Privacy information retrieval method based on NTRU homomorphic outer product

Abstract

The invention provides an NTRU homomorphic outer product-based privacy information retrieval method, which comprises the following steps of: firstly, regarding a database as a v + 1-dimensional hypercube, generating a corresponding query tuple (i, j1, j2,..., jv) by a user according to a query index idx, carrying out compression coding and encryption on the query tuple to obtain an RLWE ciphertext cquery serving as a query, sending the ciphertext cquery to a server, and sending the RLWE ciphertext cquery to the server; the server expands the cquery into v + 1 groups of ciphertexts CTNtru, CTNtruGSW, 0, CTNtruGSW, 1,..., CTNtruGSW and v-1 based on a ciphertext inquiry expansion algorithm, NTRU homomorphic outer product calculation is adopted according to a hypercube form of a database, a ciphertext response result credit is generated and sent to the user, and the user recovers a result didx by adopting an NTRU decryption algorithm. According to the scheme, the hidden query of the database data records is realized, the complexity of a ciphertext query vector extension algorithm is reduced, and the throughput and query calculation efficiency of privacy information retrieval are improved.

Description

Technical Field

[0001] The present invention relates to the field of privacy computing technology, and in particular to a privacy information retrieval method based on NTRU homomorphic outer product. Background Art

[0002] Private information retrieval (PIR) is a special-purpose cryptographic protocol that allows a client to query a record with index index in the database of a server. index , but does not disclose to the database server which record is being queried. Privacy information retrieval is an important key technology in privacy computing and can be applied to scenarios such as database hidden query, anonymous information transmission, contact discovery, contact tracking, privacy-preserving navigation, and secure browsing.

[0003] Privacy information retrieval protocols are mainly divided into information-theoretically secure privacy information retrieval protocols and computationally secure privacy information retrieval protocols. The computationally secure PIR protocol database is stored on a single server and is constructed based on mathematically difficult problems. It is also called a single-server PIR protocol. Fully homomorphic encryption has ciphertext computing capabilities and can perform ciphertext computing on queries and database records. The calculation results are also encrypted, which is very suitable for designing computationally secure privacy information retrieval protocols and can effectively reduce the number of interaction rounds and communication volume. Privacy information retrieval protocols constructed based on fully homomorphic encryption belong to computationally secure privacy information retrieval protocols. In 2009, Gentry of Stanford University proposed the first PIR protocol based on fully homomorphic encryption, which achieved sublinear communication complexity, but the execution efficiency was very low due to bit-by-bit homomorphic computing.

[0004] From 2012 to 2016, the efficiency of fully homomorphic encryption has been greatly improved, especially the performance of schemes such as BGV and BFV constructed based on the RLWE mathematical difficulty problem is outstanding, which has brought rapid development to the practical design of the PIR protocol. In 2016, Melchor et al. adopted a homomorphic encryption scheme based on RLWE to design an efficient and usable privacy information retrieval protocol XPIR, and implemented the protocol based on the HElib library. At present, most of the high-efficiency PIR protocols based on fully homomorphic encryption are based on the XPIR protocol framework, but the query request of the XPIR scheme contains a ciphertext vector with the same dimension size as the database size, resulting in a large query communication overhead. In 2018, Angel et al. designed a privacy information retrieval protocol SealPIR with a smaller query size based on the BFV homomorphic encryption scheme, encoding the query index index as a monomial x index, and then homomorphically encrypt it to obtain the ciphertext query, and the query size is compressed to 0.36% of the XPIR scheme. In order to shorten the response size, in 2021, Mughees et al. designed an efficient single-server privacy information query protocol OnionPIR under the basic framework of SealPIR. This protocol makes full use of the outer product of RLWE ciphertext and RGSW ciphertext, and has the advantage of a small noise growth rate, which makes the parameter setting of the scheme smaller. In 2022, Menon et al. integrated two lattice-based homomorphic encryption schemes and designed a fast and high-percentage single-server privacy information retrieval protocol cluster, mainly including SPIRAL, SPIRALSTREM and SPIRALPACK schemes. The SPIRAL protocol family uses the matrix Regev scheme and the GSW scheme, and introduces a new ciphertext conversion method, while achieving improvements in server throughput and response ratio.

[0005] It can be seen that the efficient mainstream privacy information retrieval scheme mainly involves key technologies such as ciphertext query compression and expansion technology, homomorphic outer product, and is mainly constructed with RLWE / LWE as a mathematically difficult problem. The existing technical solutions have problems such as complex ciphertext query expansion, high query calculation overhead, and heterogeneous ciphertext conversion requiring additional auxiliary information, as follows:

[0006] (1) The ciphertext query expansion is complex. Currently, SealPIR, OnionPIR, SPIRAL and other solutions use a coefficient extraction algorithm based on homomorphic computing. The ciphertext query vector is obtained through a certain number of cyclic iterative expansions. This expansion is relatively complex and the ciphertext noise increases significantly.

[0007] (2) The query computation overhead is large. The homomorphic inner product of solutions such as OnionPIR and SPIRAL is based on the RLWE or LWE mathematical difficulty problem. The ciphertext size is large, and the homomorphic computation process consumes a lot of polynomial computations.

[0008] (3) Heterogeneous ciphertext conversion is difficult. When schemes such as OnionPIR and SPIRAL use homomorphic inner products, the query must be converted from BFV / Regev ciphertext to GSW ciphertext. The private key needs to be encrypted using the GSW homomorphic encryption scheme, and the ciphertext of the private key needs to be sent to the server, which increases the communication overhead during the query. Summary of the invention

[0009] In response to the above problems, the present invention proposes a privacy information retrieval method based on NTRU homomorphic outer product, which adopts polynomial coefficient extraction, NTRU symmetric homomorphic encryption, NTRU homomorphic outer product and other technologies to realize hidden query of database data records, reduce the complexity of ciphertext query vector expansion algorithm, and improve the throughput and query calculation efficiency of privacy information retrieval. It has the characteristics of high computing efficiency, low communication volume and large data scale.

[0010] The present invention proposes a privacy information retrieval method based on NTRU homomorphic outer product, comprising:

[0011] Step 1: User User calls the RLWE scheme, NteuSHE scheme and NtruGSW scheme respectively according to the security parameter λ, and generates the parameters of the RLWE scheme, NtruSHE scheme and NtruGSW scheme: Params RLWE ←RLWE.Setup(1 λ ), Params NtruSHE ←NtruSHE.Setup(1 λ ), Params NtruGSW ←NtruGSW.Setup(1 λ );

[0012] Step 2: User User generates private keys s, f and ciphertext conversion keys w, K according to the RLWE scheme, NtruSHE scheme and conversion key generation algorithms RlweToNtruKeyGen() and LweToRlweKeyGen(), s←RLWW.KeyGen(Params RLWE )、f←NtruSHE.KeyGen(Params NtruSHE ), w←RlweToNtruKeyGen(s, f, B w ), K←LweToRlweKeyGen(s), and determine the parameter v according to the database size 1 and v, the user User will be the parameters Params RLWE 、Params NtruSHE 、Params NtruGSW , ciphertext conversion key public key w, K, and parameter v 1 and v are sent to the server;

[0013] Step 3: User User calls the query tuple generation algorithm based on the plaintext query index idx to generate a query tuple (i, j 1 , j 2 , ..., j v )←QueryTupleGen(idx);

[0014] Step 4: Input the private key s and call the ciphertext query generation algorithm to generate the ciphertext query c from the query tuple query ←EncQueryGen(s,(i,j 1 , j 2 , ..., j v )), and ask c for the ciphertext query Send to the server;

[0015] Step 5: The server receives the ciphertext query c query After that, from c query =(c 0 , c 1 ) to extract N LWE ciphertexts:

[0016] c LWE,i =(c 0，i , ρ i (c 1 )), i = 0, 1, ..., N-1

[0017] Where N is the dimension of the ring R polynomial, c 0，i Represents the polynomial c 0 The coefficient of the i-th term, ρ i is a transformation function that can transform the polynomial b=b 0 +b 1 x+…+b N-1 x N-1 Convert to an N-dimensional vector (b i , b i-1 , …, b 0 , -b N-1 , -b N-2 , ..., -b i+1 ).

