Lattice-based privacy information retrieval method and system based on coefficient extraction

Abstract

The invention provides a lattice-based privacy information retrieval method and system based on coefficient extraction. The method comprises the steps that a user generates parameters and sends the generated parameters to a server; the parameters comprise database parameters, parameters and corresponding private keys of an RLWE scheme, parameters and corresponding private keys of an LWE scheme and an LWEGSW scheme, and a conversion key of the LWEGSW scheme; the user generates a query tuple according to the database structure and the query target, generates a ciphertext query based on the query tuple and the RLWE scheme, and sends the ciphertext query to the server; the server performs ciphertext expansion on the received ciphertext inquiry according to the received parameters, the LWE scheme and the LWEGSW scheme, performs homomorphic calculation according to a database structure, obtains inquiry feedback and sends the inquiry feedback to the user; and the user decrypts the inquiry feedback by using the private key and the LWE scheme to obtain an inquiry result. According to the method, the query efficiency can be remarkably improved, the communication overhead is reduced, and better noise control is realized.

Description

Technical Field

[0001] The present invention relates to the technical field of privacy information retrieval, and in particular to a lattice-based privacy information retrieval method and system based on coefficient extraction. Background Art

[0002] Private Information Retrieval (PIR) is a type of protocol that meets specific requirements. It allows the client to query specific records in the server's database without revealing the query target to the server. According to the security guarantee method, PIR protocols are mainly divided into information-theoretic secure multi-server solutions and computationally secure single-server solutions.

[0003] In the research of single-server PIR, the scheme based on lattice cryptography has attracted wide attention due to its resistance to quantum computing attacks. In 2016, Melchor et al. designed the XPIR protocol, which applied RLWE homomorphic encryption to PIR construction for the first time. In 2018, Angel et al. proposed the SealPIR scheme, which innovatively used the monomial x index Encode the query location and compress the query size to 0.36% of XPIR. In 2019, Polyakov et al. proposed an improved scheme based on RLWE, ACCEPTABLE, which introduced a new encoding method to reduce communication overhead. In 2021, Mughees et al. designed the OnionPIR protocol, which uses the outer product characteristics of RLWE and RGSW ciphertext to control noise growth. In 2022, Menon et al. proposed the SPIRAL protocol family, which improved the system throughput through the matrix Regev scheme and the improved GSW scheme. The advantage of this route is that it has a solid theoretical foundation and complete security proof, but the efficiency of homomorphic operations is relatively low.

[0004] Existing privacy information retrieval technology still has the following problems:

[0005] (1) The ciphertext query expansion is complex. Currently, SealPIR, OnionPIR, SPIRAL and other solutions use a coefficient extraction algorithm based on homomorphic calculation, which expands the ciphertext query vector through a certain number of loop iterations. This method not only has a complex expansion algorithm, but also involves multiple homomorphic operations, which causes the ciphertext noise to grow too fast, and requires larger parameter settings to ensure correctness.

[0006] (2) The query computation overhead is large. The homomorphic inner product of OnionPIR, SPIRAL and other schemes is based on the RLWE or LWE mathematical difficulty problem. Since the ciphertext is in the form of a binary on a polynomial ring, the ciphertext size is large. A large number of polynomial operations are required during the homomorphic computation process, which leads to rapid accumulation of noise, requires large parameter settings, and has significant computational overhead.

[0007] (3) Heterogeneous ciphertext conversion is difficult. When performing homomorphic inner product operations, schemes such as OnionPIR and SPIRAL must convert the query ciphertext from BFV / Regev ciphertext to GSW ciphertext. This conversion requires using the GSW homomorphic encryption scheme to encrypt the private key and send the private key ciphertext to the server, which not only increases the communication overhead during the query, but also requires complex conversion operations. Summary of the invention

[0008] In view of the problems existing in the above-mentioned existing privacy information retrieval technology, the present invention provides a lattice-based privacy information retrieval method and system based on coefficient extraction, which adopts the RLWE / LWE difficulty problem in lattice cryptography, and through innovative coefficient extraction algorithms and efficient ciphertext conversion technology, significantly improves query efficiency, reduces communication overhead, and achieves better noise control.

