Privacy protection record linking method based on attribute encryption

Abstract

The invention discloses a privacy protection record linking method based on attribute encryption, which specifically comprises the following steps that: each data owner performs attribute classification on data, encrypts the data by using KeyGen, transmits the data to the data owner through a secure channel, encrypts the data based on attributes by using linear secret sharing, and finally stores the data on a cloud storage; the trusted authorization is responsible for recording public parameters and a master key, including attribute selection and storage and verification of a private key, so as to ensure that a data owner can consult and verify and prevent malicious behaviors; the data user obtains the decrypted ciphertext by matching the private key and linking the ciphertext after successful matching, and the method combines the record link with the attribute encryption, so that the calculation efficiency is improved while the data privacy is guaranteed, and the malicious collusion of the third party is effectively prevented.

Description

Technical Field

[0001] The present invention relates to the technical field of privacy protection, and in particular to a privacy protection record linking method based on attribute encryption. Background Art

[0002] With the advent of the big data era, record linkage technology is also developing rapidly. With the continuous development of technology and the continuous expansion of application fields, record linkage technology is increasingly penetrating into various industries. However, data redundancy and privacy protection issues have also become prominent. In this case, some privacy protection technologies are applied to data sharing, among which privacy preserving record linkage (PPRL: Privacy Preserving Record Linkage) technology is a typical example. Privacy preserving record linkage is a technology that identifies the same entity by analyzing and matching information in different data sources, while ensuring data security and privacy, and promoting the ability to match data. For example, in express delivery systems, this technology can be used to link user data across systems. Different express delivery systems can share user information records, facilitate information aggregation, conduct comprehensive research, and manage user purchased item information data while protecting user privacy.

[0003] Existing privacy-preserving record linking methods often rely on a trusted third party. Although the transmission efficiency is high, it may lead to collusion with other data sources and complicate the link, leading to the risk of privacy leakage. On the other hand, although solutions such as homomorphic encryption can significantly improve security, the efficiency of data transmission is greatly affected. Therefore, how to solve the third-party problem and achieve more efficient matching while ensuring data security is a crucial challenge. Summary of the invention

[0004] In view of the above-mentioned problems, the present invention proposes a privacy-preserving record linking method based on attribute encryption. The method combines record linking with attribute encryption technology, realizes attribute-based privacy-preserving record linking by encrypting data attributes, verifies identity by downloading attribute collections, and completes the interaction between attribute encryption and privacy record linking. In addition, the present invention also improves third-party participation to further enhance its security. This architecture not only improves the efficiency of multi-party record linking, but also effectively guarantees the security and compliance of the entire computing process.

[0005] In order to achieve the above object, the technical solution adopted by the present invention is as follows:

[0006] The privacy protection record linking method based on attribute encryption includes the following steps:

[0007] Step 1: Each data owner pre-processes the data locally (such as data cleaning), and then converts the data into a unified standard format. Next, based on the data type, the attribute set of the data is encrypted through a trusted authorization agency. For string data, it must first be divided into semantic units and then encrypted. Then, the bilinear mapping rule is applied to transform the encryption result to increase the security of data protection while maintaining the similarity of the data. At the same time, the initialization algorithm generates public parameters and master keys.

[0008] Step 2: The generated master key and public parameters are stored on a trusted authority. Subsequently, the data owner jointly writes an access policy and generates a private key using the KeyGen algorithm. After that, they transmit the private key to the data user through a secure channel, but do not inform the attribute corresponding to the key. After receiving the task request, the trusted authority first verifies the validity of the request, including checking the attribute set and user permissions, and ensures that only authorized data owners can access the data information through access control functions. After verifying the attributes, the access policy randomly selects the data information, generates the master key and public parameters, and makes its attribute names public, thereby ensuring the fairness and security of the encryption process.

[0009] The key generation algorithm needs to be trusted by the central authority to generate random numbers through a hash function. The process includes outputting the master key and public parameters, as well as making the attribute name public and embedding the attribute value into the ciphertext. Subsequently, in the key generation phase, the algorithm selects a random number for selection, calculates all attributes in the user attribute set, and outputs the user attribute key SK. The attribute authority transmits it to the user through a secure channel to ensure privacy. It has a high degree of security. After this phase, the attributes are shuffled and the attributes corresponding to the key are not informed, and the key is transmitted to the data owner.