[0018] Then input the conversion key K and w to call the ciphertext conversion algorithm LweToRlwe() and RlweToNtru() in turn to convert the LWE ciphertext into RLWE ciphertext, and then further convert it into NtruSHE ciphertext:

[0019] ct RLWE,i ←LweToRlwe(K,C LWE,i ), i = 0, 1, ..., N-1

[0020] C Ntru，i ←RlweToNtru(w,ct RLWE,i ), i = 0, 1, ..., N-1;

[0021] Step 6: The server divides the N NtruSHE ciphertexts into v+1 groups, the first group is Convert ciphertext groups other than group 1 to NtruGSW ciphertext groups by calling the algorithm NtruSHEToGSW():

[0022]

[0023] CT NtruGSW,k =(c NtruGSW,k , gC NtruGSW,k mod q)

[0024] Where k = 0, 1, ..., v-1, l = "log B q], g is the tool vector, q is the ciphertext modulus;

[0025] Step 7: The server performs the cipher query calculation, first using the first group of ciphertext CT Ntru Process the first dimension database records, let n represent the number of database data records, for Among them, NtruSHE.MultPlain() is the homomorphic plaintext multiplication, and the addition of the summation symbol uses the homomorphic addition method NtruSHE.Add(), and then CT NtruGSW,0 , CT NtruGSW,1 ,…,CT NtruGSW,v-1 Process the records of subsequent dimensions of the database and initialize For k = 0, 1, ..., v-1, the loop iterates as follows:

[0026] (1) Set num = num / 2;

[0027] (2) For h = 0, 1, ..., num-1, Among them, g is the tool vector, B is the base, Represents the NTRU homomorphic outer product operation;

[0028] (3) As a result of the calculation, it enters the next round of loop iteration;

[0029] After completing v iterations, output is the output of the last iteration, the server will c respond Send to user User;

[0030] Step 8: The user receives c respond , input the private key f, and decrypt the result d according to the NTRU decryption algorithm idx ←NtruSHE.Dec(f,c respond ).

[0031] Furthermore, the RLWE scheme in step 1 is a symmetric homomorphic encryption scheme based on RLWE, including:

[0032] System establishment algorithm RLWE.Setup(1 λ ): Input security parameter λ, let distribution χ key Represents the distribution of the key, and generates parameters Params according to the decision-type RLWE problem RLWE =(N, q, σ, B, l, t, Δ), so that the complexity of solving the difficult problem is not less than 2 λ , where N represents an integral ring The degree of the generating polynomial, q represents the ciphertext modulus, σ represents the standard deviation of the discrete Gaussian distribution, B represents the basis of the tool vector, t represents the plaintext modulus,

[0033] Key generation algorithm RLWE.KeyGen(Params RLWE ): Input parameters Params RLWE , in the ternary {-1,0,1} distribution Randomly select s from the above, let the key be sk=s∈R, where

[0034] Encryption algorithm RLWE.Enc(sk, m): Input plaintext m∈R t , in random R q Randomly select an element a←R q , in the discrete Gaussian distribution Randomly select e from above, calculate and output the ciphertext in

[0035] Decryption algorithm RLWE.Dce(sk,ct): Input ciphertext ct = (c 0 , c 1 ) and the decryption key sk, calculate and output

[0036] Furthermore, the NtruSHE scheme in step 1 is a symmetric homomorphic encryption scheme based on NTRU, including:

[0037] System establishment algorithm NtruSHE.Setup(1 λ ):Input the security parameter λ, according to the decisional NTRU problem Decisional_NTRU N，q，σ , generate parameters Params NtruSHE=(N, q, σ, B, l, t, Δ), so that the complexity of solving the difficult problem is not less than 2 λ , where N represents an integral ring The degree of the generating polynomial, q represents the ciphertext modulus, σ represents the standard deviation of the discrete Gaussian distribution, B represents the basis of the tool vector, t represents the plaintext modulus,

[0038] Key generation algorithm NtruSHE.KeyGen(Params NtruSHE ): Input parameters Params NtruSHE , randomly selected Calculate f = t·f′+1, determine whether f is reversible, if not, reselect f′ until f is reversible, and output the key sk = f;

[0039] Encryption algorithm NtruSHE.Enc(sk, m): Input plaintext m∈R t , in the discrete Gaussian distribution Randomly select u from the above, calculate and output the ciphertext ct = u sk -1 +Δ·m mod q;

[0040] Decryption algorithm NtruSHE.Dec(sk, ct): Input ciphertext ct and decryption key sk, calculate and output

[0041] In order to speed up the calculation efficiency of homomorphic multiplication and homomorphic outer product, sometimes it is not necessary to make the ciphertext decryptable, but just use the ciphertext as an intermediate output process. In this case, the following method can be used to encrypt the plaintext:

[0042] Encoding algorithm NtruSHE.Encode(sk,m): Input plaintext m∈R t , in the discrete Gaussian distribution Randomly select u from above and calculate the ciphertext ct = u sk -1 +m mod q;

[0043] Homomorphic addition NtruSHE.Add(ct 0 , ct 1 ): Enter two ciphertexts ct 0 ,ct 1 ∈R q , calculate and output ct Add =ct 0 +ct 1 mod q;

[0044] Homomorphic plaintext addition NtruSHE.AddPlain(ct,pt): Input ciphertext ct∈R q and a plaintext pt∈R t , calculate and output ct MultPlain = ct + Δ·pt mod q;

[0045] Homomorphic plaintext multiplication NtruSHE.MultPlain(ct, pt): Input ciphertext ct∈R q and a plaintext pt∈R t , calculate and output ct MultPlain =ct·pt mod q.

[0046] Furthermore, the NtruGSW scheme in step 1 is a GSW-type symmetric Boolean homomorphic encryption scheme based on NTRU, including:

[0047] Given a basis B, let Introduce tool vector g and tool matrix G, Definition -1 Transformation: For a∈R q , decompose it with B as the basis in a i ∈R B , g T g -1 (a) = a;

[0048] System establishment algorithm NtruGSW.Setup(1 λ ):Input the security parameter λ, according to the decisional NTRU problem Decisional_NTRU N，q，σ , generate parameters Params NtruGSW =(N, q, σ, B, l, t, Δ), so that the complexity of solving the difficult problem is not less than 2 λ ,in

[0049] Key generation algorithm NtruGSW.KeyGen(Params NtruGSW ): Input parameters Params NtruGSW , randomly selected Calculate f = tf′ + 1, determine whether f is reversible, if not, reselect f′ until f is reversible, and set the key sk = f;

[0050] Encryption algorithm NtruGSW.Enc(sk,m): Input plaintext polynomial m∈{0,1}, in l identical discrete Gaussian distributions Randomly select a l-dimensional vector u=(u 0 ,u 1 , ..., u l-1 ), calculate and output the ciphertext c = u·f -1 +Δ·m·g;

[0051] Decryption algorithm NtruGSW.Dec(sk, c): Input ciphertext c and private key sk, calculate By getting the 0th element of vector m, we can recover the message m=m[0];

[0052] In order to speed up the calculation efficiency of homomorphic multiplication and homomorphic outer product, sometimes it is not necessary to make the ciphertext decryptable, but just use the ciphertext as an intermediate output process. In this case, the following method can be used to encrypt the plaintext:

[0053] Encoding algorithm NtruGSW.Encode(sk,m): Input plaintext polynomial m∈{0,1}, in l identical discrete Gaussian distributions Randomly select a l-dimensional vector u=(u 0 ,u 1 , ..., u l-1 ), calculate and output the ciphertext c = u·f -1 +mg;

[0054] Homomorphic addition NtruGSW.Add(c 0 , c 1 ): Enter two ciphertexts Calculate and output c Add =c 0 +c 1 mod q, where That is, 1 R q The Cartesian direct product of

[0055] Homomorphic plaintext addition NtruGSW.AddPlain(c, pt): input ciphertext and a plaintext pt∈{0,1}, calculate and output c AddPlain = c + Δ·pt·g mod q;

[0056] Homomorphic complement operation NtruGSW.comple(c): input ciphertext Calculate and output c comple =gc mod q.

