod 3), we get the matrix j is the query matrix Q l The j-th vector of * =π -1 (F(key2,Q l-1 ),j), CMP represents the logical operation of the operator. l Add to the right encryption matrix C R In. Encrypted by key2 Q l Then get the ciphertext Get the symmetric encrypted ciphertext of the retrieval matrix sequence

[0019] 3.3 Comparison function parses the left and right ciphertexts.

[0020] Based on the above method, the present invention further proposes a private information retrieval system based on a trusted execution environment, the system comprising:

[0021] (1) Random vector and search vector generation module. In this module, the user first generates k random vectors U1, U2, ..., U with length mα. k , and k retrieval vectors of length mα, the random matrix U consists of k random vectors, and the retrieval matrix E l It consists of k retrieval vectors of length mα, and the retrieval matrix E l-1 The row vector in is shifted circularly.

[0022] (2) Query matrix construction module: In this module, the user constructs a query matrix and sends it to the storage node for query. The query matrix sent to node l is Q l .

[0023] (3) A retrieval matrix and query matrix encryption module, in which the retrieval matrix and query matrix are encrypted during transmission.

[0024] (4) Decryption and verification module: In this module, in the trusted execution environment, the decrypted query matrix and retrieval matrix are sent to the system node, and the storage node performs shift and add operations on the data packet stored in itself to generate a new data packet and return it to the user.

[0025] (5) Data decoding module.

[0026] Furthermore, in the retrieval matrix and query matrix encryption module, for the k×mα-dimensional retrieval matrix E l and the query matrix Q l , 1≤l≤N, when encrypting, the security parameter λ∈N, N is the size of the plaintext space, N>0, integer d,n>0, d n ≥N, input is a variable-length reversible pseudo-random function PRF, F:{0,1} λ ×[n]→{0,1} λ , hash function H:{0,1} λ ×{0,1} λ →Z3,π:{0,1} λ ×[n]→[n].

[0027] 3.1 Left encryption: Input key sk = (key1, key2), where key1 and key2 are two parts of the key sk, and retrieve matrix sequence E = (E1, ..., E l ,...,E N ), output the left ciphertext matrix C L .

[0028] For the retrieval matrix E l , a random sequence x=π(F(key2,E l-1 ),E l ), the encrypted ciphertext of the current search vector is The encrypted retrieval matrix Add the left key matrix C L In. E is encrypted by key1 l Then get the ciphertext Then retrieve the symmetric encrypted ciphertext of the matrix sequence Enc indicates symmetric encryption.

[0029] 3.2 Right encryption: Input key sk = (key1, key2), query matrix sequence Q = (Q1, ..., Q l ,...,Q N ), output the right encrypted matrix C R .

[0030] A random sequence y=F(key2,Q l ), calculate z l,j =CMP(j * ,Q l )+(H(F(key1,Q l-1 ||j),y)(mod3), we get the matrix C Ql =(z i,1 ,z i,2 ,...,z i,k ), j is the query matrix Q l The j-th vector of * =π -1 (F(key2,Q l-1 ),j), CMP represents the logical operation of the operator. l Add to the right encryption matrix C R In. Encrypted by key2 Q l Then get the ciphertext Get the symmetric encrypted ciphertext of the retrieval matrix sequence

[0031] 3.3 Comparison function parses the left and right ciphertexts.

[0032] Compared with the prior art, the technical advantages of the present invention are:

[0033] (1) Comprehensive protection of user privacy: The present invention combines encryption and a trusted execution environment to protect the retrieval matrix and the query matrix, and maintains the sequential visibility of the retrieval matrix and the query matrix, thereby comprehensively protecting the user's privacy. Compared with traditional private information retrieval technology, the present invention not only encrypts the query information during data transmission, but also ensures that sensitive information is not leaked through a trusted execution environment during the data processing stage. This comprehensive security measure effectively prevents the data holder from obtaining the user's retrieval conditions and improves the security of the user's data privacy.

[0034] (2) Reduce communication consumption and improve efficiency: The present invention adopts sequential visible encryption and trusted execution environment technology to effectively reduce the communication consumption of upload and download while ensuring data privacy and security. Compared with traditional private information retrieval technology, the present application encrypts and protects data during transmission and processing. Due to the sequential visibility of the encrypted retrieval and query matrix, the communication overhead is reduced, the efficiency and performance of the system are improved, and data query and processing are completed more quickly while ensuring user privacy and security, providing users with faster and safer data services. DETAILED DESCRIPTION

[0035] The present invention proposes a private information retrieval method and system based on a trusted execution environment. By combining encryption and a trusted execution environment, the retrieval vector and query matrix are protected to prevent leakage of sensitive information. This technical solution can not only protect the privacy and data security of users, but also reduce the communication consumption of upload and download, and improve the efficiency and performance of the system. The specific steps are:

[0036] (1) Generate random vectors and search vectors:

[0037] The user first generates k random vectors U1, U2, ..., U of length mα k , and generate k retrieval vectors of length mα, which contain the index information of the files to be retrieved. Then the random matrix U consists of k random vectors. For the retrieval matrix E l It is also composed of k search vectors of length mα and can be obtained by E l-1 The row vector in is shifted circularly.