[0009] The present invention provides a lattice-based privacy information retrieval method based on coefficient extraction, comprising:

[0010] System establishment phase: the user generates parameters and sends the generated parameters to the server; the parameters include database parameters, parameters and corresponding private keys of the RLWE scheme, LWE scheme and LWEGSW scheme, and LWEGSW scheme conversion key; the RLWE scheme, LWE scheme and LWEGSW scheme maintain the same algebraic structure;

[0011] Query generation phase: The user generates a query tuple according to the database structure and query target, generates a ciphertext query based on the query tuple and the RLWE scheme, and sends the ciphertext query to the server;

[0012] In the response calculation phase, the server performs ciphertext expansion on the received ciphertext query according to the received parameters and the LWE scheme and LWEGSW scheme, and performs homomorphic calculation according to the database structure to obtain query feedback and send it to the user;

[0013] In the result acquisition stage, the user receives the query feedback and uses the private key and LWE scheme to decrypt the query feedback to obtain the query result.

[0014] In some embodiments, the user-generated parameters include:

[0015] According to the safety parameter λ and the decision-type RLWE difficulty problem, the input parameters of the RLWE scheme, the LWE scheme and the LWEGSW scheme are generated;

[0016] Generate the corresponding private key according to the input parameters of the RLWE scheme;

[0017] Generate a LweGSW conversion key based on the private key;

[0018] Determine database parameters based on database size.

[0019] In some embodiments, the database structure adopts a (p+1)-dimensional hypercube organization form:

[0020] 1st Dimension: Units;

[0021] Dimensions 2 to p+1: 2 units per dimension;

[0022] The database parameters include p and p1.

[0023] In some embodiments, the query generation stage includes:

[0024] Based on the database structure and the query target index, the query index conversion algorithm QueryTupleGen(index) is used to generate a p+1-dimensional query tuple (i, j1, j2, …, j p )←QueryTupleGen(index);

[0025] Based on the private key s and the p+1-dimensional query tuple (i, j1, j2, …, j p ), according to the ciphertext query construction algorithm EncQueryGen(s,(i,j1,j2,…,j p )) to generate the ciphertext query c query ←EncQueryGen(s,(i,j1,j2,…,j p )).

[0026] In some embodiments, the query index conversion algorithm includes:

[0027] Calculate the first dimension index:

[0028] Get the remainder: tmp = index-i·2 p ;

[0029] Calculate the index of each dimension:

[0030] Cycle k from 1 to p:

[0031]

[0032] tmp=tmp-j k 2 p-k

[0033] Output p+1-dimensional query tuple (i, j1, j2, ..., j p ).

[0034] In some embodiments, the ciphertext query construction algorithm includes:

[0035] Initialize a polynomial μ(x);

[0036] Embed the information of each dimension cyclically in the polynomial μ(x) in a self-additive manner;

[0037] Based on the polynomial μ(x) after cyclic embedding of each dimension information, the encryption calculation in the RLWE scheme is used to generate the query c query ;

[0038] Output ciphertext query c query .

[0039] In some embodiments, the response calculation phase includes:

[0040] (1) Ciphertext query extension:

[0041] Query c from the ciphertext query Extract N LWE ciphertexts;

[0042] Based on N LWE ciphertexts, construct p+1 groups of ciphertexts corresponding to each dimension in the database structure:

[0043] Generate ct LWE Group and ct LWEGSW,0 to ct LWEGSW,p-1 Group; N LWE ciphertexts (c LWE,0 ,c LWE,1 ....,c LWE,N ) is divided into p+1 groups:

[0044] Group 1:

[0045] Subsequent p-groups: Transform the key K by entering the LWEGSW scheme i And call the LWETOGSW algorithm to convert the LWE ciphertext group into the LweGSW ciphertext group: ct LWEGSW，k ,k=0,1,…,p-1;

[0046] (2) Perform dense state query calculation based on homomorphic outer product:

[0047] Use the first group of ciphertext ct LWE Process the first dimension data;

[0048] Use ct LWEGSW,0 to ct LWEGSW,p-1 , based on the homomorphic outer product of LWE ciphertext in LWE scheme to LWEGSW encoding in LWEGSW scheme, the subsequent dimensional data is processed;

[0049] After the processing is completed, the query feedback is output.

[0050] In some embodiments, the query from the ciphertext c query Extract N LWE ciphertexts, including:

[0051] Define a transformation that means flipping the 0th to ith consecutive elements of the coefficient vector of the polynomial, and flipping the i+1th to N-1th consecutive elements;

[0052] Based on the defined transformation, from the ciphertext query c query Extract N LWE ciphertexts from .

[0053] In some embodiments, the LWETOGSW algorithm includes:

[0054] Calculate each LWE ciphertext and conversion key K in the LWE ciphertext group i The homomorphic outer product of

[0055] The ciphertext vectors obtained by the homomorphic outer product are combined into a new ciphertext by column, that is, the LweGSW ciphertext group is obtained.

