Privacy information retrieval method, system, device and storage medium

Abstract

The application relates to the technical field of secure multi-party computation, and specifically provides a privacy information retrieval method, system, device and storage medium, which comprises the following steps: a client generates a plurality of keys based on an index and preconfigured parameters by using a key generation algorithm, and respectively distributes the plurality of keys to a plurality of corresponding servers; a server calculates a secret sharing vector corresponding to an index of a table item of a database in parallel based on the received keys, and performs vector point multiplication on the secret sharing vector and the database table item to obtain intermediate data; the server performs parallel reduction XOR on the intermediate data, and sends the reduction result to the client as an evaluation result; and the client performs XOR operation on all the received evaluation results to obtain the database table item data corresponding to the index. The application realizes privacy information retrieval based on the global evaluation of DPF, significantly improves the query efficiency by reducing repeated calculation and pruning strategies, and realizes efficient query under large-scale data processing.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of secure multi-party computation, and particularly relates to a private information retrieval method, system, device and storage medium. BACKGROUND

[0002] Private information retrieval (PIR) technology is an encryption technology that completes data query while protecting privacy. It allows users to obtain the required data from the server without exposing their query intentions. Because the server side is not trusted, the server side does not know the specific data queried by the user. This feature is particularly important in query scenarios involving sensitive information.

[0003] Although PIR technology provides theoretical advantages in privacy protection, it still faces several challenges in practical application, especially in terms of query performance. PIR protocols usually rely on complex encryption algorithms such as homomorphic encryption, lattice cryptography, etc. These algorithms have high computational complexity, resulting in long query times. In addition, PIR protocols also require a large amount of data transmission, which further increases communication overhead. When dealing with large-scale databases (such as millions of data records), traditional PIR solutions are difficult to meet the performance requirements in practical applications. SUMMARY

[0004] In view of the above shortcomings of the prior art, the present application provides a private information retrieval method, system, device and storage medium to solve the above technical problems.

[0005] In a first aspect, the present application provides a private information retrieval method, comprising:

[0006] The client generates a plurality of keys based on the index and pre-configured parameters using a key generation algorithm, and distributes the plurality of keys to the corresponding plurality of servers respectively;

[0007] The server calculates the secret sharing vector corresponding to the table index of the database in parallel based on the received keys, and performs vector dot multiplication between the secret sharing vector and the database table to obtain intermediate data;

[0008] The server performs parallel reduction on the intermediate data, and sends the reduction result as an evaluation result to the client;

[0009] The client performs XOR operation on all received evaluation results to obtain the database table data corresponding to the index.

[0010] In an optional embodiment, the client generates a plurality of keys based on the index and pre-configured parameters using a key generation algorithm, and distributes the plurality of keys to a corresponding plurality of servers, comprising:

[0011] Obtaining the number of servers, and setting the number of keys equal to the number of servers;

[0012] Generating a plurality of keys based on the number of keys using a key generation algorithm, the key generation algorithm comprising:

[0013]

[0014] wherein, is the index, =1, is a set security parameter, is an Abelian group;

[0015] Distributing the plurality of generated keys to a corresponding plurality of servers.

[0016] In an optional embodiment, the method further comprises:

[0017] Based on the tensor transformation technology, reducing the key size from bits to bits, where n is the length of the point query function;

[0018] Using a pseudo-random function to generate a double-length pseudo-random number based on a seed with a length of In the key generation process, the generated correction word in each layer controls the output consistency through the pseudo-random number, and the introduction of the correction word in each layer ensures that the secret sharing on the non-target path remains consistent.

[0019] In an optional embodiment, the server calculates the secret sharing vector corresponding to the index of the table entry of the database in parallel based on the received key, and performs vector dot multiplication on the secret sharing vector and the database table entry to obtain intermediate data, comprising:

[0020] Setting the database to contain pieces of data, in the binary tree constructed by the distributed point function, using a global evaluation function, starting from the root node of the binary tree to calculate downward, wherein the root node starts a thread to calculate a pseudo-random function to obtain the random seed and control bit value of the second layer, the second layer starts two threads to calculate the pseudo-random function twice to obtain the random seed and control bit value of the third layer, and iterates layer by layer, and in the last layer, starting threads calculate the secret sharing vector according to the final random seed and control bit value;

[0021] In the kernel function, wait for all threads to complete the synchronous calculation and evaluation to obtain the secret shared vector, and then calculate the vector dot product of the secret shared vector and the database table entry in parallel.

[0022] In one optional implementation, the server computes, on the basis of the received key, in parallel the secret sharing vector corresponding to the table entry index of the database, including:

[0023] In the construction of distributed point functions, the input is defined. arrive function ;

[0024] The first server generates a secret sharing vector based on the received key. The second server generates a secret sharing vector based on the received key. ;

[0025] when hour, This ensures consistent secret sharing on non-target paths;

[0026] when hour, This ensures that the secret sharing at the target index is inconsistent, making it easier to recover data on the target index.