[0057] Furthermore, the conversion key generation algorithm RlweToNtruKeyGen() in step 2 is the conversion of RLWE ciphertext to NtruSHE ciphertext, including:

[0058] The RLWE ciphertext is in the form of Where s is the private key of the RLWE ciphertext, and a is randomly and uniformly selected from R q , e randomly sampled from the distribution Plaintext m belongs to R t In order to convert RLWE ciphertext into NtruSHE ciphertext, a conversion key w is required. The conversion key generation algorithm RlweToNtruKeyGen() is:

[0059] Let f denote the private key of the NtruSHE scheme, B w Indicates conversion base;

[0060] Input the private key s of the RLWE ciphertext, the private key f of the NtruSHE scheme, and the conversion basis B w ,make Transformation key generation algorithm RlweToNtruKeyGen(s, f, B w )for:

[0061] (1) In distribution Randomly select a w dimensional vector u w ;

[0062] (2) Let l w Dimensional Tools Vector

[0063] (3) Calculate and output the conversion key w = (w 0 , w 1 ,…,w l-1 )=u w ·f -1 +s·g w mod q;

[0064] Input RLWE ciphertext ct RLWE And the conversion key w, the conversion algorithm from RLWE ciphertext to NtruSHE ciphertext RlweToNtru(w, c RLWE )for:

[0065] (1) For the RLWE ciphertext component c RLWE，1 Base B w Decomposition in Indicates that the output data is B w Decomposition by base;

[0066] (2) Calculate and output

[0067] The conversion key generation algorithm LweToRlweKeyGen() in step 2 is a conversion key generation algorithm from LWE ciphertext to RLWE ciphertext, including:

[0068] K←KSKeyGen(s, s′): Randomly select an l-dimensional vector k 1 , in the distribution Randomly sample an l-dimensional vector e and calculate k 0 =-k 1 ·s′+g·s+emod q, output the transformation key of RLWE ciphertext

[0069] K←LweToRlweKeyGen(s): Since s is a polynomial, for i=2, 3, ..., l-1, let s (i) =s(x i ), call K i =KSKeyGen(s, s′), then the conversion key from LWE ciphertext to RLWE ciphertext is K={K 2 , K 3 , ..., K l-1}.

[0070] Furthermore, the query tuple generation algorithm in step 3 is specifically as follows:

[0071] Suppose the database server stores a database DB with n records. 0 , d 1 , ..., d n-1}, let the private information query index be idx, that is, the query object be d idx , consider the database as a hypercube in v+1 dimensional space That is, the number of the first dimension is The number of dimensions from 2 to v+1 is 2, and the parameters v and v 1 Set according to database size and specific needs;

[0072] Assume the query index idx∈{0, 1, ..., n-1}, then the query tuple generation algorithm QueryTupleGen() is:

[0073] (1)

[0074] (2) tmp = idx - i 2 v :

[0075] (3) For k = 1, 2, ..., v, execute:

[0076] ①

[0077] ②tmp=tmp-j k 2 v-k ;

[0078] Finally, the query tuple (i, j 1 , j 2 , ..., j v ),in j 1 , j 2 , ..., j v ∈{0, 1}.

[0079] Furthermore, the ciphertext query generation algorithm in step 4 is specifically:

[0080] The query tuple (i, j 1 , j 2 , ..., j v ) is embedded into the plaintext polynomial μ(x)=μ 0 +μ 1 x+…+μ N-1 x N-1 In the h j k , h=0,1,…,l-1,k=1,2,…,v,the ciphertext query generation algorithm EncQueryGen() is:

[0081] Input RLWE private key s and query tuple (i, j 1 , j 2 , ..., j v );

[0082] Output: RLWE ciphertext

[0083] Let μ(x) = Δ·x i ;

[0084] For k = 1, 2, ..., v, execute:

[0085]

[0086] Output RLWE ciphertext c query =RLWE.Enc(s,μ(x)).

[0087] Furthermore, the ciphertext query expansion algorithm in step 5 specifically includes:

[0088] Let the vector polynomial b = b 0 +b 1 x+…+b N-1 x N-1 ∈Rq , whose coefficient vector is (b 0 , b 1 , …, b N-1 ), define the transformation ρ i (b)=(b i , b i-1 , ..., b 0 , -b N-1 , -b N-2 , ..., -b i+1 ), which is equivalent to reversely flipping the 0th to ith consecutive elements of the coefficient vector of the polynomial b, and reversely flipping the i+1th to N-1th consecutive elements, outputting a N-1 dimensional vector on ;

[0089] Let the input be a RLWE ciphertext query c query =RLWE.Enc(s,μ(x))=(c 0 , c 1 )=(-as+e+Δ·μ(x),a), where plaintext μ(x)=μ 0 +μ 1 x+…+μ N-1 x N-1 , use vector s to represent the coefficient vector of the key, C 0，i Represents R q Polynomial element c over the ring 0 The coefficient of the i-th order term, and then directly from c RLWE The LWE ciphertext of the plaintext polynomial coefficients is extracted as follows:

[0090] LWE.Enc(s,μ i )=(c 0，i , ρ i (c 1 )), i = 0, 1, ..., N-1

[0091] By adopting the LWE ciphertext to RLWE ciphertext conversion technology, LWE.Enc(s, μ i ) is converted to RLWE ciphertext with key s. This conversion requires the conversion key K←LweToRlweKeyGen(s). Let the conversion algorithm be LweToRlwe(), then:

[0092] ct RLWE,i ←LweToRlwe(K,LWE.Enc(s,μ i )), i = 0, 1, ..., N-1

[0093] ct RLWE,i is a pair coefficient μ i Encrypted RLWE ciphertext, ctRLWE,i =RLWE.Enc(s,μ i ), i = 0, 1, ..., N-1, and then call the RLWE ciphertext to NtruSHE ciphertext conversion algorithm RlweToNtru(), input the conversion key w, and generate a set of NtruSHE ciphertext: C Ntru，i ←RlweToNtru(w,ct RLWE,i ), i = 0, 1, ..., N-1, the result of the calculation is the ciphertext C Ntru,i is the coefficient μ i NtruSHE ciphertext;

[0094] The ciphertext conversion algorithm LweToRlwe() includes:

[0095] ct′←KeySwitch(ct, K): Input a RLWE ciphertext Convert the key K, calculate and output the ciphertext ct′=(c 0 ,0)+g -1 (c 1 )·K mod q;

[0096] ct′←EvalAuto(ct, i, K): Input a RLWE ciphertext Conversion key K = {K 2 , K 3 , ..., K l-1}, an integer i, calculate and output ct′=KeySwitch(ct, K i );

[0097] ct RLWE ←LweToRlwe(C LWE , K): Input a LWE ciphertext where a=(a 0 , a 1 , ..., a N-1 ), convert a into a polynomial Let the initial ciphertext ct = (b, a), for k = 1, 2, ..., log 2 N, iterative calculation After the iteration is completed, output

[0098] Furthermore, the algorithm NtruSHEToGSW() in step 6 constructs NtruGSW ciphertext based on NtruSHE ciphertext group, including:

[0099] Let the plaintext m∈{0,1}, input l NtruSHE encryption codes: ct 0 =NtruSHE.Encode(B 0,m)、ct 1 =NtruSHE.Encode(B,m),…,ct l-1 =NtruSHE.Encode(B l-1 , m), then the algorithm NtruSHEToGSW() is:

[0100]

[0101] Furthermore, the NTRU homomorphic outer product operation in step 7 is:

[0102]

[0103] Let an NtruSHE ciphertext ct∈R q It is the message 0 ∈{0,1} encryption, that is, ct = NtruSHE.Enc(sk,m 0 ), a NtruGSW ciphertext It is the message 1 ∈{0,1} encryption code, that is, c=NtruGSW.Encode(sk,m 1 ), NTRU homomorphic outer product Output an NtruSHE ciphertext, set to ct ExPorduct , and is the message m 0 m 1 mod t encryption, when m 1 =0, ct ExPorduct The noise has nothing to do with ct.

[0104] Privacy information retrieval is an important key technology in privacy computing. It can protect users' query behaviors and prevent service libraries from mastering users' query results. It has become an indispensable technology in privacy computing platforms and has wide application value. The present invention aims at the problems existing in privacy information retrieval protocols, such as complex ciphertext query expansion, large query calculation overhead, and difficulty in heterogeneous ciphertext conversion. A privacy information retrieval method based on NTRU homomorphic outer product is proposed. The method mainly adopts a coefficient direct extraction method to extract the LWE encryption of each coefficient of the plaintext polynomial from the RLWE ciphertext, thereby achieving more efficient ciphertext query expansion, and adopts NTRU symmetric homomorphic encryption and NTRU homomorphic outer product to perform encrypted query calculation, thereby reducing memory space consumption and improving query calculation efficiency. The present invention first regards a database of size n as a v+1-dimensional hypercube, that is, The size of the first dimension is The remaining dimensions have scale 2, where v 1 It is usually set to 128, and the user User generates the corresponding query tuple (i, j) from the query index idx.1 , j 2 , ..., j v ), compress and encrypt the query tuple to obtain a RLWE ciphertext c as the query query , the ciphertext c query Sent to the server, the server will use the ciphertext query expansion algorithm to query Expanded to v+1 groups of NtruSHE ciphertext, further calling the NtruSHEToGSW algorithm to convert to CT Ntru , CT NtruGSW,0 , CT NtruGSW,1 ,…,CT NtruGSW,v-1 , and according to the database hypercube form, NTRU homomorphic outer product calculation is used to generate the ciphertext response result c respond , sent to the user User, who uses the NTRU decryption algorithm to recover the result d idx The privacy information retrieval protocol method proposed in the present invention has low communication overhead and short response calculation time, and has the following beneficial technical effects:

[0105] (1) Simple ciphertext query expansion. Currently, SealPIR, OnionPIR, SPIRAL and other schemes use coefficient extraction algorithms based on homomorphic computing, which are complex to expand and cause large ciphertext noise growth. The present invention directly extracts LWE ciphertext from RLWE ciphertext, realizes coefficient ciphertext extraction with basically no computational overhead, and combines the ciphertext conversion method to form a highly efficient ciphertext expansion algorithm.