[0056] The present invention also provides a lattice privacy information retrieval system based on coefficient extraction, comprising a first processing module, a second processing module and a fourth processing module arranged at a user, and a third processing module arranged at a server;

[0057] The first processing module is used to execute the system establishment phase: the user generates parameters and sends the generated parameters to the server; the parameters include database parameters, parameters of the RLWE scheme, the LWE scheme and the LWEGSW scheme and corresponding private keys, and the LWEGSW scheme conversion key; the RLWE scheme, the LWE scheme and the LWEGSW scheme maintain the same algebraic structure;

[0058] The second processing module is used to perform the query generation phase: the user generates a query tuple according to the database structure and the query target, generates a ciphertext query based on the query tuple and the RLWE scheme, and sends the ciphertext query to the server;

[0059] The third processing module is used to execute the response calculation phase, where the server performs ciphertext expansion on the received ciphertext query according to the received parameters and the LWE scheme and the LWEGSW scheme, and performs homomorphic calculation according to the database structure to obtain query feedback and send it to the user;

[0060] The fourth processing module is used to execute the result acquisition phase, where the user receives the query feedback and uses the private key and the LWE scheme to decrypt the query feedback to obtain the query result.

[0061] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0062] Based on the RLWE / LWE difficulty problem, the present invention realizes a safe and efficient PIR scheme through direct coefficient extraction and efficient homomorphic outer product calculation, which significantly improves query efficiency, reduces communication overhead, and achieves better noise control. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 It is a schematic diagram of a lattice privacy information retrieval method based on coefficient extraction in an embodiment of the present invention. DETAILED DESCRIPTION

[0064] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0065] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0066] Example

[0067] like Figure 1 As shown, the embodiment of the present invention proposes a lattice privacy information retrieval method based on coefficient extraction, including:

[0068] System establishment phase: the user generates parameters and sends the generated parameters to the server; the parameters include database parameters, parameters and corresponding private keys of the RLWE scheme, LWE scheme and LWEGSW scheme, and LWEGSW scheme conversion key; the RLWE scheme, LWE scheme and LWEGSW scheme maintain the same algebraic structure;

[0069] Query generation phase: The user generates a query tuple according to the database structure and query target, generates a ciphertext query based on the query tuple and the RLWE scheme, and sends the ciphertext query to the server;

[0070] In the response calculation phase, the server performs ciphertext expansion on the received ciphertext query according to the received parameters and the LWE scheme and LWEGSW scheme, and performs homomorphic calculation according to the database structure to obtain query feedback and send it to the user;

[0071] In the result acquisition stage, the user receives the query feedback and uses the private key and LWE scheme to decrypt the query feedback to obtain the query result.

[0072] The method of the present invention can avoid the iterative coefficient extraction process of local homomorphic calculation in the existing privacy information retrieval technology, thereby reducing the computational overhead; it does not require a complex ciphertext conversion mechanism and additional conversion keys, thereby reducing the communication burden; it optimizes the homomorphic outer product operation and achieves controllable noise growth.

[0073] The following is a detailed description of a lattice-based privacy information retrieval method based on coefficient extraction proposed in an embodiment of the present invention.

[0074] 1. Symbol related instructions

[0075] The symbols used in the embodiments of the present invention are specifically described as follows:

[0076] In basic notation, italic bold lowercase letters represent vectors (e.g. ), use italic bold capital letters to denote matrices (e.g. ). represents the ring of integers, represents the set of natural numbers. For positive integers [n] represents the set {1,2,...,n}. For positive integers represents the residue class of integers modulo q. And a≤b, let [a,b] denote the set {a,a+1,...,b}. λ denotes the security parameter.

[0077] In terms of algebraic structure, the embodiments of the present invention mainly perform operations on the following ring: Let N be a power of 2, is a polynomial over the ring. The element a in R is represented by Its coefficient vector is (a0,a1,...,a N-1 ). For integers The business ring is recorded as

[0078] In terms of randomness representation, when A is a set, x←A means randomly selecting an element x from the set A. When χ is a distribution, x←χ means randomly sampling an element x from the distribution χ; when f is a function, x←f means the output of function f.

[0079] 2. LWE Hard Problem Assumption

[0080] LWE instance generation: Given parameters N,q and distribution χσ, select a random matrix Secret Vector Error Vector Calculate b = As + e mod q and output (A, b) as an LWE instance.