[0027] In an optional implementation, the intermediate data is reduced in parallel on the server side, and the reduction result is sent to the client as an evaluation result, including:

[0028] In the first kernel function, the result of the vector dot product is reduced within a warp. The number of threads per block is set in the kernel function. Then each block has / 32 warps, reduced to the following: There are 32 results, which are stored in shared memory. The first warp reads the shared memory and performs a second reduction to obtain a single result. In total, there are... Each block corresponds to The result will The result is stored in global memory and returned;

[0029] Start a second kernel function to repeatedly perform warp reduction, and obtain the result Each result is stored in global memory;

[0030] The result of the second reduction is XORed to obtain the final reduction result.

[0031] In an optional implementation, the client performs an exclusive OR operation on all received evaluation results to obtain database table item data corresponding to the index, including:

[0032] receiving evaluation results and ;

[0033] performing an exclusive OR operation on the evaluation results:

[0034]

[0035] database table item data corresponding to the index .

[0036] In a second aspect, the present application provides a private information retrieval system, comprising:

[0037] a key generation module configured to generate a plurality of keys based on an index and pre-configured parameters using a key generation algorithm at a client side, and distribute the plurality of keys to a plurality of server sides respectively;

[0038] a first calculation module configured to calculate a secret sharing vector corresponding to an index of a database table based on a received key at a server side in parallel, and perform a vector dot product between the secret sharing vector and a database table item to obtain intermediate data;

[0039] a second calculation module configured to perform parallel reduction on the intermediate data at the server side, and send a reduction result as an evaluation result to the client side;

[0040] a data acquisition module configured to perform an exclusive OR operation on all received evaluation results at the client side to obtain database table item data corresponding to the index.

[0041] In a third aspect, an apparatus is provided, comprising:

[0042] a memory configured to store a private information retrieval program;

[0043] a processor configured to implement the steps of the private information retrieval method provided in the first aspect when the private information retrieval program is executed.

[0044] In a fourth aspect, a computer readable storage medium is provided, and the storage medium stores a private information retrieval program. When the private information retrieval program is executed by a processor, the steps of the private information retrieval method provided in the first aspect are implemented.

[0045] The present application has the beneficial effect that the private information retrieval method, system, apparatus and storage medium provided by the present application achieve private information retrieval based on DPF global evaluation, and by reducing repeated calculation and pruning strategies, the calculation complexity of DPF is reduced from decreased to , significantly improve the query efficiency. On this basis, the GPU acceleration technology is adopted, the parallel calculation of global evaluation is realized by using CUDA architecture, and efficient query under large-scale data processing is realized. Meanwhile, the parallel global evaluation is fused with vector point multiplication, reduction algorithm, and the optimization reduction strategy is fully applied, the use of global memory and shared memory is reduced, and the query time and calculation cost are greatly reduced.

[0046] In addition, the design principle of the application is reliable, the structure is simple, and it has very wide application prospect. BRIEF DESCRIPTION OF DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiment or prior art description, and obviously, other drawings can also be obtained by those skilled in the art without creative labor.

[0048] Figure 1 is a schematic flow chart of the method of an embodiment of the present application.

[0049] Figure 2 is a schematic block diagram of the method of an embodiment of the present application.

[0050] Figure 3 is a schematic principle diagram of the method of an embodiment of the present application.

[0051] Figure 4 is a schematic application scenario diagram of the method of an embodiment of the present application.

[0052] Figure 5 is a schematic block diagram of the system of an embodiment of the present application.

[0053] Figure 6 is a structural schematic diagram of an apparatus provided by an embodiment of the present application. DETAILED DESCRIPTION

[0054] In order to make the person skilled in the art better understand the technical solutions in the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should belong to the scope of protection of the present application.

[0055] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used in the description herein is for describing particular embodiments only and is not intended to be limiting of the application.

[0056] The key terms appearing in the present application are explained as follows:

[0057] Binary Tree (BT);

[0058] Secure Multi-Party Computation (MPC);

[0059] Private Information Retrieval (PIR);

[0060] Function Secret Sharing (FSS);

[0061] Distributed Point Function (DPF);

[0062] Correction Words (CW);

[0063] Pseudorandom Generator (PRG);

[0064] thread;

[0065] warp;

[0066] block.

[0067] The private information retrieval method provided by the embodiments of the present application is executed by a computer device, and accordingly, the private information retrieval system runs in the computer device.

[0068] Figure 1 is a schematic flowchart of the method of one embodiment of the present application. Wherein, Figure 1 The execution subject can be a private information retrieval system. According to different requirements, the order of steps in the flowchart can be changed, and some can be omitted.

[0069] As shown in Figure 1 , the method comprises:

[0070] S1. generating a plurality of keys based on an index and a preconfigured parameter by using a key generation algorithm at a client side, and distributing the plurality of keys to a plurality of corresponding server sides respectively.