[0106] (2) The query calculation overhead is small. When OnionPIR, SPIRAL and other schemes calculate the homomorphic inner product, the ciphertext is two polynomial ring elements, while the ciphertext of the present invention is one polynomial ring element, which not only reduces the memory space, but also reduces the polynomial multiplication operation time;

[0107] (3) The heterogeneous ciphertext conversion is simple and efficient. When the OnionPIR, SPIRAL and other schemes use homomorphic inner products, the GSW ciphertext of the private key needs to be sent to the server, which increases the communication overhead during the query, and requires a homomorphic outer product to realize the conversion of BFV ciphertext to GSW ciphertext. The present invention does not require the GSW ciphertext of the private key, and directly expresses a group of NTRU ciphertexts as a GSW ciphertext. This conversion has no computational overhead and is very efficient. BRIEF DESCRIPTION OF THE DRAWINGS

[0108] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0109] Figure 1 It is a flowchart of a privacy information retrieval method based on NTRU homomorphic outer product provided by an embodiment of the present invention;

[0110] Figure 2 This is an overall architecture diagram of a privacy information retrieval based on NTRU homomorphic outer product provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0111] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0112] First, the relevant symbols of the present invention are described as follows:

[0113] This paper uses italic bold lowercase letters to represent vectors (e.g., u, v) and italic bold uppercase letters to represent matrices (e.g., A, B). represents the ring of integers, represents the set of natural numbers; for positive integers Let [n] denote the set {1, 2, ..., n}; for positive integers make represents the residue class of integers modulo q; for integers and a≤b, let [a, b] denote the set {a, a+1, ..., b}; let λ denote the security parameter, and the symbol poly(λ) denotes that for some positive integer The asymptotic function O(λ c ), the symbol negl(λ) means that for all positive integers The asymptotic function o(λ -c ).

[0114] When A is a set, x←A means randomly selecting an element x from the set A; when χ is a probability distribution, x←χ means randomly sampling an element x from the distribution χ; when f is a function, x←f means the output of function f.

[0115] If the positive integer N is a power of 2, then x N +1 is a 2N-order cyclotomic polynomial, then the ring is a cyclotomic polynomial ring; any element a on R can be regarded as a unique polynomial of degree less than N and x N +1; for convenience, we use the polynomial Represents the elements on R, and its coefficient vector is (a 0 , a 1 , ..., a N-1 ); for any integer There is a business ring

[0116] The discrete Gaussian distribution is the ring of integers For the real number σ, c>0, we first define the Gaussian function Therefore, for the entire ring of integers Then there is Then a discrete Gaussian distribution with standard deviation σ and mean c is The distribution of The probability function is Its symbol is χ σ，c , if c = 0, then it is recorded as χ σ , express distribution on , each component is a χ σ distributed.

[0117] The present invention proposes a privacy information retrieval method based on NTRU homomorphic outer product. First, the database is regarded as a v+1-dimensional hypercube. The user User generates the corresponding query tuple (i, j) from the query index idx. 1 , j 2 , ..., j v ), compress and encrypt the query tuple to obtain a RLWE ciphertext c as the query query , the ciphertext c query Sent to the server, the server will use the ciphertext query expansion algorithm to query Expanded to v+1 groups of ciphertext CT Ntru , CT NtruGSW，0 , CT NtruGSW，1 ,…,CT NtruGSW，v-1 , and according to the database hypercube form, NTRU homomorphic outer product calculation is used to generate the ciphertext response result c respond , sent to the user User, who uses the NTRU decryption algorithm to recover the result d idx . Specifically include:

[0118] This method has two participating entities: user User and server Server. The server Server has a database DB of size n = {d 0 , d 1 , ..., d n-1}, the user wants to query the record in the database for d idx , then the process of the privacy information retrieval method based on NTRU homomorphic outer product proposed by the present invention is as follows Figure 1 As shown, including:

[0119] Step 1: User User calls the RLWE scheme, NtruSHE scheme and NtruGSW scheme respectively according to the security parameter λ, and generates the parameters of the RLWE scheme, NtruSHE scheme and NtruGSW scheme: Params RLWE ←RLWE.Setup(1 λ ), Params NtruSHE ←NtruSHE.Setup(1 λ ), Params NtruGSW ←NtruGSW.Setup(1 λ ), here it is required to maintain the consistency of the underlying algebraic structure, that is, these three schemes use the same algebraic structure

[0120] Step 2: User User generates private keys s, f and ciphertext conversion keys w, K according to the RLWE scheme, NtruSHE scheme and conversion key generation algorithms RlweToNtruKeyGen() and LweToRlweKeyGen(): s←RLWE.KeyGen(Params RLWE )、f←NtruSHE.KeyGen(Params NtruSHE ), w←RlweToNtruKeyGen(s, f, B w ), K←LweToRlweKeyGen(s), and determine the parameter v according to the database size 1 and v, the user User will be the parameters Params RLWE 、Params NtruSHE 、Params NtruGSW , ciphertext conversion key public key w, K, and parameter v 1 and v are sent to the server.

[0121] Step 3: User User calls the query tuple generation algorithm based on the plaintext query idx to generate a query tuple (i, j 1 , j 2 , ..., j v)←QueryTupleGen(idx).

[0122] Step 4: Input the private key s and call the ciphertext query generation algorithm to generate the ciphertext query c from the query tuple query ←EncQueryGen(s,(i,j 1 , j 2 , ..., j v )), and ask c for the ciphertext query Sent to the server.

[0123] Step 5: The server receives the ciphertext query c query After that, from c query =(c 0 , c 1 ) to extract N LWE ciphertexts:

[0124] c LWE,i =(c 0,i , ρ i (c 1 )), i = 0, 1, ..., N-1

[0125] Where N is the dimension of the ring R polynomial, c 0，i Represents the polynomial c 0 The coefficient of the i-th term, ρ i is a transformation function that can transform the polynomial b=b 0 +b 1 x+…+b N-1 x N-1 Convert to an N-dimensional vector (b i , b i-1 , …, b 0 , -b N-1 , -b N-2 , ..., -b i+1 ).

[0126] Then input the conversion key K and w to call the ciphertext conversion algorithm LweToRlwe() and RlweToNtru() in turn to convert the LWE ciphertext into RLWE ciphertext, and then further convert it into NtruSHE ciphertext:

[0127] ct RLWE,i ←LweToRlwe(K,C LW E,i ) , i=0,1,…,N-1

[0128] C Ntru，i ←RlweToNtru(w,ct RLWE,i ), i = 0, 1, ..., N-1;

[0129] Step 6: The server divides the N NtruSHE ciphertexts into v+1 groups, the first group is Convert ciphertext groups other than group 1 to NtruGSW ciphertext groups by calling the algorithm NtruSHEToGSW():

[0130]

[0131] CT NtruGSW，k =(c NtruGSW，k , gc NtruGSW，k mod q)

[0132] Where k = 0, 1, ..., v-1, g is the tool vector and q is the ciphertext modulus.

[0133] Step 7: The server performs the cipher query calculation, first using the first group of ciphertext CT Ntru Process the first dimension database records, let n represent the number of database data records, for Among them, NtruSHE.MultPlain() is the homomorphic plaintext multiplication, and the addition of the summation symbol uses the homomorphic addition method NtruSHE.Add(), and then CT NtruGSW，0 , CT NtruGSW，1 ,…,CT NtruGSW，v-1 Process the records of subsequent dimensions of the database and initialize For k = 0, 1, ..., v-1, the loop iterates as follows:

[0134] (1) Set num = num / 2;

[0135] (2) For h = 0, 1, ..., num-1, Among them, g is the tool vector, B is the base, Represents the NTRU homomorphic outer product operation;

[0136] (3) As a result of the calculation, it enters the next round of loop iteration;

[0137] After completing v iterations, output is the output of the last iteration, the server will c respond Sent to user User.