[0081] Search-type LWE problem Search_LWE_{n,q,χ σ}: Given an LWE instance (A,b = As + e mod q), where For secret, is a “small” error vector, required to recover the secret vector s.

[0082] Decisional_LWE_{n,q,χ σ}: Given multiple samples, it is required to distinguish the following two distributions:

[0083] Distribution 1, (A,b = As + e mod q), where

[0084] Distribution 2 is: (A,u), where Uniformly random.

[0085] After extensive research, it was found that the above LWE problem can be reduced to the worst-case lattice problem under appropriate parameter selection, and is therefore considered to be resistant to quantum computing attacks. This provides a solid theoretical basis for building a secure privacy information retrieval scheme.

[0086] 3. RLWE solution

[0087] The RLWE scheme is a symmetric homomorphic encryption scheme based on RLWE, which is described as follows:

[0088] RLWE.Setup(1 λ ): Input security parameter λ, let distribution X key Represents the distribution of the key, and generates parameters Params according to the decision-type RLWE problem RLWE =(N,q,σ,B,l,t,Δ), ​​so that the complexity of solving the difficult problem is not less than 2 λ ,in

[0089] RLWE.KeyGen(Params RLWE ): Input parameters Params RLWE , randomly selected Output key sk = s∈R;

[0090] RLWE.Enc(sk,m): Input plaintext m∈R t , randomly select a←R q and Calculate and output ciphertext

[0091] RLWE.Dec(sk,ct): Input ciphertext ct = (c0,c1) and decryption key sk, calculate and output plaintext

[0092] 4. LWE solution

[0093] The LWE scheme is a symmetric homomorphic encryption scheme based on LWE, which is described as follows:

[0094] LWE.Setup(1 λ ): Input security parameter λ, let distribution χ key Represents the distribution of the key, and generates parameters Params according to the decision-type RLWE problem RLWE =(N,q,σ,B,l,t,Δ), ​​so that the complexity of solving the difficult problem is not less than 2 λ ,in

[0095] LWE.KeyGen(Params RLWE ): Input parameters Params RLWE , randomly selected Let the key be

[0096] LWE.Enc(sk,m): input plaintext In random Randomly select a vector Randomly select e←χ σ , calculate and output the ciphertext

[0097] LWE.Dec(sk,ct): input ciphertext and decryption key sk=(1,s), calculate and output

[0098] 5. LWEGSW solution

[0099] Given a basis B, let First, the tool vector g and tool matrix G are introduced. The tool vector g is expressed as:

[0100]

[0101] Definition -1 Transformation: For a∈R q , decompose it with B as the basis in It can be seen that g T g -1 (a) = a. Then for We can define G -1 (v)=(g -1 (a),g -1 (b)). It can be seen that g T g -1 (a) = a, G T G -1 (v) = v.

[0102] The LWEGSW scheme is a GSW-type symmetric homomorphic encryption scheme based on LWE, which is described as follows:

[0103] LweGSW.Setup(1 λ ): Input security parameter λ, let distribution χ key Represents the distribution of the key, and generates parameters Params according to the decision-type RLWE problem RLWE =(N,q,σ,B,l,t,Δ), ​​so that the complexity of solving the difficult problem is not less than 2 λ ,in

[0104] LweGSW.KeyGen(Params RLWE ): Input parameters Params RLWE , randomly selected Let the key be

[0105] LweGSW.Enc(sk,m): input plain text exist Randomly select a l(N+1)×N dimensional matrix In the discrete Gaussian distribution χ σ Randomly select a l(N+1)-dimensional vector Calculate the output ciphertext:

[0106]

[0107] in

[0108] LweGSW.Dec(sk,C): input ciphertext and decryption key sk = (1, s), calculate c = C sk = e + ΔmG skmodq. Take the first element of vector c and calculate

[0109] LweGSW.Encode(sk,m): plain text exist Randomly select a l(N+1)×N dimensional matrix In the discrete Gaussian distribution χ σRandomly select a l(N+1)-dimensional vector Calculate the output encoding:

[0110]

[0111] in

[0112] It is easy to verify that D·sk=e+mG·sk mod q.