[0071] On the client side, we utilize a key generation algorithm that generates multiple keys based on a specific index and pre-configured parameters. These pre-configured parameters may include algorithm type, key length, random seed, etc., which collectively determine the characteristics and security of the generated keys. The generated multiple keys are then distributed to the corresponding multiple servers respectively to ensure distributed storage and processing of data.

[0072] S2. On the server side, based on the received keys, the secret sharing vectors corresponding to the table index of the database are calculated in parallel, and the secret sharing vectors are multiplied by the database table entries to obtain intermediate data.

[0073] On the server side, once the respective keys are received, they will use these keys to calculate the secret sharing vectors corresponding to the table index of the database in parallel. This process may involve complex mathematical operations and encryption algorithms to ensure the confidentiality and integrity of data. Secret sharing vector is a special encryption technology that divides the original data into multiple parts, each containing part of the original data information, but a single part cannot restore the complete original data. In this way, even if the data of a server is leaked, attackers cannot obtain the complete database table data.

[0074] Next, the server will perform vector dot multiplication operation on the calculated secret sharing vectors and the database table entries. Vector dot multiplication is a linear algebra operation that multiplies the corresponding elements of two vectors and sums them up to get a scalar result. The purpose of this step is to combine the secret sharing vectors with the database table data to generate an intermediate data. This intermediate data contains both the database table data information and maintains the encryption characteristics of the original data.

[0075] S3. On the server side, the intermediate data is reduced in parallel, and the reduction result is sent to the client as the evaluation result.

[0076] After the server completes the generation of intermediate data, they will perform parallel reduction on these data. Parallel reduction is an optimization technique that speeds up the calculation process by dividing the data into multiple parts and processing these parts simultaneously. The result of reduction is one or more summary values, which represent some statistical characteristics or calculation results of all intermediate data. In this scenario, the reduction result is sent back to the client as the evaluation result.

[0077] S4. On the client side, all received evaluation results are XORed to obtain the database table data corresponding to the index.

[0078] On the client side, once all the server evaluation results are received, it will perform an XOR operation on these results. XOR operation is a binary operation that compares the corresponding bits of two binary numbers. If they are the same, the result is 0, if they are different, the result is 1. By performing XOR operation on all evaluation results, the client can restore the database table item data corresponding to the original index. This process takes advantage of the reversibility and linearity of the XOR operation, ensuring the correctness and integrity of the data.

[0079] The application scenario of the present application is that the Client sends a request to the Server to retrieve the corresponding table item of the database through the index without leaking to the Server. The overall architecture of the privacy information retrieval scheme based on distributed point functions proposed by the present application is shown in Figure 2 .

[0080] The Client first calculates generates a key pair ), and distributes it to two servers Server0 and Server1. After the servers receive the key, they perform global evaluation operations respectively to generate secret shares . Then, these secret shares are subjected to vector point multiplication with the database , and the results are all XORed and returned to the client. The client performs XOR operation on the results returned by the two servers to restore the target data . This scheme improves the retrieval efficiency through key distribution and parallel computing, and ensures the privacy and correctness of the query.

[0081] In an embodiment of the present application, based on step S1, a possible embodiment will be given below to illustrate the specific implementation of the present application.

[0082] Obtain the number of servers and set the number of keys equal to the number of servers;

[0083] Generate a plurality of corresponding keys based on the number of keys using a key generation algorithm, the key generation algorithm comprising:

[0084]

[0085] wherein, is an index, =1, is a set security parameter, is an Abelian group.

[0086] Gen() specifically includes:

[0087]

[0088] The generated keys are distributed to the corresponding servers.

[0089] In the overall architecture of the solution, DPF-PIR generates two-part keys through a Distributed Point Function (DPF) to support privacy protection for user queries. A Distributed Point Function is an algorithmic construct that allows clients to perform queries based on a target index. and target data value Generate two keys and The data is sent to two uncooperative servers respectively. In the construction of the DPF, the input is defined... arrive function Two keys generated by DPF and It was distributed to two different servers.

[0090] The index is a key variable, typically starting from 0 and incrementing, assigning a unique identifier to each key. The security parameter is crucial, determining the complexity and unbreakability of the generated key. Abel groups provide a mathematical framework that allows operations in cryptographic algorithms to be performed within this framework, guaranteeing properties such as closure and associativity.

[0091] Please refer to Figure 3 In one embodiment of the present invention, based on step S2, the following will provide a possible embodiment and describe its specific implementation in a non-limiting manner.

[0092] S201. On the server side, based on the received key, the secret sharing vector corresponding to the table entry index of the database is calculated in parallel.

[0093] Using the index as the objective function f between 0 and 1, the objective function... Decomposed into multiple shared shares:

[0094] Let the family of functions It contains the following two sets:

[0095] Represents the set of function descriptions;

[0096] It is a multinomial-time algorithm used to calculate the time of a function based on its description. Calculate the function value.