[0138] Step 8: The user receives c respond , input the private key f, and decrypt the result d according to the NTRU decryption algorithm idx←NtruSHE.Dec(f,c respond ).

[0139] The method is divided into four stages: Step 1 and Step 2 are the system establishment stage, Step 3 and Step 4 are the query generation stage, Step 5 to Step 7 are the response calculation stage, and Step 8 is the result acquisition stage.

[0140] Furthermore, the NTRU difficulty problem is assumed to be:

[0141] NTRU sampling: In the distribution χ σ f and g are randomly selected on R q It is reversible, taking f as the secret information, and calculating h = g·f -1 , get NTRU N，q，σ (f) Sampling h.

[0142] Search NTRU ProblemSearch_NTRU N，q，σ :Let integer N>0,q>0, let real number σ>0, select as an element of R, and f is in R q It is reversible, taking f as the secret information, and selecting from the discrete Gaussian distribution As an element on R, given h = g·f -1 mod q, solve for f.

[0143] Decisional NTRU problem N，q，σ :Let integer N>0,q>0, let real number σ>0, select as an element of R, and f is in R q It is reversible, taking f as the secret information, and selecting from the discrete Gaussian distribution As an element on R, h = g·f -1 mod q forms a probability distribution NTRU N，q，σ (f) Differentiate between NTRU N，q，σ (f) and random uniform distribution u←R q .

[0144] The RLWE difficulty problem is assumed to be:

[0145] RLWE sampling: Random sampling in the distribution χ key Select an element s as the secret information and uniformly randomly select it from R q Choose a polynomial a, in the discrete Gaussian distribution Select an error e, calculate b = as + e, and get RLWE N，q，σ Sampling (a, b) of (s).

[0146] Search-type RLWE problemSearch_RLWE N，q，σ :According to k RLWE N，q，σ (s) Sampling (a) i , b i =a i s+e i ), i=1, 2, ..., k, solve the secret s.

[0147] Decisional_RLWE N，q，σ :Distinguish between (a, b = as + e) ​​distribution and uniform distribution U(R q ×R q ).

[0148] According to the research of scholars, solving Search_NTRU N，q，σ Question and Decisional_NTRU N，q，σ Question, and Search_RLWE N，q，σ and Decisional_RLWE N，q，σ It is difficult to calculate.

[0149] Furthermore, the RLWE scheme in step 1 is a symmetric homomorphic encryption scheme based on RLWE, including:

[0150] System establishment algorithm RLWE.Setup(1 λ ): Input security parameter λ, let distribution χ key Represents the distribution of the key, and generates parameters Params according to the decision-type RLWE problem RLWE =(N, q, σ, B, l, t, Δ), so that the complexity of solving the difficult problem is not less than 2 λ , where N represents an integral ring The degree of the generating polynomial, q represents the ciphertext modulus, σ represents the standard deviation of the discrete Gaussian distribution, B represents the basis of the tool vector, t represents the plaintext modulus,

[0151] Key generation algorithm RLWE.KeyGen(Params RLWE ): Input parameters Params RLWE , in the ternary {-1,0,1} distribution Randomly select s from the above, let the key be sk=s∈R, where

[0152] Encryption algorithm RLWE.Eec(sk,m): Input plaintext m∈R t , in random R qRandomly select an element a←R q , in the discrete Gaussian distribution Randomly select e from above, calculate and output the ciphertext in

[0153] Decryption algorithm RLWE.Dec(sk,ct): Input ciphertext ct = (c 0 , c 1 ) and the decryption key sk, calculate and output .

[0154] Furthermore, the NtruSHE scheme in step 1 is a symmetric homomorphic encryption scheme based on NTRU, including:

[0155] System establishment algorithm NtruSHE.Setup(1 λ ):Input the security parameter λ, according to the decisional NTRU problem Decisional_NTRU N，q，σ , generate parameters Params HtruSHE =(N, q, σ, B, l, t, Δ), so that the complexity of solving the difficult problem is not less than 2 λ , where N represents an integral ring The degree of the generating polynomial, q represents the ciphertext modulus, σ represents the standard deviation of the discrete Gaussian distribution, B represents the basis of the tool vector, t represents the plaintext modulus,

[0156] Key generation algorithm NtruSHE.KeyGen(Params NtruSHE ): Input parameters Params NtruSHE , randomly selected Calculate f = t·f′+1, determine whether f is reversible, if not, reselect f′ until f is reversible, and output the key sk = f;

[0157] Encryption algorithm NtruSHE.Enc(sk, m): Input plaintext m∈R t , in the discrete Gaussian distribution Randomly select u from the above, calculate and output the ciphertext ct = u sk -1 +Δ·m mod q;

[0158] Decryption algorithm NtruSHE.Dec(sk, ct): Input ciphertext ct and decryption key sk, calculate and output

[0159] In order to speed up the calculation efficiency of homomorphic multiplication and homomorphic outer product, sometimes it is not necessary to make the ciphertext decryptable, but just use the ciphertext as an intermediate output process. In this case, the following method can be used to encrypt the plaintext:

[0160] Encoding algorithm NtruSHE.Encode(sk,m): Input plaintext m∈R t , in the discrete Gaussian distribution Randomly select u from above and calculate the ciphertext ct = u sk -1 +m mod q;

[0161] Homomorphic addition NtruSHE.Add(ct 0 , ct 1 ): Enter two ciphertexts ct 0 ,ct 1 ∈R q , calculate and output ct Add =ct 0 +ct 1 mod q;

[0162] Homomorphic plaintext addition NtruSHE.AddPlain(ct,pt): Input ciphertext ct∈R q and a plaintext pt∈R t , calculate and output ct MultPlain = ct + Δ·pt mod q;

[0163] Homomorphic plaintext multiplication NtruSHE.MultPlain(ct, pt): Input ciphertext ct∈R q and a plaintext pt∈R t , calculate and output ct MultPlain =ct·pt mod q.

[0164] Furthermore, the NtruGSW scheme in step 1 is a GSW-type symmetric Boolean homomorphic encryption scheme based on NTRU, including:

[0165] Given a basis B, let Introduce tool vector g and tool matrix G, Definition -1 Transformation: For a∈R q , decompose it with B as the basis in a i ∈R B , g T g -1 (a) = a;

[0166] System establishment algorithm NtruGSW.Setup(1 λ ):Input the security parameter λ, according to the decisional NTRU problem Decisional_NTRU N，q，σ , generate parameters Params NtruGSW =(N, q, σ, B, l, t, Δ), so that the complexity of solving the difficult problem is not less than 2 λ ,in

[0167] Key generation algorithm NtruGSW.KeyGen(Params NtruGSW ): Input parameters Params NtruGSW , randomly selected Calculate f = tf′ + 1, determine whether f is reversible, if not, reselect f′ until f is reversible, and set the key sk = f;

[0168] Encryption algorithm NtruGSW.Enc(sk,m): Input plaintext polynomial m∈{0,1}, in l identical discrete Gaussian distributions Randomly select a l-dimensional vector u=(u 0 ,u 1 , ..., u l-1 ), calculate and output the ciphertext c = u·f -1 +Δ·mg;

[0169] Decryption algorithm NtruGSW.Dec(sk, c): Input ciphertext c and private key sk, calculate By getting the 0th element of vector m, we can recover the message m=m[0];

[0170] In order to speed up the calculation efficiency of homomorphic multiplication and homomorphic outer product, sometimes it is not necessary to make the ciphertext decryptable, but just use the ciphertext as an intermediate output process. In this case, the following method can be used to encrypt the plaintext:

[0171] Encoding algorithm NtruGSW.Encode(sk,m): Input plaintext polynomial m∈{0,1}, in l identical discrete Gaussian distributions Randomly select a l-dimensional vector u=(u 0 ,u 1 , ..., u l-1 ), calculate and output the ciphertext c = u·f -1 +mg;

[0172] Homomorphic addition NtriGSW.Add(c 0 , c 1 ): Enter two ciphertexts Calculate and output cAdd =c 0 +c 1 mod q, where That is, 1 R q The Cartesian direct product of

[0173] Homomorphic plaintext addition NtruGSW.AddPlain(c, pt): input ciphertext and a plaintext pt∈{0,1}, calculate and output c AddPlain = c + Δ·pt·g mod q;

[0174] Homomorphic complement operation NtruGSW.comple(c): input ciphertext Calculate and output c comple =gc mod q.