[0113] 6. Homomorphic outer product of LWE ciphertext and LWEGSW encoding

[0114] Let a LWE ciphertext It's news Encryption, that is, ct = LWE.Enc (sk, m0). A LweGSW encoding is the encrypted code of message m1∈{0,1}, i.e. D=LweGSW.Encode(sk,m1). The decryption keys corresponding to these two ciphertexts are the same, both sk=(1,s). Define the operator Represents a homomorphic outer product operation:

[0115]

[0116] 7. Extract LWE ciphertext from RLWE ciphertext

[0117] make Let c = a·b. Since x N ≡-1modx N +1, then their coefficients have the following relationship:

[0118]

[0119] That is c i For a vector (a0, a1, ..., a N-1 ) and (b i ,b i-1 ,…,b0,-b N-1 ,-b N-2 ,…,-b i+1 ) inner product, and then modulo q. Define the transformation ρ i (b)=(b i ,b i-1 ,…,b0,-b N-1 ,-b N-2 ,…,-b i+1 ).but:

[0120] c i = <a,ρ i (b)>

[0121] Let the vector polynomial b = b0 + b1x + ... + b N-1 x N-1 ∈R q , whose coefficient vector is (b0,b1,…,b N-1 ), define the transformation ρ i (b)=(b i ,b i-1 ,…,b0,-b N-1 ,-b N-2 ,…,-b i+1 ).

[0122] The transformation ρ i (b) is equivalent to reversely flipping the 0th to ith consecutive elements of the coefficient vector of the vector polynomial b, and reversely flipping the i+1th to N-1th consecutive elements, and outputting a N-1 dimensional vector on .

[0123] Let the input be an RLWE ciphertext c RLWE =RLWE.Enc s (m)=(c0,c1)=(-as+e+Δm,a), where plain text m=m0+m1x+…+m N-1 x N-1 . Let vector s represent the coefficient vector of the key, c 0,i Represents R q The coefficient of the i-th degree term of the polynomial element c0 on the ring. Then the present invention can directly obtain the coefficient of the i-th degree term of the polynomial element c0 on the ring. RLwE Extract the LWE ciphertext of the plaintext polynomial coefficients from the ciphertext. The details are as follows:

[0124] LWE.Enc(s,m i )=(c 0,1 ,ρ i (c1)),i=0,1,…,N-1

[0125] 8. Construct LweGSW ciphertext based on LWE ciphertext group

[0126] Let input l LWE ciphertexts ct (0) =LWE.Enc(s,B 0 m), ct (1) =LWE.Enc(s,B 1 m),…,ct (l-1) =LWE.Enc(s,B l-1 m), the group ciphertext needs to be converted into a LweGSW ciphertext C of the encrypted message m * In order to complete this conversion, an additional conversion ciphertext is required, namely K i =LweGSW.Encode(s,s i),i=0,1,…,N-1.

[0127] LWETOGSW(ct (0) ,ct (1) ,…,ct (l-1) ,K0,K1,…,K N-1 )The specific conversion process is as follows:

[0128] (1) For i = 0, 1, ..., l-1, calculate the homomorphic outer product:

[0129]

[0130] (2) These lN ciphertexts are regarded as row vectors. Then these lN ciphertexts are combined into a new ciphertext by column:

[0131] C *

[0132] =(ct (0) ,ct (1) ,…,ct (l-1) ,ct (0,0) ,ct (1,0) ,…,ct (l-1,0) ,ct (0,1) ,ct (1,1) ,…,ct (l -1,1) ,…,ct (0,N-1) ,ct (1,N-1) ,…,ct (l-1,N-1) )

[0133] (3) Output this new ciphertext C * , the ciphertext C * It is the LweGSW ciphertext of m.

[0134] 9. Ciphertext query generation algorithm

[0135] To achieve efficient privacy query, the ciphertext query generation algorithm of the present invention includes two key steps: query index conversion and ciphertext query construction.

[0136] In this embodiment, the database structure is designed as follows:

[0137] (1) The server stores n records: DB = {d0, d1, ..., d n-1};

[0138] (2) Adopting (p+1)-dimensional hypercube organization:

[0139] 1st Dimension: Units;

[0140] Dimensions 2 to p+1: 2 units per dimension;

[0141] Parameters p and p1 can be flexibly configured according to the database scale.

[0142] Step 1: Query index conversion

[0143] Input: user query target index∈{0,1,…,n-1};

[0144] Output: p+1-dimensional query tuple (i, j1, j2, ..., j p ), where i∈{0,1,...,2 p1},j1,j2,…,j p ∈{0,1};

[0145] Query index conversion algorithm QueryTupleGen (idex):

[0146] (1) Calculate the first dimension index:

[0147] (2) Get the remainder: tmp = index - i · 2 p ;

[0148] (3) Calculate the index of each dimension:

[0149] Cycle k from 1 to p:

[0150]

[0151] tmp=tmp-j k 2 p-k

[0152] (4) Output p+1-dimensional query tuple (i, j1, j2, …, j p ).