[0097] assumed A function was defined ,in It is the input field. is the output domain. The computational formula of this function is In general, it is assumed that the input domain is a binary string of length , while the output domain is a finite Abelian group . To simplify the expression, the function descriptor will be omitted, and will be used directly to represent the corresponding function.

[0098] The secret sharing algorithm includes a key generation algorithm Gen and an evaluation algorithm Eval. They are responsible for key generation and computation respectively. Specifically, assuming there are participants, the implementation steps of the FSS scheme are as follows:

[0099] : This is a key generation algorithm completed in polynomial time. The algorithm accepts input (safety parameter) and (description of function ), and outputs a tuple of keys ; where contains information such as input length , group description , and scale parameter ;

[0100] : This is an evaluation algorithm completed in polynomial time. The algorithm accepts input (participant index), key (key defining function ), and (input). It outputs a group element , where represents the value of , i.e. the partial output of the function at the th participant, corresponding to the th share of .

[0101] In this embodiment, the default setting is . In the case of , the index of the participant is simplified to instead of , in order to facilitate the representation of a two-party scenario.

[0102] Gen accepts the security parameter and the input , generates the key pair , and ensures that during evaluation, Satisfies:

[0103] ,

[0104] The lightweight nature of the algorithm makes it possible to quickly generate key pairs on client devices. In the PIR scheme, the client protects the privacy of the query through key distribution.

[0105] It should be noted that the present embodiment adopts not the additive secret sharing described above, but the subtractive secret sharing. In this sharing manner, when the calculation result is located at the target index, the result of subtracting or XORing the two is 1, thereby ensuring that the data can be correctly recovered at the target index. In addition, the characteristics of subtractive secret sharing can further improve the efficiency and security of the scheme, because subtractive operation is usually more efficient in implementation, and has the advantage of simplified processing in data recovery.

[0106] Eval is a key evaluation process performed on the server, including:

[0107]

[0108] After the server receives the key or , it performs a global evaluation operation respectively to generate secret shares and . Then, the server performs vector point multiplication on these secret shares with the database entries, obtains the response data, performs XOR operation and returns it to the client. The client performs XOR operation on the returned results of and , thereby recovering the target data . When , , it ensures that the calculation results of non-target indexes remain consistent; when , , to ensure that the data is recovered at the target index.

[0109] In the construction of DPF, this paper defines a function from the input to . The two keys and generated by DPF are distributed to two different servers. Each server evaluates each entry in the database according to the key it holds, generating secret shares and . These secret shares have the following properties:

[0110] When , , it ensures that the secret shares on the non-target path are consistent.

[0111] When , , ensure that the secret sharing at the target index is inconsistent, facilitate the recovery of data on the target index.

[0112] By XOR operation on all corresponding multiplication results, it can be ensured that only at the target index get non-zero result, that is, 1, and get zero at other positions. This feature makes the XOR operation an effective verification method, and the specific calculation formula is as follows. In the formula, and are the intermediate results returned by the two servers respectively. Through XOR operation, it is ensured that the correct data is recovered at the target index . At the same time, due to the pseudo-random construction of DPF, the user's query content cannot be guessed by a single server, thus realizing privacy protection.

[0113] When , , that is , the product , ensure that non-target data items will not affect the final result. This multiplication operation combines the core idea of DPF scheme, that is, through XOR to ensure the correctness of the target index, and through multiplication with the database to recover the target data.

[0114] Through the above parallel calculation and multiplication operation, the final result is the target data item :

[0115]

[0116]

[0117]

[0118]

[0119]

[0120] This design ensures that the secret sharing at the target index can accurately recover the target data item, and remains zero at non-target indexes, thus realizing the correctness and privacy of PIR.

[0121] To improve efficiency, this invention combines mathematical optimization and GPU acceleration. It employs global evaluation during computation to reduce computational overhead and leverages the parallel capabilities of the GPU to accelerate query processing. Furthermore, to reduce communication overhead, a communication compression strategy is designed to decrease the amount of data queried and returned, thereby improving the communication performance of large-scale database queries.

[0122] In classic DPF schemes, to support lengths of... The dot lookup function typically has a key size of 1. bits, of which These are security parameters. To optimize the key size, this invention redesigns the key structure based on tensor transformation technology, reducing the key size to [a smaller value]. The reduced number of bits lowers communication and storage requirements, making the DPF more suitable for large-scale PIR applications.

[0123] The DPF generation algorithm also utilizes a pseudo-random generator (PRG), whose receive length is... Using a seed as input, a pseudo-random string of double length is generated. During key generation, the correction word (CW) generated at each layer is used to control output consistency via a pseudo-random tree. Introducing correction words at each layer ensures consistent secret sharing on non-target paths, thus supporting efficient and private queries.

[0124] Through the DPF optimization design of this invention, users can retrieve specific data items from the server in a DPF-based PIR system without revealing the query content. The key generated by DPF and the sharing mechanism prevent a single server from inferring the user's true query intent, thus achieving privacy protection. In experiments and theory, its performance advantages in large-scale data scenarios, through efficient key distribution and parallel computing mechanisms, ensure both privacy and query efficiency.