[0175] Furthermore, the conversion key generation algorithm RlweToNtruKeyGen() in step 2 is the conversion of RLWE ciphertext to NtruSHE ciphertext, including:

[0176] The RLWE ciphertext is in the form of Where s is the private key of the RLWE ciphertext, and a is randomly and uniformly selected from R q , e randomly sampled from the distribution Plaintext m belongs to R t In order to convert RLWE ciphertext into NtruSHE ciphertext, a conversion key w is required. The conversion key generation algorithm RlweToNtruKeyGen() is:

[0177] Let f denote the private key of the NtruSHE scheme, B w Indicates conversion base;

[0178] Input the private key s of the RLWE ciphertext, the private key f of the NtruSHE scheme, and the conversion basis B w ,make Transformation key generation algorithm RlweToNtruKeyGen(s, f, B w )for:

[0179] (1) In distribution Randomly select a w dimensional vector u w ;

[0180] (2) Let l w Dimensional Tools Vector

[0181] (3) Calculate and output the conversion key w = (w 0 , w 1 ,…,wl-1 )=u w ·f -1 +s·g w mod q;

[0182] Input RLWE ciphertext ct RLWE And the conversion key w, the conversion algorithm from RLWE ciphertext to NtruSHE ciphertext RlweToNtru(w, c RLWE )for:

[0183] (1) For the RLWE ciphertext component c RLWE，1 Base B w Decomposition in Indicates that the output data is processed in B w Decomposition by base;

[0184] (2) Calculate and output

[0185] The conversion key generation algorithm LweToRlweKeyGen() in step 2 is a conversion key generation algorithm from LWE ciphertext to RLWE ciphertext, including:

[0186] K←KSKeyGen(s, s′): Randomly select an l-dimensional vector k 1 , in the distribution Randomly sample an l-dimensional vector e and calculate k 0 =-k 1 ·s′+g·s+e mod q, output the transformation key of RLWE ciphertext

[0187] K←LweToRlweKeyGen(s): Since s is a polynomial, for i=2, 3, ..., l-1, let s (i) =s(x i ), call K i =KSKeyGen(s, s′), then the conversion key from LWE ciphertext to RLWE ciphertext is K={K 2 , K 3 , ..., K l-1}.

[0188] Furthermore, the query tuple generation algorithm in step 3 is specifically as follows:

[0189] Suppose the database server stores a database DB with n records. 0 , d 1 , ..., d n-1}, let the private information query index be idx, that is, the query object be didx , consider the database as a hypercube in v+1 dimensional space That is, the size of the first dimension is The scale of the 2nd to v+1th dimension is 2, and the parameters v and v 1 Set according to database size and specific needs;

[0190] Assume that the query index idx∈{0, 1, ..., n-1} can be converted into a query tuple (i, j 1 , j 2 , ..., j v ),in j 1 , j 2 , ..., j v ∈{0, 1}. The query tuple generation algorithm QueryTupleGen() can be called to generate the query tuple. The query tuple generation algorithm is:

[0191]

[0192] Furthermore, the ciphertext query generation algorithm in step 4 is specifically:

[0193] The query tuple (i, j 1 , j 2 , ..., j v ) is embedded into the plaintext polynomial μ(x)=μ 0 +μ 1 x+…+μ N-1 x N-1 In order to adapt to the encryption form of the NtruGSW scheme, it is also necessary to embed B h j k , h=0,1,…,l-1, k=1,2,…,v, for this purpose, the present invention provides a ciphertext query generation algorithm WncQueryGen():

[0194]

[0195]

[0196] The present invention requires

[0197] Furthermore, the ciphertext query expansion algorithm in step 5 specifically includes:

[0198] Let the vector polynomial b = b 0 +b 1 x+…+b N-1 x N-1 ∈R q , whose coefficient vector is (b 0 , b1 , …, b N-1 ), define the transformation ρ i (b)=(b i , b i-1 , ..., b 0 , -b N-1 -b N-2 , ..., -b i+1 ), which is equivalent to reversely flipping the 0th to ith consecutive elements of the coefficient vector of the polynomial b, and reversely flipping the i+1th to N-1th consecutive elements, outputting a N-1 dimensional vector on ;

[0199] Let the input be a RLWE ciphertext query c query =RLWE.Enc(s,μ(x))=(c 0 , c 1 )=(-as+e+Δμ(x),a), where the plaintext μ(x)=μ 0 +μ 1 x+…+μ N-1 x N-1 , use vector s to represent the coefficient vector of the key, c 0，i Represents R q Polynomial element c over the ring 0 The coefficient of the i-th order term, and then directly from c RLWE The LWE ciphertext of the plaintext polynomial coefficients is extracted as follows:

[0200] LWE.Enc(s,μ i )=(c 0，i , ρ i (c 1 )), i = 0, 1, ..., N-1

[0201] By adopting the LWE ciphertext to RLWE ciphertext conversion technology, LWE.Enc(s, μ i ) is converted to RLWE ciphertext with key s. This conversion requires the conversion key K←LweToRlweKeyGen(s). Let the conversion algorithm be LewToTlwe(), then:

[0202] ct RLWR，i ←LweToRlwe(K,LWE.Enc(s,μ i )), i = 0, 1, ..., N-1

[0203] ct RLWE，i is a pair coefficient μ i Encrypted RLWE ciphertext, ct RLWE，i =RLWE.Enc(s,μ i), i = 0, 1, ..., N-1, and then call the RLWE ciphertext to NtruSHE ciphertext conversion algorithm RlweToNtru(), input the conversion key w, and generate a set of NtruSHE ciphertext: c Ntru，i ←RlweToNtru(w,ct RLWE，i ), i = 0, 1, ..., N-1, the calculated ciphertext c Ntru，i is the coefficient μ i NtruSHE ciphertext;

[0204] The ciphertext conversion algorithm LweToRlwe() includes:

[0205] ct′←KeySwitch(ct, K): Input a RLWE ciphertext Convert the key K, calculate and output the ciphertext ct′=(c 0 ,0)+g -1 (c 1 )·K mod q;

[0206] ct′←EvalAuto(ct, i, K): Input a RLWE ciphertext Conversion key K = {K 2 , K 3 , ..., K l-1}, an integer i, calculate and output ct′=KeySwitch(ct, K i );

[0207] ct RLWE ←LweToRlwe(c LWE , K): Input a LWE ciphertext where a=(a 0 , a 1 , ..., a N-1 ), convert a into a polynomial Let the initial ciphertext ct = (b, a), for k = 1, 2, ..., log 2 N, iterative calculation After the iteration is completed, output

[0208] Furthermore, the algorithm NtruSHEToGSW() in step 6 constructs NtruGSW ciphertext based on NtruSHE ciphertext group, including:

[0209] Let the plaintext m∈{0,1}, input l NtruSHE encryption codes: ct 0 =NtruSHE.Encode(B 0 ,m)、ct 1=NtruSHE.Encode(B,m),…,ct l-1 =NtruSHE.Encode(B l-1 , m), the present invention can construct these l NtruSHE encryption codes into 1 NtruGSW ciphertext. This construction has zero overhead and is very direct. Let the construction algorithm be NtruSHEToGSW(), and the specific form is:

[0210]

[0211] Furthermore, the NTRU homomorphic outer product operation in step 7 includes:

[0212] Let an NtruSHE ciphertext ct∈R q It is the message 0 ∈{0,1} encryption, that is, ct = NtruSHE.Enc(sk,m 0 ), a NtruGSW ciphertext It is the message 1 ∈{0,1} encryption code, that is, c=NtruGSW.Encode(sk,m 1 ), the decryption keys corresponding to these two ciphertexts are the same, both are f, and the operator symbol is defined Represents the NTRU homomorphic outer product operation:

[0213]

[0214] NTRU Homomorphic Outer Product Output an NtruSHE ciphertext, set to ct ExPorduct , and is the message m 0 m 1 For mod t encryption, the noise growth rate caused by the homomorphic outer product operation is an asymmetric linear one, especially when m 1 =0, ct ExPorduct The noise has nothing to do with ct.

[0215] Figure 2 The overall framework of the privacy information retrieval based on NTRU homomorphic outer product proposed in the present invention is as shown in the figure. The user side includes components such as query tuple generation and plaintext encoding, RLWE encryption, NTRU decryption, etc. to generate ciphertext queries and decrypt to obtain response results; the server side includes components such as expansion algorithm, NTRU ciphertext group to NtruGSW ciphertext group conversion, database plaintext and ciphertext multiplication, homomorphic outer product, etc. to generate ciphertext responses.