[0153] Step 2: Ciphertext query construction

[0154] Input: RLWE private key s, query tuple (i, j1, j2, …, j p );

[0155] Output: RLWE ciphertext c query ;

[0156] EncQueryGen((s,(i,j1,j2,…,j p ))):

[0157] (1) Initialization polynomial: μ(x) = Δx i ;

[0158] (2) Embed the information of each dimension in a self-additive manner on the polynomial μ(x):

[0159] For k = 1 to v:

[0160]

[0161] (3) Based on the polynomial μ(x) after cyclic embedding of information in each dimension, the encrypted calculation query in the RLWE scheme is used: query =RLWE.Enc(s,μ(x));

[0162] (4) Output ciphertext query c query .

[0163] Technical constraints: Requirements To ensure correctness.

[0164] 10. Ciphertext query extension algorithm

[0165] The input and specific process of the ciphertext query expansion algorithm are as follows:

[0166] Input: RLWE ciphertext c RLWE =RLWE.Enc s (m)=(c0,c1)=(-as+e+Δm,a), where plain text m=m0+m1x+…+m N-1 x N-1 .

[0167] Step 1: Extract coefficient ciphertext:

[0168] Define the transformation ρ i (b)=(b i ,b i-1 ,…,b0,-b N-1 ,-b N-2 ,…,-b i+1 ), where the polynomial b∈R q ; This transformation reverses the coefficients from 0 to i, and reverses the coefficients from i+1 to N-1;

[0169] Extract N LWE ciphertexts directly from the RLWE ciphertext:

[0170] LWE.Enc(s,m i )=(c 0,i ,ρ i (c1)),i=0,1,…,N-1

[0171] Among them, c 0,i Represents the coefficient of the i-th order term of c0.

[0172] Step 2: Ciphertext group construction:

[0173] Divide N LWE ciphertexts into p+1 groups:

[0174] Group 1:

[0175] ct LWE =(c LWE,0 ,c LWE,1 ....,c LWE,2p1-1 )

[0176] Subsequent p group:

[0177] Convert the LWE ciphertext group to the LweGSW ciphertext group by calling the algorithm LWETOGSW: LWEGSW，k ,k=0,1,…,p-1.

[0178] Based on the above solution description, an embodiment of the present invention proposes a lattice-based privacy information retrieval method based on coefficient extraction, which is specifically as follows:

[0179] Step 1: System establishment phase (executed by user User):

[0180] Generate relevant scheme parameters based on security parameter λ:

[0181] RLWE scheme parameters: Params RLWE ←RLWE.Setup(1 λ );

[0182] LWE scheme parameters: Params LWE ←LWE.Setup(1 λ );

[0183] LweGSW scheme parameters: Parmas LWEGSW ←LWEGSW.Setup(1 λ );

[0184] The above three solutions are required to use the same algebraic structure

[0185] Generate the corresponding private key: s←RLWE.KeyGen(Params RLWE ),make Vector s=(s0,s1,…,s N-1 );

[0186] Generate LweGSW conversion key: K i =LweGSW.Encode(s,s i ),i=0,1,…,N-1;

[0187] Determine database parameters p and p1 according to the database size;

[0188] Step 2: Query generation phase (executed by user User):

[0189] Generate query tuples based on the query target index:

[0190] According to the query index conversion algorithm QueryTupleGen(index), a p+1-dimensional query tuple (i, j1, j2, ..., j p )←QueryTupleGen(index).

[0191] Generate RLWE ciphertext query:

[0192] According to the ciphertext query construction algorithm EncQueryGen(s,(i,j1,j2,…,j p )) to generate the ciphertext query c query ←EncQueryGen(s,(i,j1,j2,…,j p )).

[0193] c query and Params RLWE 、Params LWE 、Params LWEGSW , and LweGSW conversion key K i , and parameters p1 and p are sent to the server Server.

[0194] Step 3: Response calculation phase (executed by the server):

[0195] (1) Ciphertext query extension:

[0196] Query c from the ciphertext query Extract N LWE ciphertexts from:

[0197] LWE.Enc(s,m i )=(c 0,i ,ρ i (c1)),i=0,1,…,N-1

[0198] Based on N LWE ciphertexts, construct p+1 groups of ciphertexts corresponding to each dimension in the database structure:

[0199] Generate ct LWE Group and ct LWEGSW,0 to ct LWEGSW,p-1 Group; N LWE ciphertexts (c LWE,0 ,c LWE,1 ....,c LWE,N ) is divided into p+1 groups:

[0200] Group 1:

[0201]

[0202] Subsequent p group:

[0203] Convert the key K by entering the LWEGSW scheme i And call the LWETOGSW algorithm to convert the LWE ciphertext group into the LweGSW ciphertext group: ct LWEGSW，k ,k=0,1,…,p-1.