[0125] DPF function Only for individual inputs An evaluation is required, but what is needed in PIR is... A vector consisting of the secret shared by all numbers within an interval. Assume the database contains... When querying data using the basic DPF scheme, the server needs to handle data with a height of [value missing]. The computational complexity of traversing the entire binary tree level by level is O(n log n). ,in = To improve efficiency, this invention employs Full Domain Evaluation, specifically the EvalAll function, which allows the evaluation algorithm to utilize shared paths among tree nodes, reducing repetitive operations during computation and thus lowering the overall computational complexity. Down to .

[0126] The implementation of the conventional EvalAll function is to reduce the number of PRF function calls by recursively calculating from the leaf nodes of the binary tree upwards. The basic idea is that in the tree structure constructed by DPF, the value stored by the parent node determines the random seed and control bit value of the child nodes Unlike the Eval function, which only calculates the value corresponding to the path of the binary representation of x, EvalAll calculates the values corresponding to the left and right sub-paths at each layer for the next layer, thereby reducing the time of repeated calculation. To fully parallelize the global evaluation, the EvalAll function is modified to calculate from the root node downwards, where the root node starts a thread to calculate PRF once to get the and of the second layer, the second layer starts two threads to calculate PRF twice to get the and t of the third layer, and so on. At the last layer, start threads to calculate the secret sharing according to the final and .

[0127] A random seed is a starting value used to generate random numbers or random sequences. In the fields of encryption, simulation, data analysis, etc., the generation of random numbers or random sequences is crucial. The choice of random seed directly affects the randomness and unpredictability of the generated random number sequence. In your description, the random seed is used to generate random elements at each layer of the binary tree, which may be used for subsequent encryption, decryption, data obfuscation, etc., to ensure the security of the data.

[0128] Control bit value, commonly referred to as control bit or control bit, is a binary value used to control data processing flow or data conversion. Control bit value, together with random seed, is used to generate or control the calculation process at each layer of the binary tree. These control bit values may determine which data is processed, how to process, and the order of data processing, etc. In the field of encryption, control bit value can also be used to implement specific encryption algorithms or encryption modes to ensure the confidentiality and integrity of data.

[0129] S202. Vector dot product the secret sharing vector with the database table item to get intermediate data.

[0130] After obtaining the result of global evaluation, i.e. the vector , it is also necessary to multiply the vector with the database table item Vector dot product is performed. Instead of saving and returning the result of the kernel function calculation in the full field evaluation, a more suitable method is to directly wait for all threads in the kernel function to synchronize the calculation of the evaluation result, and then calculate the vector dot product in parallel to obtain .

[0131] In an embodiment of the present application, based on step S3, a possible embodiment will be given below to specifically and non-limitingly illustrate the implementation thereof.

[0132] After the result of the vector dot product is calculated, all results need to be XORed. To fully utilize the computing resources and characteristics of the GPU, the present application adopts a highly optimized reduction algorithm.

[0133] Specifically, in the first kernel function, the result of the vector dot product is directly subjected to intra-warp reduction. Assuming that the number of thread_per_block set in the kernel function is , then each block has / 32 warps, and the reduction obtains / 32 results, which are stored in the shared memory. In the first warp, the shared memory is read and subjected to a second reduction to obtain one result, and there are a total of blocks corresponding to results. Finally, these results are stored in the global memory and returned. The second kernel function is started again to repeat the intra-warp reduction, and finally results are stored in the global memory. The results of the second reduction are directly XORed on the CPU of the server to obtain the final result.

[0134] Compared with the conventional reduce operator, this reduction method uses operations on local memory instead of operations on shared memory, solves the problem that the block shared memory cannot accommodate large-scale data, and greatly optimizes the performance of the reduction. Finally, the read-write scale of the global memory is also greatly reduced.

[0135] In an embodiment of the present application, based on step S4, a possible embodiment will be given below to specifically and non-limitingly illustrate the implementation thereof.

[0136] The evaluation results and are received.

[0137] The evaluation results are subjected to XOR operation:

[0138]

[0139] The database table item data corresponding to the index .

[0140] On the basis of the above embodiments, further provide a specific application scenario, such as Figure 4 As shown in the figure:

[0141] There is a client Client and two independent server , . Respectively store the same database , the size of the database is . Client sends retrieval request to Server, Server will return secret sharing under the condition of not knowing the index , Client restores by two secret shares.

[0142] The flow chart of the scheme is as the scheme overall framework in the foregoing, the specific steps are as follows:

[0143] (1) Key generation and distribution stage, including:

[0144] For the database table index to be retrieved , Client sets the parameter of , and then calculates the Gen function to generate the key pair );

[0145] Client sends the calculated key to the server , .