[0216] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A privacy information retrieval protocol method based on NTRU homomorphic outer product, characterized in that: The method comprises: Step 1: User User calls the RLWE scheme, NtruSHE scheme and NtruGSW scheme respectively according to the security parameter λ, and generates the parameters of the RLWE scheme, NtruSHE scheme and NtruGSW scheme: Params RLWE ←RLWE.Setup(1 λ ), Params NtruSHE ←NtruSHE.Setup(1 λ ), Params NtruGSW ←NtruGSW.Setup(1 λ ); Step 2: User User generates private keys s, f and ciphertext conversion keys w, K according to the RLWE scheme, NtruSHE scheme and conversion key generation algorithms RlweToNtruKeyGen() and LweToRlweKeyGen(), s←RLWE.KeyGen(Params RLWE )、f←NtruSHE.KeyGen(Params NtruSHE ), w←RlweToNtruKeyGen(s, f, B w ), K←LweToRlweKeyGen(s), and determine the parameters v1 and v according to the database size. The user User sets the parameters Params RLWE 、Params NtruSHE 、Params NtruGSW , the ciphertext conversion key public key w, K, and parameters v1 and v are sent to the server Server; Step 3: User User calls the query tuple generation algorithm based on the plaintext query index idx to generate a query tuple (i, j1, j2, ..., j v )←QueryTupleGen(idx); Step 4: Input the private key s and call the ciphertext query generation algorithm to generate the ciphertext query c from the query tuple query ←EncQueryGen(s,(i,j1,j2,...,j v )), and ask c for the ciphertext query Send to the server; Step 5: The server receives the ciphertext query c query After that, from c query =(c0, c1) to extract N LWE ciphertexts: c LWE，i =(c 0，i ,ρ i (c1)), i=0, 1,…, N-1 Where N is the dimension of the ring R polynomial, c 0，i represents the coefficient of the i-th term of the polynomial c0, ρ i is a transformation function that converts the polynomial Convert to an N-dimensional vector (b i , b i-1 , ..., b0, -b N-1 , -b N-2 , ..., -b i+1 ); Then input the conversion key K and w and call the ciphertext conversion algorithm LweToRlwe() and RlweToNtru() in turn to convert the LWE ciphertext into RLWE ciphertext, and then further convert it into NtruSHE ciphertext: ct RLWE，i ←LweToRlwe(K,c LWE，i ),i=0,1,…,N-1 c Ntru，i ←RlweToNtru(w,ct RLWE，i ),i=0,1,…,N-1; Step 6: The server divides the N NtruSHE ciphertexts into v+1 groups, the first group is The ciphertext groups other than group 1 are converted to NtruGSW ciphertext groups by calling the algorithm NtruSHEToGSW(): Where k = 0, 1, ..., v-1, g is the tool vector, q is the ciphertext modulus; Step 7: The server performs the cipher query calculation, first using the first group of ciphertext CT Ntru Process the first dimension database records, let n represent the number of database data records, for Among them, NtruSHE.MultPlain() is the homomorphic plaintext multiplication, and the addition of the summation symbol uses the homomorphic addition method NtruSHE.Add(), and then CT NtruGSW，0 , CT NtuGSW，1 ,…,GT NtruGSW，v-1 Process the records of subsequent dimensions of the database and initialize For k = 0, 1, ..., v-1, the loop iterates as follows: (1) Set num = num / 2; (2) For h = 0, 1, ..., num-1, Among them, g is the tool vector, B is the base, Represents the NTRU homomorphic outer product operation; (3) As a result of the calculation, it enters the next cycle iteration; After completing v iterations, output is the output of the last iteration, the server will c respond Send to user User; Step 8: The user receives c respond , input the private key f, and decrypt the result d according to the NTRU decryption algorithm idx ←NtruSHE.Dec(f,c respond ).

2. The method according to claim 1, characterized in that: The RLWE scheme in step 1 is a symmetric homomorphic encryption scheme based on RLWE, including: System establishment algorithm RLWE.Setup(1 λ ): Input security parameter λ, let distribution χ key Represents the distribution of the key, and generates parameters Params according to the decision-type RLWE difficulty problem RLWE =(N, q, σ, B, l, t, Δ), so that the complexity of solving the difficult problem is not less than 2 λ , where N represents an integral ring The degree of the generating polynomial, q represents the ciphertext modulus, σ represents the standard deviation of the discrete Gaussian distribution, B represents the basis of the tool vector, t represents the plaintext modulus, Key generation algorithm RLWE.KeyGen(Params RLWE ): Input parameters Params RLWE , in the ternary {-1,0,1} distribution Randomly select s from the above, let the key be sk=s∈R, where Encryption algorithm RLWE.Eec(sk,m): Input plaintext m∈R t , in random R q Randomly select an element a←R q , in the discrete Gaussian distribution Randomly select e from above, calculate and output the ciphertext in Decryption algorithm RLWE.Dec(sk, ct): Input ciphertext ct = (c0, c1) and decryption key sk, calculate and output 3. The method according to claim 1, characterized in that The NtruSHE scheme in step 1 is a symmetric homomorphic encryption scheme based on NTRU, including: System establishment algorithm NtruSHE.Setup(1 λ ):Input the security parameter λ, according to the decisional NTRU problem Decisional_NTRU N，q，σ , generate parameters Params NtruSHE =(N, q, σ, B, l, t, Δ), so that the complexity of solving the difficult problem is not less than 2 λ , where N represents an integral ring The degree of the generating polynomial, q represents the ciphertext modulus, σ represents the standard deviation of the discrete Gaussian distribution, B represents the basis of the tool vector, t represents the plaintext modulus, Key generation algorithm NtruSHE.KeyGen(Params NtruSHE ): Input parameters Params NtruSHE , randomly selected Calculate f = t·f′+1, determine whether f is reversible, if not, reselect f′ until f is reversible, and output the key sk = f; Encryption algorithm NtruSHE.Enc(sk, m): Input plaintext m∈R t , in the discrete Gaussian distribution Randomly select u from the above, calculate and output the ciphertext ct = u sk -1 +Δ·m mod q; Decryption algorithm NtruSHE.Dec(sk, ct): Input ciphertext ct and decryption key sk, calculate and output In order to speed up the calculation efficiency of homomorphic multiplication and homomorphic outer product, sometimes the ciphertext does not need to be decryptable, and the ciphertext is only used as an intermediate output process. In this case, the following method is used to encrypt the plaintext: Encoding algorithm NtruSHE.Encode(sk,m): Input plaintext m∈R t , in the discrete Gaussian distribution Randomly select u from above and calculate the ciphertext ct = u sk -1 +m mod q; Homomorphic addition NtruSHE.Add(ct0, ct1): Input two ciphertexts ct0, ct1∈R q , calculate and output ct Add = ct0 + ct1 mod q; Homomorphic plaintext addition NtruSHE.AddPlain(ct,pt): Input ciphertext ct∈R q and a plaintext pt∈R t , calculate and output ct MultPlain = ct + Δ·pt mod q; Homomorphic plaintext multiplication NtruSHE.MultPlain(ct, pt): Input ciphertext ct∈R q and a plaintext pt∈R t , calculate and output ct MultPlain =ct·pt mod q.