[0038] (2) Construct the query matrix:

[0039] The user constructs a query matrix and sends it to the storage node for query. The query matrix sent to node l is represented as Q l ,The row vector of the query matrix represents the query vector sent by the user to the node in each round of query.

[0040] (3) Retrieval matrix and query matrix encryption:

[0041] To ensure that the retrieval information is invisible, the retrieval matrix is ​​encrypted during transmission. Similarly, the query matrix is ​​also encrypted to ensure the security of the query content. The query matrix received by the storage node and the verification node is also confidential. Only the nodes in the trusted execution environment can decrypt and process the encrypted query matrix, effectively preventing node collusion and sensitive information leakage.

[0042] To prevent the retrieval matrix from being leaked during transmission, the retrieval matrix sequence E generated by the user will be encrypted in step 1. The encrypted retrieval matrix protects the privacy of the user's query content and ensures that sensitive information will not be leaked before being sent to the storage node.

[0043] (4) Decryption and verification:

[0044] In the trusted execution environment, the decrypted query matrix and retrieval matrix are sent to the system node, and the storage node performs shift and add operations on the data packets stored in itself to generate new data packets and return them to the user.

[0045] (5) Data decoding:

[0046] The user decodes the data packet returned from the node, performs corresponding shift-and-add operations based on the elements in the query matrix, and generates a new data packet. For odd-even nodes, the user receives the data packet returned from the check node, and performs corresponding shift-and-add operations to generate a new data packet. Finally, the user decodes the received data packet to obtain the complete content of the file.

[0047] Specifically, for the k×mα-dimensional search matrix E l and the query matrix Q l , where 1≤l≤N, the encryption algorithm is as follows:

[0048] Define security parameter λ∈N, where N is the size of the plaintext space, N>0, and define integer d,n>0, satisfying d n ≥N. Define the input as a variable-length reversible pseudo-random function PRF as F:{0,1} λ ×[n]→{0,1} λ . Hash function H: {0,1} λ ×{0,1} λ →Z3. Secure pseudo-random permutation π:{0,1} λ ×[n]→[n].

[0049] (1) Left encryption algorithm: Input key sk = (key1, key2), search matrix sequence E = (E1, ..., E l ,...,E N ), output the left ciphertext matrix C L .

[0050] Furthermore, for the retrieval matrix E l , a random sequence x=π(F(key2,E l-1 ),E l ), the encrypted ciphertext of the current retrieval matrix is The encrypted retrieval matrix Add the left key matrix C L In addition, E is encrypted by key1 l for Get the symmetric encrypted ciphertext of the retrieval matrix sequence

[0051]

[0052] (2) Right encryption algorithm: Input key sk = (key1, key2), query matrix sequence Q = (Q1, ..., Q l ,...,Q N ), output the right encrypted matrix C R .

[0053] Specifically, a random sequence y=F(key2,Q l ), for the current query matrix Q l Calculate z l,j =CMP(j * ,Q l )+(H(F(key1,Q l-1 ||j),y)(mod3), we get the matrix C Ql =(z i,1 ,z i,2 ,...,z i,k ), where j represents the query matrix Q l The jth vector of * =π -1 (F(key2,Q l-1 ),j), CMP represents the logical operation of the operator. l Add the right encryption matrix C R In addition, Q is encrypted by key2 l for Get the symmetric encrypted ciphertext of the retrieval matrix sequence Enc indicates symmetric encryption.

[0054] (3) The comparison function parses the left and right ciphertexts to make the order of the retrieval ciphertext and the query ciphertext transparent, that is, the order of the ciphertext can be determined without completing the decryption. When the subsequent nodes perform the shift operation on the ciphertext, the corresponding ciphertext can be directly used for decryption, saving time.

[0055] (4) Decryption algorithm: The key sk = (key1, key2) and the ciphertext C E , C Q As input, output their respective plaintext Where Dec is the decryption algorithm.