[0146] (2) Server evaluation stage, taking server as an example, the processing method includes:

[0147] Server receives the key ;

[0148] Parallelly calculate to get the secret sharing corresponding to the database all table index b , and multiply the secret sharing with the database table to get ;

[0149] Use the optimized reduction algorithm to parallelly reduce all , and finally get the reduction result ;

[0150] Send the final evaluation result to Client.

[0151] (3) the recovery search data stage, comprising:

[0152] The client receives two evaluation results and , calculates The index of the database table item that can be recovered is .

[0153] In some embodiments, the privacy information retrieval system can include a plurality of functional modules composed of computer program segments. The computer programs of each program segment in the privacy information retrieval system can be stored in the memory of the computer device and executed by at least one processor to perform the functions of privacy information retrieval (see Figure 1 for a detailed description).

[0154] In this embodiment, the privacy information retrieval system can be divided into a plurality of functional modules according to the functions it performs, as shown in Figure 5 . The functional modules of the system 500 can include a key generation module 510, a first calculation module 520, a second calculation module 530, and a data acquisition module 540. The module referred to by the present application refers to a series of computer program segments that can be executed by at least one processor and can complete a fixed function, which is stored in the memory. In this embodiment, the functions of each module will be described in detail in subsequent embodiments.

[0155] The key generation module is configured to generate a plurality of keys based on an index and preconfigured parameters using a key generation algorithm at a client, and distribute the plurality of keys to a corresponding plurality of servers respectively.

[0156] The first calculation module is configured to calculate, at a server, a secret sharing vector corresponding to an index of a database table item in parallel based on a received key, and perform vector dot multiplication between the secret sharing vector and the database table item to obtain intermediate data.

[0157] The second calculation module is configured to perform parallel reduction on the intermediate data at the server, and send a reduction result to the client as an evaluation result.

[0158] The data acquisition module is configured to perform an exclusive OR operation on all received evaluation results at the client to obtain database table item data corresponding to the index.

[0159] Optionally, as an embodiment of the present application, generating a plurality of keys based on an index and preconfigured parameters using a key generation algorithm at a client, and distributing the plurality of keys to a corresponding plurality of servers respectively, comprises:

[0160] Obtaining the number of servers, and setting the number of keys equal to the number of servers.

[0161] generating a corresponding plurality of keys based on the number of keys using a key generation algorithm, the key generation algorithm comprising:

[0162]

[0163] wherein, is an index, = 1, is a security parameter set, is an Abelian group;

[0164] distributing the generated plurality of keys to a corresponding plurality of the service ends.

[0165] Optionally, as one embodiment of the present application, the method further comprises:

[0166] reducing the key size from bits to bits based on a tensor transformation technique, where n is the length of the point query function;

[0167] generating a double-length pseudo-random number based on a seed with a length of bits using a pseudo-random function, and in the key generation process, the generated correction words in each layer are controlled by the pseudo-random number to ensure the output consistency, and the introduction of the correction words in each layer ensures that the secret sharing on the non-target path remains consistent.

[0168] Optionally, as one embodiment of the present application, the service end calculates the secret sharing vector corresponding to the index of the database table item in parallel based on the received key, and performs vector dot multiplication on the secret sharing vector and the database table item to obtain intermediate data, comprising:

[0169] Setting the database to contain pieces of data, in the binary tree constructed by the distributed point function, a global evaluation function is used, and calculation is started from the root node of the binary tree, wherein the root node starts a thread to calculate a pseudo-random function once to obtain the random seed and control bit value of the second layer, the second layer starts two threads to calculate the pseudo-random function twice to obtain the random seed and control bit value of the third layer, and iteration is performed layer by layer, and pieces of threads are started in the last layer to calculate the secret sharing vector according to the final random seed and control bit value;

[0170] In the kernel function, all threads are synchronized to calculate the evaluation, and the secret sharing vector is obtained, and then the vector dot multiplication of the secret sharing vector and the database table item is calculated in parallel.

[0171] Optionally, as one embodiment of the present application, the service end calculates the secret sharing vector corresponding to the index of the database table item in parallel based on the received key, comprising:

[0172] In the construction of the distributed point function, a function from input to is defined ;

[0173] The first service end generates a secret sharing vector based on the received key, and the second service end generates a secret sharing vector based on the received key;

[0174] When , , it is ensured that the secret sharing on the non-target path is consistent;

[0175] When , , it is ensured that the secret sharing at the target index is inconsistent, facilitating the recovery of data on the target index.

[0176] Optionally, as an embodiment of the present application, the intermediate data is parallel reduced on the service end, and the reduction result is sent to the client as the evaluation result, comprising:

[0177] The result of vector point multiplication is reduced within a warp in the first kernel function, the thread_per_block number set in the kernel function is , then each block has / 32 warps, and / 32 results are obtained by reduction, which are stored in shared memory, the shared memory is read in the first warp, and the second reduction is performed to obtain a result, a total of blocks correspond to results, and results are stored in global memory and returned;

[0178] The second kernel function is started to repeat the warp reduction, and results are stored in global memory;

[0179] The results of the second reduction are XOR processed to obtain the final reduction result.