[0010] Step 3: In the data encryption phase, the data owner sets the access policy and the information M he wants to share according to his needs through the public parameters and master key given by the system. The specific method is to divide the data owner's data secret into multiple sub-share vectors through a linear secret sharing scheme and assign them to different vectors. Each vector holds and calculates based on its own secret sub-share.

[0011] A linear secret sharing scheme is used to encrypt data. Each attribute corresponds to a secret s, and multiple shares are randomly constructed. A vector is formed and calculation is performed based on the share to form a ciphertext, which is then sent to the cloud storage.

[0012] Step 4: The data user downloads the ciphertext he needs from the cloud storage, and the key generation system generates a private key. The data user matches it with a trusted authority. Then, the calculation result is submitted to the trusted authority, and the address is submitted to the access policy. The access policy verifies the integrity and correctness of the matching result. After the match is passed, the data owner's private key is returned and the decryption algorithm is started. If the matching result does not meet the access policy set by the data owner, a failure flag will be output. Finally, the matching result is published by the authorized agency, and the data user obtains the ciphertext through the matching result to complete the data exchange. The whole process is open and transparent, which can effectively avoid collusion.

[0013] Beneficial effects of the present invention: The present invention combines attribute encryption and linear secret sharing technology, and significantly improves privacy protection in the data link process in the following ways: using linear secret sharing of attribute sets to calculate shares, and decrypting ciphertexts through decryption algorithms. The trusted authority records the calculation process in detail, including the selection of attribute sets and the generation of master keys, which can be reviewed and verified by all data owners, thereby effectively preventing malicious behavior. By matching attributes, while ensuring security, the efficiency of multi-party computing is significantly improved, the efficiency of record links is ensured, and a high level of recall, precision and F index is maintained. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 It is the overall flow chart of the present invention.

[0015] Figure 2 It is an architectural diagram of the interaction of the participating modules of the present invention.

[0016] Figure 3 This is a comparison chart of the data accuracy of the present invention and other existing methods.

[0017] Figure 4 It is a comparison chart of the matching quality between the present invention and other existing methods. DETAILED DESCRIPTION

[0018] A privacy-preserving record linking method based on attribute encryption includes the following steps:

[0019] Step 1: Each data owner first pre-processes the data locally, using data cleaning to clean up dirty data such as missing and noisy data. Subsequently, the data is converted to a standard format. Different types are processed differently depending on the data type. For numeric data, attribute classification can be performed directly; for string data, pre-processing is required before encoding. In the string processing process, to segment the string into semantically meaningful units, such as words or subwords, a multilingual word segmentation tool can be used, such as spaCy's multilingual model. These tools can effectively segment text into words or subwords based on the grammatical rules and context of different languages, laying the foundation for language processing tasks. Next, the string is split into fixed-length substrings, and each substring is attributed, and then the security parameters and attribute sets are determined by the trusted authority. After the confirmation is completed, the Setup algorithm is applied to generate it, which is called by the trusted authority.

[0020] The trusted authority uses the bilinear mapping method, G1 and G t is a multiplication cycle of two prime numbers of order P, g is a generator of group G1, e:G1×G2→G t is a bilinear map. is the complete set of attributes in the system, for each attribute The attribute value set P under i = {V i , 1, ... V i , j , ... V i , n}, for each attribute value V i，j Random selection, According to the hash function H3:G t →{0,1} m , H4: G0→{0,1} m . Random Selection u, v∈G0, generate public parameters PK and master key MSK.

[0021] Step 2: The trusted authority stores the processed public parameters and master key, and uses KeyGen(PK, MSK, S) → SK. The algorithm is called by the authority and inputs the system's public key PK, master key MSK and user attribute set. Randomly select the data owner For V i,j ∈S(i∈[1,n],j∈[1,n]), select calculate At the same time, the trusted authorization agency must also calculate each attribute of the data user and send the generated private key to the data user through a secure channel.