[0056] A more specific embodiment:

[0057] First, the user needs to generate random vectors and search vectors. Assume that the user generates a random matrix The search matrix is:

[0058]

[0059] Next, the user constructs a query matrix sequence Q and sends it to the storage node for query. The row vector of the query matrix sequence Q represents the query vector sent by the user to the node in each round of query. According to the rule, the query matrix Q1 = U, Q2 = U, Q3 = U + E3, Q4 = U + E4, Q5 = U + E5 is sent to nodes 1-5 respectively.

[0060] During the encryption process, the left encryption algorithm and the right encryption algorithm encrypt the retrieval matrix and the query matrix respectively. The left encryption algorithm uses PRF to generate a random sequence and encrypts the current retrieval vector to obtain an encrypted retrieval matrix. The right encryption algorithm also uses PRF to generate a random sequence and encrypts the current query matrix to obtain an encrypted query matrix. These encrypted matrices protect the user's privacy information and ensure the security of data during transmission.

[0061] Specifically, assuming key1 = 0x2b7e151628aed2a6abf7158809cf4f3c, key2 = 0x3ad77bb40d7a3660a89ecaf32466ef97, for the retrieval matrix Query Matrix After completing the left and right encryption, they are C E3 =0x3f8a59e1c24d4871a9252c6b11de99a7. The two ciphertexts are used as the input of the comparison algorithm to compare the two ciphertexts to see if there is a difference in the position bit values ​​in the ciphertexts, thereby ensuring sequential visibility. The algorithm ensures the secure transmission of the query content. The query matrix received by the storage node and the verification node is confidential. Only the nodes in the trusted execution environment can decrypt and process the query matrix, which effectively prevents node collusion and information leakage.

[0062] Specifically, symmetric encryption is used to encrypt E3 and Q3 to obtain the ciphertext and

[0063]

[0064] Finally, in a trusted environment, the user sends the decrypted query matrix and retrieval matrix to the system node. The storage node retrieves data based on the query matrix and generates a new data packet and returns it to the user. The user decodes the returned data packet and performs corresponding shift and add operations based on the elements in the query matrix, and finally obtains the complete file content.

[0065] Compared with the prior art, the technical means of the present invention reduces redundant data transmission, and the size of each query transmission data is greatly reduced. At the same time, the encrypted retrieval matrix and query matrix have sequential visibility, which can reduce communication overhead and shorten user waiting time.

[0066] Through the above examples, we can clearly understand the specific implementation process and steps of the secure private information retrieval solution. This solution not only ensures the confidentiality and integrity of the data, but also has strong sequential visibility, can effectively deal with security threats such as data leakage and node collusion, and provides reliable protection for users' privacy information.

[0067] The units, devices or modules described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. For the convenience of description, the above devices are described separately by functions divided into various modules. Of course, when implementing this application, the functions of each module can be implemented in the same or more software and / or hardware, or the modules that implement the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the coupling or direct coupling or communication connection between each other shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0068] Those skilled in the art also know that, in addition to implementing the controller in a purely computer-readable program code, the controller can be made to implement the same function in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, such a controller can be considered as a hardware component, and the devices for implementing various functions included therein can also be considered as structures within the hardware component. Or even, the devices for implementing various functions can be considered as both software modules for implementing the method and structures within the hardware component.

[0069] The present application may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, classes, etc. that perform specific tasks or implement specific abstract data types. The present application may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0070] It can be known from the description of the above implementation methods that those skilled in the art can clearly understand that the present application can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present application can be essentially or partly contributed to the prior art in the form of a software product, which can be stored in a storage medium such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes several instructions for enabling a computer device (which can be a personal computer, a mobile terminal, a server, or a network device, etc.) to execute the methods described in the various embodiments of the present application or certain parts of the embodiments.

[0071] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld devices or portable devices, tablet devices, multi-processor systems, microprocessor-based systems, set-top boxes, programmable electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc.

[0072] The specific embodiments described above further illustrate the purpose, technical solutions and beneficial effects of the present application. It should be understood that the above description is only a specific embodiment of the present application and is not intended to limit the scope of protection of the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application.

Claims

1. A private information retrieval method based on a trusted execution environment, characterized in that: (1) Generate random vectors and search vectors: The user first generates k random vectors U1, U2, ..., U with length mα k , and k retrieval vectors of length mα, the random matrix U consists of k random vectors, and the retrieval matrix E l It consists of k retrieval vectors of length mα, and the retrieval matrix E l-1 The row vector in is shifted circularly; (2) Constructing a query matrix: The user constructs a query matrix and sends it to the storage node for querying. The query matrix sent to node l is Q l ; (3) Retrieval matrix and query matrix encryption: The retrieval matrix and query matrix are encrypted during transmission; (4) Decryption and verification: In the trusted execution environment, the decrypted query matrix and retrieval matrix are sent to the system node. The storage node performs shift and add operations on the data packets stored in itself to generate a new data packet and return it to the user. (5) Data decoding.