[0180] Optionally, as an embodiment of the present application, all evaluation results received by the client are XOR operated to obtain the database table item data corresponding to the index, comprising:

[0181] The evaluation results and are received;

[0182] The evaluation results are XOR operated:

[0183]

[0184] with the index corresponding database table data.

[0185] Figure 6 The privacy information retrieval method provided by the embodiments of the present application can be applied to a device. Those skilled in the art can understand that the device structure involved in the embodiments of the present application does not constitute a limitation on the device, and the device can include more or fewer components than the illustration, or combine certain components, or different component arrangements. In the embodiments of the present application, the device includes but is not limited to a laptop computer, a desktop computer, a workstation, a personal digital assistant, a server, a blade server, a mainframe computer, and other suitable computers. The device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples, and are not intended to limit the implementation of the embodiments of the present application described herein and / or claimed.

[0186] The device 600 can include a processor 610, a memory 620, and a communication unit 630. These components communicate through one or more buses, and those skilled in the art can understand that the structure of the server shown in the figure does not constitute a limitation on the present application, and it can be a bus structure or a star structure, and can include more or fewer components than the illustration, or combine certain components, or different component arrangements.

[0187] The memory 620 can be used to store the execution instructions of the processor 610, and the memory 620 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk. When the execution instructions in the memory 620 are executed by the processor 610, the device 600 can execute part or all of the steps in the following method embodiments.

[0188] The processor 610 is the control center of the storage device, connects various parts of the entire electronic device by using various interfaces and lines, and executes various functions of the electronic device and / or processes data by running or executing software programs and / or modules stored in the memory 620 and calling data stored in the memory. The processor can be composed of an integrated circuit (IC), for example, can be composed of a single packaged IC, or can be composed of a plurality of packaged ICs connected together. For example, the processor 610 can only include a central processing unit (CPU). In the embodiments of the present application, the CPU can be a single operation core or can include multiple operation cores.

[0189] The communication unit 630 is configured to establish a communication channel, so that the storage device can communicate with other devices. The communication unit 630 receives user data sent by other devices or sends user data to other devices.

[0190] The present application also provides a computer storage medium, wherein the computer storage medium can store a program, and the program can include some or all steps in the embodiments provided by the present application when executed. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0191] Those skilled in the art can clearly understand that the technology in the embodiments of the present application can be realized by means of software and necessary general hardware platforms. Based on such understanding, the technical solutions in the embodiments of the present application can be embodied in the form of a software product, which is stored in a storage medium such as a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc. The software product includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a second device, a network device, etc.) to execute all or part of the steps of the method described in the embodiments of the present application.

[0192] In the present specification, the same or similar parts among various embodiments can be referred to each other. In particular, for the device embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the description in the method embodiments.

[0193] In several embodiments provided by the present application, it should be understood that the disclosed system and method can be implemented in other manners. For example, the system embodiments described above are merely schematic. For example, the division of the modules is only a logical function division. There can be another division manner for the actual implementation. For example, a plurality of modules or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections between different modules can be indirect couplings or communication connections through some interfaces, and electrical, mechanical or other forms.

[0194] The modules illustrated as separated components can or can not be physically separated, and the components illustrated as modules can or can not be physical modules, i.e., can be located in one place, or can be distributed to a plurality of network modules. Part or all of the modules can be selected according to actual needs to achieve the purpose of the embodiment.

[0195] In addition, each functional module in each embodiment of the present application can be integrated into a processing module, or each module can exist physically separately, or two or more modules can be integrated into one module.

[0196] Although the present application has been described in detail by referring to the preferred embodiments thereof, it is to be understood that the present application is not limited to the embodiments described above. Rather, it should be appreciated that those skilled in the art, upon consideration of the disclosure, can make modifications and / or improvements to the embodiments of the application without deviating from the spirit and scope of the application. Any modifications and / or improvements made to the embodiments of the application by those skilled in the art are to be considered within the scope of the application.

Claims

1. A method of private information retrieval, characterized by, The method comprises the following steps: The client generates a plurality of keys based on the index and pre-configured parameters by using a key generation algorithm, and distributes the plurality of keys to a plurality of corresponding servers respectively; The server calculates a secret sharing vector corresponding to the index of the table item of the database in parallel based on the received key, and performs vector point multiplication on the secret sharing vector and the table item of the database to obtain intermediate data; The server performs parallel reduction XOR on the intermediate data, and sends the reduction result to the client as an evaluation result; The client performs XOR operation on all the received evaluation results to obtain the database table item data corresponding to the index; The method further comprises the following steps: Based on the tensor transformation technique, the key size is reduced from bits to bits, where n is the length of the point query function. A pseudo-random function is used to generate a double-length pseudo-random number based on a seed of length In the key generation process, the generated correction word in each layer is controlled by the pseudo-random number to ensure the output consistency. The introduction of the correction word in each layer ensures that the secret sharing on the non-target path remains consistent.