[0022] Key generation needs to be performed by a trusted authority to ensure the security and integrity of the key. The general steps are as follows: The initialization phase generates public keys and public parameters, and uses their attributes for encryption. The key generation phase includes submission and generation phases. The submission phase stores public parameters and master keys. The generation phase generates private keys corresponding to data attributes. After the generation phase, all data submitted by the data owner will generate private keys and master keys. The private key is used for user decryption, and the master key is used to match the access policy. After the submission phase, the access policy selects different attributes to generate keys, records them on the trusted authority, and sends the private key to the data owner.

[0023] Step 3: Encrypt the ciphertext using a linear secret sharing method to divide the data attributes of the data owner into multiple secret shares. A vector is formed and calculations are performed based on this share.

[0024] Step 3-1: Linear secret sharing is a j ×n j The secret value of the data attribute is split into multiple shares through linear secret sharing, and each share is distributed to a different vector. Assume that there must be a shared generation matrix And a mapping function ρ exists such that M i can be mapped to specific attributes in the set U through ρ, that is, ρ:[l]→U, where i∈[1,l],M i is the i-th row of the matrix M. In addition, given a row vector v = (s, r2, ..., r l ), where r2,...,r l All from Z q * Then, according to the secret sharing scheme, a column vector can be generated This vector is composed of l secret shares {λ1,λ2,…,λ l}. And for all i∈[1,l], the secret share λ i Belongs to attribute ρ(i). It is worth emphasizing that the LSSS structure has the characteristic of linear reconstruction, that is, let M and ρ share the generation matrix and mapping function respectively, then for any authorized attribute set S∈A, there must be a set of constants So that the equation ∑ i∈j ω i M i=(1,0,…,0)) holds, where I = i∈[l]. Then for any secret value s, when {λ i} i∈I is its effective share, the following equation must hold:∑ i∈I ω i λ i =(∑ i∈I i i )·v=(1,0,...,0)·(s,r2,...,r l ) T That is, the secret value s can be obtained by accessing the effective share {λ i} i∈I Linear recovery. However, for a non-authorized attribute set There is no set of constants that satisfies the above conditions, so s cannot be calculated from the effective share.

[0025] Step 3-2: The data owner formulates the access policy P for data M, and then transforms P into the policy expression A(M,ρ) that satisfies LSSS. is a matrix with l rows and y columns. The function ρ:[l]→S can transform M j , mapped to an attribute in S. Where S is the set of attributes contained in P, M j is the jth row of M, j∈[1, l], then the data owner runs the encryption algorithm Encrypt(PK, M, (M j , ρ i )i∈I)→CT to obtain the data ciphertext CT={C0,(X j ,Y j ,E j (C j ,l,D j ,l),...,(C j ,I,D j ,l))j∈I}

[0026] Step 4: In the decryption module, the data user downloads the ciphertext M of the message he needs from the cloud storage. The data user needs to verify. After the verification, the trusted authority transmits the private key to the data user, and then starts the decryption algorithm Decrypt(PK, CT, SK) for the private key of the access structure (M, ρ) and the attribute set S. Assume that S satisfies the access structure, and let I{1, 2, ..., l}, defined as I = {i:ρ(i)∈S}, then, let is a constant set, if λ i is the effective share of any secret s according to M, then calculate

[0027]

[0028] The decryption algorithm can then divide this value from C to obtain the message M.

Claims

1. A privacy-preserving record linking method based on attribute encryption, characterized in that: The following steps are involved: Step 1: Each data owner first pre-processes the data locally and uses data cleaning to clean dirty data such as missing and noisy data. Subsequently, the data is converted into a standard format. A trusted authority is used to determine the security parameters and attribute sets, and to generate public parameters and master keys; Step 2: The trusted authority generates a user private key based on the access policy and user permissions, and transmits it to the data user through a secure channel; Step 3: The data owner uses the linear secret sharing method to divide the data attributes into multiple secret shares, generates encrypted ciphertext based on the access policy and stores it in the cloud storage; Step 4: The data user downloads the ciphertext from the cloud storage and uses the user's private key to match the attributes. If the access policy is met, the ciphertext is decrypted to obtain the plaintext.