[0204] (2) Confidential query calculation:

[0205] Use the first group of ciphertext ct LWE Processing the first dimension data:

[0206] right calculate:

[0207]

[0208] Use ct LWEGSW,0 to ct LWEGSW,p-1 , based on the homomorphic outer product of LWE ciphertext in LWE scheme to LWEGSW encoding in LWEGSW scheme, the subsequent dimensional data is processed:

[0209] initialization

[0210] Loop for k=0,1,...,v-1:

[0211] num=num / 2;

[0212] For h=0,1,…,num-1, calculate:

[0213]

[0214] Use the result for the next round of calculations;

[0215] Output query feedback

[0216] Step 4: Result acquisition phase (executed by user User):

[0217] Receive inquiry feedback respond ;

[0218] Using the private key s, the query feedback is decrypted based on the LWE scheme to obtain the query result:

[0219] d index ←LWE.Dec(s,c respond )

[0220] From the above, it can be seen that the present invention realizes a safe and efficient PIR scheme through direct coefficient extraction and efficient homomorphic outer product calculation. The security of the whole scheme is based on the RLWE / LWE difficulty problem, and the performance is significantly improved compared with the existing scheme.

[0221] Based on the same technical concept, an embodiment of the present invention also provides a lattice-based privacy information retrieval system based on coefficient extraction, comprising a first processing module, a second processing module and a fourth processing module arranged at a user, and a third processing module arranged at a server;

[0222] The first processing module is used to execute the system establishment phase: the user generates parameters and sends the generated parameters to the server; the parameters include database parameters, parameters of the RLWE scheme, the LWE scheme and the LWEGSW scheme and corresponding private keys, and the LWEGSW scheme conversion key; the RLWE scheme, the LWE scheme and the LWEGSW scheme maintain the same algebraic structure;

[0223] The second processing module is used to perform the query generation phase: the user generates a query tuple according to the database structure and the query target, generates a ciphertext query based on the query tuple and the RLWE scheme, and sends the ciphertext query to the server;

[0224] The third processing module is used to execute the response calculation phase, where the server performs ciphertext expansion on the received ciphertext query according to the received parameters and the LWE scheme and the LWEGSW scheme, and performs homomorphic calculation according to the database structure to obtain query feedback and send it to the user;

[0225] The fourth processing module is used to execute the result acquisition phase, where the user receives the query feedback and uses the private key and the LWE scheme to decrypt the query feedback to obtain the query result.

[0226] The specific working principles of the above-mentioned processing modules can be referred to the description in the above-mentioned method embodiment, which will not be repeated here.

[0227] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A lattice privacy information retrieval method based on coefficient extraction, characterized in that: include: System establishment phase: the user generates parameters and sends the generated parameters to the server; The parameters include database parameters, parameters of the RLWE scheme, the LWE scheme and the LWEGSW scheme and corresponding private keys, and a conversion key of the LWEGSW scheme; the RLWE scheme, the LWE scheme and the LWEGSW scheme maintain the same algebraic structure; Query generation phase: The user generates a query tuple according to the database structure and query target, generates a ciphertext query based on the query tuple and the RLWE scheme, and sends the ciphertext query to the server; In the response calculation phase, the server performs ciphertext expansion on the received ciphertext query according to the received parameters and the LWE scheme and LWEGSW scheme, and performs homomorphic calculation according to the database structure to obtain query feedback and send it to the user; In the result acquisition stage, the user receives the query feedback and uses the private key and LWE scheme to decrypt the query feedback to obtain the query result.

2. The lattice privacy information retrieval method based on coefficient extraction according to claim 1 is characterized in that: The user generated parameters include: According to the safety parameter λ and the decision-type RLWE difficulty problem, the input parameters of the RLWE scheme, the LWE scheme and the LWEGSW scheme are generated; Generate the corresponding private key according to the input parameters of the RLWE scheme; Generate a LweGSW conversion key based on the private key; Determine database parameters based on database size.

3. The lattice-based privacy information retrieval method based on coefficient extraction according to claim 2 is characterized in that: The database structure adopts a (p+1)-dimensional hypercube organization form: 1st Dimension: Units; Dimensions 2 to p+1: 2 units per dimension; The database parameters include p and p1.