2. A private information retrieval method based on a trusted execution environment as claimed in claim 1, characterized in that: In step (3), for the k×mα-dimensional search matrix E l and the query matrix Q l , 1≤l≤N, when encrypting, the security parameter λ∈N, N is the size of the plaintext space, N>0, integer d,n>0, d n ≥N, input is a variable-length reversible pseudo-random function PRF, F:{0,1} λ ×[n]→{0,1} λ , hash function H:{0,1} λ ×{0,1} λ →Z3,π:{0,1} λ ×[n]→[n]. 3.1 Left encryption: Input key sk = (key1, key2), where key1 and key2 are two parts of the key sk, and retrieve matrix sequence E = (E1, ..., E l ,...,E N ), output the left ciphertext matrix C L ; For the retrieval matrix E l , a random sequence x=π(F(key2,E l-1 ),E l ), the encrypted ciphertext of the current search vector is The encrypted retrieval matrix Add the left key matrix C L In. E is encrypted by key1 l Then get the ciphertext Then retrieve the symmetric encrypted ciphertext of the matrix sequence Enc means symmetric encryption; 3.2 Right encryption: Input key sk = (key1, key2), query matrix sequence Q = (Q1, ..., Q l ,...,Q N ), output the right encrypted matrix C R ; A random sequence y=F(key2,Q l ), calculate z l,j =CMP(j * ,Q l )+(H(F(key1,Q l-1 ||j),y)(mod 3), we get the matrix j is the query matrix Q l The j-th vector of * =π -1 (F(key2,Q l-1 ),j), CMP represents the logical operation of the operator. l Add to the right encryption matrix C R In. Encrypted by key2 Q l Then get the ciphertext Get the symmetric encrypted ciphertext of the retrieval matrix sequence 3.3 Comparison function parses the left and right ciphertexts.

3. A private information retrieval system based on a trusted execution environment, characterized in that: The system includes: (1) Random vector and retrieval vector generation module. In this module, the user first generates k random vectors U1, U2, ..., U with a length of mα. k , and k retrieval vectors of length mα, the random matrix U consists of k random vectors, and the retrieval matrix E l It consists of k retrieval vectors of length mα, and the retrieval matrix E l-1 The row vector in is shifted circularly; (2) Query matrix construction module: In this module, the user constructs a query matrix and sends it to the storage node for query, where the query matrix sent to node l is Q l ; (3) a retrieval matrix and query matrix encryption module, in which the retrieval matrix and query matrix are encrypted during transmission; (4) Decryption and verification module, in which the decrypted query matrix and retrieval matrix are sent to the system node in the trusted execution environment, and the storage node performs shift and add operations on the data packets stored in itself to generate a new data packet and return it to the user; (5) Data decoding module.

4. A private information retrieval system based on a trusted execution environment as claimed in claim 3, characterized in that: In the retrieval matrix and query matrix encryption module, for the k×mα-dimensional retrieval matrix E l and the query matrix Q l , 1≤l≤N, when encrypting, the security parameter λ∈N, N is the size of the plaintext space, N>0, integer d,n>0, d n ≥N, input is a variable-length reversible pseudo-random function PRF, F:{0,1} λ ×[n]→{0,1} λ , hash function H:{0,1} λ ×{0,1} λ →Z3,π:{0,1} λ ×[n]→[n]. 3.1 Left encryption: Input key sk = (key1, key2), where key1 and key2 are two parts of the key sk, and retrieve matrix sequence E = (E1, ..., E l ,...,E N ), output the left ciphertext matrix C L ; For the retrieval matrix E l , a random sequence x=π(F(key2,E l-1 ),E l ), the encrypted ciphertext of the current search vector is The encrypted retrieval matrix Add the left key matrix C L In. E is encrypted by key1 l Then get the ciphertext Then retrieve the symmetric encrypted ciphertext of the matrix sequence Enc means symmetric encryption; 3.2 Right encryption: Input key sk = (key1, key2), query matrix sequence Q = (Q1, ..., Q l ,...,Q N ), output the right encrypted matrix C R ; A random sequence y=F(key2,Q l ), calculate z l,j =CMP(j * ,Q l )+(H(F(key1,Q l-1 ||j),y)(mod 3), we get the matrix j is the query matrix Q l The j-th vector of * =π -1 (F(key2,Q l-1 ),j), CMP represents the logical operation of the operator. l Add to the right encryption matrix C R In. Encrypted by key2 Q l Then get the ciphertext Get the symmetric encrypted ciphertext of the retrieval matrix sequence 3.3 Comparison function parses the left and right ciphertexts.

Images