2. According to claim 1, a privacy protection record linking method based on attribute encryption is characterized in that: The process of generating public parameters and master keys described in step 1 is as follows: the trusted authority uses a bilinear mapping method to t is a multiplication cycle of two prime numbers of order P, g is a generator of group G1, e:G1×G2→G t is a bilinear map. is the complete set of attributes in the system, for each attribute The attribute value set P under i = {V i , 1, ... V i , j , ... V i , n }, for each attribute value V i，j Random selection, According to the hash function H2: H3:G t →{0,1} m , H4: G0→{0,1} m . Randomly choose α, u, v∈G0, generate public parameters PK and master key MSK.

3. According to claim 1, a privacy protection record linking method based on attribute encryption is characterized in that: The process of generating a user private key according to the access policy and user rights described in step 2 is as follows: the trusted authority stores the processed public parameters and master key, uses KeyGen(PK, MSK, S) → SK, and the algorithm is called by the authority, inputs the system's public key PK, master key MSK and user attribute set Randomly select the data owner For V i,j ∈S(i∈[1,n],j∈[1,n]), select calculate .

4. A privacy protection record linking method based on attribute encryption according to claim 1, characterized in that: The encrypted ciphertext generation process described in step 3 is: Step 3-1: Linear secret sharing is a l j ×n j The secret value of the data attribute is split into multiple shares through linear secret sharing, and each share is distributed to a different vector. Assume that there must be a shared generation matrix And a mapping function ρ exists such that M i can be mapped to specific attributes in the set U through ρ, that is, ρ:[l]→U, where i∈[1,l],M i is the i-th row of the matrix M. In addition, given a row vector v = (s, r2, ..., r l ), where r2,...,r l All from Z q * Then, according to the secret sharing scheme, a column vector can be generated This vector is composed of l secret shares {λ1,λ2,…,λ l }. And for all i∈[1,l], the secret share λ i Belongs to attribute ρ(i). It is worth emphasizing that the LSSS structure has the characteristic of linear reconstruction, that is, let M and ρ share the generation matrix and mapping function respectively, then for any authorized attribute set S∈A, there must be a set of constants So that the equation ∑i ∈j ω i M i =(1,0,…,0)) holds, where I = i∈[l]. Then for any secret value s, when {λ i } i∈I is its effective share, the following equation must hold:∑ i∈I ω i λ i =(∑ i∈I i i )·v=(1,0,...,0)·(s,r2,...,r l ) T That is, the secret value s can be obtained by accessing the effective share {λ corresponding to each attribute in the policy i } i∈I Linear recovery. However, for a non-authorized attribute set There is no set of constants that satisfies the above conditions, so s cannot be calculated from the effective share. Step 3-2: The data owner formulates the access policy P for data M, and then transforms P into the policy expression A(M,ρ) that satisfies LSSS. is a matrix with l rows and y columns. The function ρ:[l]→S can transform M j , mapped to an attribute in S. Where S is the set of attributes contained in P, M j is the jth row of M, j∈[1, l], then the data owner runs the encryption algorithm Encrypt(PK, M, (M j , ρ i )i∈I)→CT to obtain the data ciphertext CT={C0,(X j ,Y j ,E j (C j ,l,D j ,l),...,(C j ,I,D j ,l)) j∈I.

5. According to claim 1, a privacy protection record linking method based on attribute encryption is characterized in that: The decryption process described in step 4 is as follows: the data user downloads the ciphertext M of the message he needs through the cloud storage, and the data user needs to verify. After the verification, the trusted authority transmits the private key to the data user, and then starts the decryption algorithm Decrypt(PK, CT, SK), which is used to access the private key of the structure (M, ρ) and the attribute set S. Assume that S satisfies the access structure, and set I{1, 2, ..., l}, defined as I = {i: ρ(i)∈S}, then, let is a constant set, if λ i is the effective share of any secret s according to M, then calculate The decryption algorithm can then divide this value from C to obtain the message M.

Images