4. The lattice privacy information retrieval method based on coefficient extraction according to claim 3 is characterized in that: The query generation stage includes: Based on the database structure and the query target index, the query index conversion algorithm QueryTupleGen(index) is used to generate a p+1-dimensional query tuple (i, j1, j2, …, j p )←QueryTupleGen(index); Based on the private key s and the p+1-dimensional query tuple (i, j1, j2, …, j p ), according to the ciphertext query construction algorithm EncQueryGen(s,(i,j1,j2,…,j p )) to generate the ciphertext query c query ←EncQueryGen(s,(i,j1,j2,…,j p )).

5. The lattice privacy information retrieval method based on coefficient extraction according to claim 4 is characterized in that: The query index conversion algorithm includes: Calculate the first dimension index: Get the remainder: tmp = index-i·2 p ; Calculate the index of each dimension: Cycle k from 1 to p: tmp=tmp-j k ·2 p-k Output p+1-dimensional query tuple (i, j1, j2, ..., j p ).

6. The lattice privacy information retrieval method based on coefficient extraction according to claim 4, characterized in that: The ciphertext query construction algorithm includes: Initialize a polynomial μ(x); Embed the information of each dimension cyclically in the polynomial μ(x) in a self-additive manner; Based on the polynomial μ(x) after cyclic embedding of each dimension information, the encryption calculation in the RLWE scheme is used to generate the query c query ; Output ciphertext query c query .

7. The lattice privacy information retrieval method based on coefficient extraction according to claim 6, characterized in that: The response calculation stage includes: (1) Ciphertext query extension: Query c from the ciphertext query Extract N LWE ciphertexts; Based on N LWE ciphertexts, construct p+1 groups of ciphertexts corresponding to each dimension in the database structure: Generate ct LWE Group and ct LWEGSW,0 to ct LWEGSW,p-1 Group; N LWE ciphertexts (c LWE,0 ,c LWE,1 …,c LWE,N ) is divided into p+1 groups: Group 1: Subsequent p-groups: Transform the key K by entering the LWEGSW scheme i And call the LWETOGSW algorithm to convert the LWE ciphertext group into the LweGSW ciphertext group: ct LWEGSW，k ,k=0,1,…,p-1; (2) Perform dense state query calculation based on homomorphic outer product: Use the first group of ciphertext ct LWE Process the first dimension data; Use ct LWEGSW,0 to ct LWEGSW,p-1 , based on the homomorphic outer product of LWE ciphertext in LWE scheme to LWEGSW encoding in LWEGSW scheme, the subsequent dimensional data is processed; After the processing is completed, the query feedback is output.

8. The lattice privacy information retrieval method based on coefficient extraction according to claim 7, characterized in that: The ciphertext query c query Extract N LWE ciphertexts, including: Define a transformation that means flipping the 0th to ith consecutive elements of the coefficient vector of the polynomial, and flipping the i+1th to N-1th consecutive elements; Based on the defined transformation, from the ciphertext query c query Extract N LWE ciphertexts from .

9. The lattice privacy information retrieval method based on coefficient extraction according to claim 6, characterized in that: The LWETOGSW algorithm includes: Calculate each LWE ciphertext and conversion key K in the LWE ciphertext group i The homomorphic outer product of The ciphertext vectors obtained by the homomorphic outer product are combined into a new ciphertext by column, that is, the LweGSW ciphertext group is obtained.

10. A lattice privacy information retrieval system based on coefficient extraction, comprising a first processing module, a second processing module and a fourth processing module arranged at a user, and a third processing module arranged at a server; The first processing module is used to execute the system establishment phase: the user generates parameters and sends the generated parameters to the server; the parameters include database parameters, parameters of the RLWE scheme, the LWE scheme and the LWEGSW scheme and corresponding private keys, and the LWEGSW scheme conversion key; the RLWE scheme, the LWE scheme and the LWEGSW scheme maintain the same algebraic structure; The second processing module is used to perform the query generation phase: the user generates a query tuple according to the database structure and the query target, generates a ciphertext query based on the query tuple and the RLWE scheme, and sends the ciphertext query to the server; The third processing module is used to execute the response calculation phase, where the server performs ciphertext expansion on the received ciphertext query according to the received parameters and the LWE scheme and the LWEGSW scheme, and performs homomorphic calculation according to the database structure to obtain query feedback and send it to the user; The fourth processing module is used to execute the result acquisition phase, where the user receives the query feedback and uses the private key and the LWE scheme to decrypt the query feedback to obtain the query result.

Images