2. The method of claim 1, wherein, The client generates a plurality of keys based on the index and pre-configured parameters by using a key generation algorithm, and distributes the plurality of keys to a plurality of corresponding servers respectively, which comprises the following steps: Obtain the number of servers, and set the number of keys equal to the number of servers; Generate a plurality of corresponding keys based on the number of keys by using a key generation algorithm, wherein the key generation algorithm comprises the following steps: wherein is an index, = 1, is a set safety parameter, is an Abelian group; Distribute the generated plurality of keys to a plurality of corresponding servers.

3. The method of claim 1, wherein, The server calculates a secret sharing vector corresponding to the index of the table item of the database in parallel based on the received key, and performs vector point multiplication on the secret sharing vector and the table item of the database to obtain intermediate data, which comprises the following steps: The setting database comprises The data in the distributed point function constructed binary tree, using global evaluation function, from the root node of the binary tree down to calculate, wherein the root node opens a thread to calculate a pseudo-random function to obtain the random seed and control bit value of the second layer, the second layer opens two threads to calculate two pseudo-random functions to obtain the random seed and control bit value of the third layer, and iteration is performed layer by layer, and in the last layer, a thread is opened to calculate a secret sharing vector according to the final random seed and control bit value. The data in the distributed point function constructed binary tree, using global evaluation function, from the root node of the binary tree down to calculate, wherein the root node opens a thread to calculate a pseudo-random function to obtain the random seed and control bit value of the second layer, the second layer opens two threads to calculate two pseudo-random functions to obtain the random seed and control bit value of the third layer, and iteration is performed layer by layer, and in the last layer, a thread is opened to calculate a secret sharing vector according to the final random seed and control bit value. Wait for all threads to synchronize the calculation of the evaluation in the kernel function to obtain a secret sharing vector, and then calculate the vector point multiplication of the secret sharing vector and the table item of the database in parallel.

4. The method of claim 3, wherein, The server calculates a secret sharing vector corresponding to the index of the table item of the database in parallel based on the received key, which comprises the following steps: In the construction of the distributed dot function, a function from the input to is defined; The first server generates a secret sharing vector based on the received key The second server generates a secret sharing vector based on the received key ; When time, , ensure that the secret sharing is consistent on non-target paths; When time, , ensure that the secret sharing at the target index is inconsistent, facilitate the recovery of data on the target index.

5. The method of claim 3, wherein, The server performs parallel reduction on the intermediate data, and sends the reduction result to the client as an evaluation result, which comprises the following steps: The result of vector dot product is reduced within warp in the first kernel, and the thread_per_block number is set in the kernel Then each block has / 32 warps, and the reduction results in / 32 results, which are stored in shared memory. The shared memory is read in the first warp, and the second reduction is performed to obtain one result, and there are blocks in total, corresponding to results, and the results are stored in global memory and returned; The second kernel function is started to repeat warp-in reduction, and the obtained result is stored in global memory. the second kernel function is started to repeat warp-in reduction, and the obtained result is stored in global memory. Perform XOR processing on the result of the second reduction to obtain the final reduction result.

6. The method of claim 1, wherein, The client performs XOR operation on all the received evaluation results to obtain the database table item data corresponding to the index, which comprises the following steps: receiving the evaluation result and ; Perform XOR operation on the evaluation result: with the index corresponding database table entry data.

7. A private information retrieval system characterized in that, The method comprises the following steps: A key generation module is configured to generate a plurality of keys based on the index and pre-configured parameters by using a key generation algorithm at the client, and distribute the plurality of keys to a plurality of corresponding servers respectively; A first calculation module is configured to calculate a secret sharing vector corresponding to the index of the table item of the database in parallel based on the received key at the server, and perform vector point multiplication on the secret sharing vector and the table item of the database to obtain intermediate data; A second calculation module is configured to perform parallel reduction on the intermediate data at the server, and send the reduction result to the client as an evaluation result; A data acquisition module is configured to perform XOR operation on all the received evaluation results at the client to obtain the database table item data corresponding to the index; Further comprising: Based on the tensor transformation technique, the key size is reduced from bits to bits, where n is the length of the point query function. A pseudo-random function is used to generate a double-length pseudo-random number based on a seed of length In the key generation process, the output consistency is controlled by the pseudo-random number generated by the correction word calculated in each layer. The introduction of the correction word in each layer ensures that the secret sharing on the non-target path remains consistent.

8. A private information retrieval device, characterized by The method comprises the following steps: A memory is configured to store a private information retrieval program; A processor is configured to implement the steps of the private information retrieval method according to any one of claims 1-6 when executing the private information retrieval program.

9. A computer readable storage medium storing a computer program, characterized in that, The readable storage medium stores a private information retrieval program, and the private information retrieval program implements the steps of the private information retrieval method according to any one of claims 1-6 when executed by a processor.

Images