4. The method according to claim 1, characterized in that The NtruGSW scheme in step 1 is a GSW-type symmetric Boolean homomorphic encryption scheme based on NTRU, including: Given a basis B, let Introduce the tool vector g, Definition -1 Transformation: For a∈R q , decompose it with B as the basis in a i ∈R B , g T g -1 (a) = a; System establishment algorithm NtruGSW.Setup(1 λ ):Input the security parameter λ, according to the decisional NTRU problem Decisional_NTRU N，q，σ , generate parameters Params NtruGSW =(N, q, σ, B, l, t, Δ), so that the complexity of solving the difficult problem is not less than 2 λ ,in Key generation algorithm NtruGSW.KeyGen(Params NtruGSW ): Input parameters Params NtruGSW , randomly selected Calculate f = tf′ + 1, determine whether f is reversible, if not, reselect f′ until f is reversible, and set the key sk = f; Encryption algorithm NtruGSW.Enc(sk,m): Input plaintext polynomial m∈{0,1}, in l identical discrete Gaussian distributions Randomly select a l-dimensional vector u=(u0,u1,...,u l-1 ), calculate and output the ciphertext c = u·f -1 +Δ·m·g; Decryption algorithm NtruGSW.Dec(sk, c): Input ciphertext c and private key sk, calculate Get the 0th element of vector m and restore the message m=m[0]; In order to speed up the calculation efficiency of homomorphic multiplication and homomorphic outer product, sometimes the ciphertext does not need to be decryptable, and the ciphertext is only used as an intermediate output process. In this case, the following method is used to encrypt the plaintext: Encoding algorithm NtruGSW.Encode(sk,m): Input plaintext polynomial m∈{0,1}, in l identical discrete Gaussian distributions Randomly select a l-dimensional vector u=(u0,u1,...,u l-1 ), calculate and output the ciphertext c = u·f -1 +mg; Homomorphic addition NtruGSW.Add(c0, c1): input two ciphertexts Calculate and output c Add =c0+c1modq, where That is, 1 R q The Cartesian direct product of Homomorphic plaintext addition NturGSW.AddPlain(c, pt): input ciphertext and a plaintext pt∈{0,1}, calculate and output c AddPlain = c + Δ·pt·g mod q; Homomorphic complement operation NtruGSW.compoe(c): input ciphertext Calculate and output c comple =gc mod q.

5. The method according to claim 3, characterized in that: The conversion key generation algorithm RlweToNtruKeyGen() in step 2 is the conversion from RLWE ciphertext to NtruSHE ciphertext, including: The RLWE ciphertext is in the form of Where s is the private key of the RLWE ciphertext, and a is randomly and uniformly selected from R q , e randomly sampled from the distribution Plaintext m belongs to R t In order to convert RLWE ciphertext to NtruSHE ciphertext, a conversion key w is required. The conversion key generation algorithm RlweToNtruKeyGen() is: Let f denote the private key of the NtruSHE scheme, B w Indicates conversion base; Input the private key s of the RLWE ciphertext, the private key f of the NtruSHE scheme, and the conversion basis B w ,make Transformation key generation algorithm RlweToNtruKeyGen(s, f, B w )for: (1) In distribution Randomly select a w dimensional vector u w ; (2) Let l w Dimensional Tools Vector (3) Calculate and output the conversion key w = (w0, w1, ..., w l-1 )=u w ·f -1 +s·g w modq; Input RLWE ciphertext ct RLWE And the conversion key w, the conversion algorithm from RLWE ciphertext to NtruSHE ciphertext RlweToNtru(w, c RLWE )for: (1) For the RLWE ciphertext component c RLWE，1 Base B w Decomposition in Indicates that the output data is B w Decomposition by base; (2) Calculate and output The conversion key generation algorithm LweToRlweKeyGen() in step 2 is a conversion key generation algorithm from LWE ciphertext to RLWE ciphertext, including: K←KSKeyGen(s, s′): Randomly select an l-dimensional vector k1 from the distribution Randomly sample an l-dimensional vector e, calculate k0 = -k1·s′+g·s+e mod q, and output the conversion key of the RLWE ciphertext K←LweToRlweKeyGen(s): Since s is a polynomial, for i=2, 3, ..., l-1, let s (i) =s(x i ), call K i =KSKeyGen(s, s′), then the conversion key from LWE ciphertext to RLWE ciphertext is K={K2, K3, ..., K l-1 }.

6. The method according to claim 1, characterized in that The query tuple generation algorithm in step 3 is as follows: The database server stores a database DB with n records = {d0, d1, ..., d n-1 }, let the private information query index be idx, that is, the query object be d idx , consider the database as a hypercube in v+1 dimensional space That is, the number of the first dimension is The number of dimensions from 2 to v+1 is 2, and the parameters v and v1 are set according to the database size and specific needs; Assume the query index idx∈{0, 1, ..., n-1}, then the query tuple generation algorithm QueryTupleGen() is: (1) (2)tmp=idx-i·2 v ; (3) For k = 1, 2, ..., v, execute: ① ②tmp=tmp-j k ·2 v-k ; Finally, the query tuple (i, j1, j2, ..., j v ),in 7. The method according to claim 2, characterized in that The ciphertext query generation algorithm in step 4 is specifically: The query tuple (i, j1, j2, ..., j v ) is embedded into the plaintext polynomial μ(x) = μ0+μ1x+…+μ N-1 x N -1 In the h j k , h=0,1,…,l-1,k=1,2,…,v,the ciphertext query generation algorithm EncQueryGen() is: Input RLWE private key s and query tuple (i, j1, j2, ..., j v ); Output: RLWE ciphertext Let μ(x) = Δ x i ; For k = 1, 2, ..., v, execute: Output RLWE ciphertext c query =RLWE.Enc(s,μ(x)).

8. The method according to claim 5, characterized in that The ciphertext query expansion algorithm in step 5 specifically includes: Let the vector polynomial b = b0 + b1x + ... + b N-1 x N-1 ∈R q , whose coefficient vector is (b0, b1, ..., b N-1 ), define the transformation ρ i (b)=(b i , b i-1 , ..., b0, -b N-1 , -b N-2 , ..., -b i+1 ), which is equivalent to reversely flipping the 0th to ith consecutive elements of the coefficient vector of the polynomial b, and reversely flipping the i+1th to N-1th consecutive elements, outputting a N-1 dimensional vector on ; Let the input be a RLWE ciphertext query c query =RLWE.Enc(s,μ(x))=(c0,c1)=(-as+e+Δ·μ(x),a), where plaintextμ(x)=μ0+μ1x+…+μ N-1 x N-1 , use vector s to represent the coefficient vector of the key, c 0，i Represents R q The coefficient of the i-th degree term of the polynomial element c0 over the ring, and then directly from c RLWE The LWE ciphertext of the plaintext polynomial coefficients is extracted as follows: LWE.Enc(s,μ i )=(c 0，i ,r i (c1)), i=0, 1,…, N-1 By adopting the LWE ciphertext to RLWE ciphertext conversion technology, LWE.Enc(s, μ i ) is converted to RLWE ciphertext with key s. This conversion requires the conversion key K←LweToRlweKeyGen(s). Let the conversion algorithm be LweToRlwe( ), then: ct RLWE，i ←LweToRlwe(K,LWE.Enc(s,μ i )),i=0,1,…,N-1 ct RLWE，i is a pair coefficient μ i Encrypted RLWE ciphertext, ct RLWE，i =RLWE.Enc(s,μ i ), i = 0, 1, ..., N-1, and then call the RLWE ciphertext to NtruSHE ciphertext conversion algorithm RlweToNtru(), input the conversion key w, and generate a set of NtruSHE ciphertext: c Ntru，i ←RlweToNtru(w,ct RLWE，i ), i = 0, 1, ..., N-1, the calculated ciphertext c Ntru，i is the coefficient μ i NtruSHE ciphertext; The ciphertext conversion algorithm LweToRlwe() includes: ct′←KeySwitch(ct, K): Input a RLWE ciphertext Convert the key K, calculate and output the ciphertext ct′=(c0,0)+g -1 (c1)·K mod q; ct′←EvalAuto(ct, i, K): Input a RLWE ciphertext Conversion key K = {K2, K3, ..., K l-1 }, an integer i, calculate and output ct′=KeySwitch(ct, K i ); ct RLWE ←LweToRlwe(c LWE , K): Input a LWE ciphertext where a=(a0,a1,...,a N-1 ), convert a into a polynomial Let the initial ciphertext ct = (b, a), for k = 1, 2, ..., log2N, iteratively calculate After the iteration is completed, output 9. The method according to claim 3, characterized in that: The algorithm NtruSHEToGSW() in step 6 constructs the NtruGSW ciphertext based on the NtruSHE ciphertext group, including: Let the plaintext m∈{0,1}, input l NtruSHE encryption codes: ct0=NTruSHe.encode(B 0 ,m),ct1=NtruSHE.Encode(B,m),…,ct l-1 =NtruSHE.Encode(B l-1 , m), then the algorithm NtruSHEToGSW( ) is:

10. The method according to claim 3 or 4, characterized in that: The NTRU homomorphic outer product operation in step 7 is: Let an NtruSHE ciphertext ct∈R q is the encryption of message m0∈{0,1}, i.e. ct=NtruSHE.Enc(sk,m0), an NtruGSW ciphertext is the encrypted code of message m1∈{0,1}, i.e. c=NtruGSW.Encode(sk,m1), NTRU homomorphic outer product Output an NtruSHE ciphertext, set to ct ExPorduct , and is the encryption of the message m0m1modt. When m1=0, ct ExPorsuct The noise has nothing to do with ct.

Images