A lattice-based privacy information retrieval method and system based on coefficient extraction

Abstract

The application provides a lattice privacy information retrieval method and system based on coefficient extraction, which comprises the following steps: a user generates parameters and sends the generated parameters to a server; the parameters comprise database parameters, parameters and corresponding private keys of RLWE scheme, LWE scheme and LWEGSW scheme, and a LWEGSW scheme conversion key; the user generates a query tuple according to a database structure and a query target, generates a ciphertext query based on the query tuple and the RLWE scheme, and sends the ciphertext query to the server; the server performs ciphertext expansion on the received ciphertext query according to the received parameters and the LWE scheme and the LWEGSW scheme, performs homomorphic calculation according to the database structure, obtains query feedback, and sends the query feedback to the user; and the user uses the private key and the LWE scheme to decrypt the query feedback to obtain a query result. The application can significantly improve the query efficiency, reduce the communication overhead, and achieve better noise control.

Description

Technical Field

[0001] The present invention relates to the technical field of privacy information retrieval, and in particular to a lattice-based privacy information retrieval method and system based on coefficient extraction. Background Art

[0002] Private Information Retrieval (PIR) is a protocol that meets specific requirements. It allows clients to query a server's database for specific records without revealing the query target to the server. Based on the security guarantees, PIR protocols are mainly divided into information-theoretically secure multi-server solutions and computationally secure single-server solutions.

[0003] In the research of single-server PIR, lattice cryptography-based schemes have attracted widespread attention due to their resistance to quantum computing attacks. In 2016, Melchor et al. designed the XPIR protocol, which applied RLWE homomorphic encryption to PIR construction for the first time. In 2018, Angel et al. proposed the SealPIR scheme, which innovatively used the monomial x index Encoding the query location compresses the query size to 0.36% of XPIR. In 2019, Polyakov et al. proposed an improved RLWE-based scheme, ACCEPTABLE, which introduced a new encoding method to reduce communication overhead. In 2021, Mughees et al. designed the OnionPIR protocol, which uses the outer product properties of RLWE and RGSW ciphertext to control noise growth. In 2022, Menon et al. proposed the SPIRAL protocol family, which improves system throughput through a matrix-based Regev scheme and an improved GSW scheme. The advantages of this approach are a solid theoretical foundation and complete security proof, but the efficiency of homomorphic operations is relatively low.

[0004] Existing privacy information retrieval technologies still have the following problems:

[0005] (1) Ciphertext query expansion is complex. Currently, schemes such as SealPIR, OnionPIR, and SPIRAL use coefficient extraction algorithms based on homomorphic computation, expanding the ciphertext query vector through a certain number of loop iterations. This approach not only makes the expansion algorithm complex, but also, due to the multiple homomorphic operations involved, causes the ciphertext noise to grow too quickly, requiring larger parameter settings to ensure correctness.

[0006] (2) The query computation overhead is high. The homomorphic inner product of schemes such as OnionPIR and SPIRAL is based on the mathematical difficulty of RLWE or LWE. Since the ciphertext is in the form of two tuples on a polynomial ring, the ciphertext size is large. A large number of polynomial operations are required during the homomorphic computation process, resulting in rapid noise accumulation, requiring large parameter settings, and significant computational overhead.

[0007] (3) Heterogeneous ciphertext conversion is difficult. When performing homomorphic inner product operations, schemes such as OnionPIR and SPIRAL must convert the query ciphertext from BFV / Regev ciphertext to GSW ciphertext. This conversion requires using the GSW homomorphic encryption scheme to encrypt the private key and send the private key ciphertext to the server. This not only increases the communication overhead during the query, but also requires complex conversion operations. Summary of the Invention

[0008] In response to the above-mentioned problems existing in the existing privacy information retrieval technology, the present invention provides a lattice-based privacy information retrieval method and system based on coefficient extraction. It adopts the RLWE / LWE difficulty problem in lattice cryptography, and through innovative coefficient extraction algorithms and efficient ciphertext conversion technology, significantly improves query efficiency, reduces communication overhead, and achieves better noise control.

[0009] The present invention provides a lattice-based privacy information retrieval method based on coefficient extraction, comprising:

[0010] System establishment phase: The user generates parameters and sends them to the server. These parameters include database parameters, parameters and corresponding private keys for the RLWE, LWE, and LWEGSW schemes, and the LWEGSW conversion key. The RLWE, LWE, and LWEGSW schemes maintain the same algebraic structure.

[0011] Query generation phase: The user generates a query tuple based on the database structure and query target, generates a ciphertext query based on the query tuple and the RLWE scheme, and sends the ciphertext query to the server;

[0012] In the response calculation phase, the server expands the received ciphertext query based on the received parameters and the LWE and LWEGSW schemes, performs homomorphic calculations based on the database structure, obtains query feedback, and sends it to the user;

[0013] In the result acquisition stage, the user receives the query feedback and uses the private key and LWE scheme to decrypt the query feedback to obtain the query result.

[0014] In some embodiments, the user-generated parameters include:

[0015] Generate input parameters for RLWE scheme, LWE scheme and LWEGSW scheme according to the security parameter λ and the decision-type RLWE difficulty problem;

[0016] Generate the corresponding private key based on the input parameters of the RLWE scheme;

[0017] Generate an LweGSW conversion key based on the private key;

[0018] Determine database parameters based on the database size.

[0019] In some embodiments, the database structure adopts a (p+1)-dimensional hypercube organization form:

[0020] 1st Dimension: units;

[0021] Dimensions 2 to p+1: 2 units per dimension;

[0022] The database parameters include p and p1.

[0023] In some embodiments, the query generation stage includes:

[0024] Based on the database structure and the query target index, the query index conversion algorithm QueryTupleGen(index) is used to generate a p+1-dimensional query tuple (i, j1, j2, ..., j p )←QueryTupleGen(index);

[0025] Based on the private key s and the p+1-dimensional query tuple (i, j1, j2, ..., j p ), according to the ciphertext query construction algorithm EncQueryGen(s,(i,j1,j2,…,j p )), generate ciphertext query c query ←EncQueryGen(s,(i,j1,j2,…,j p )).

[0026] In some embodiments, the query index conversion algorithm includes:

[0027] Calculate the first dimension index:

[0028] Get the remainder: tmp = index - i · 2 p ;

[0029] Calculate the index of each dimension:

[0030] Loop k from 1 to p:

[0031]

[0032] tmp=tmp-j k 2 p-k

[0033] Output p+1-dimensional query tuple (i, j1, j2, ..., j p ).

[0034] In some embodiments, the ciphertext query construction algorithm includes:

[0035] Initialize a polynomial μ(x);

[0036] Embed the information of each dimension cyclically in the polynomial μ(x) in a self-additive manner;

[0037] Based on the polynomial μ(x) after cyclic embedding of each dimension information, the encryption calculation in the RLWE scheme is used to generate the query c query ;

[0038] Output ciphertext query c query .

[0039] In some embodiments, the response calculation phase includes:

[0040] (1) Ciphertext query extension:

[0041] Query c from the ciphertext query Extract N LWE ciphertexts;

[0042] Based on N LWE ciphertexts, construct p+1 groups of ciphertexts corresponding to each dimension in the database structure:

[0043] Generate ct LWE Group and ct LWEGSW,0 to ct LWEGSW,p-1 group; N LWE ciphertexts (c LWE,0 ,c LWE,1 ....,c LWE,N ) is divided into p+1 groups:

[0044] Group 1:

[0045] Subsequent p-groups: transform the key K by inputting the LWEGSW scheme i And call the LWETOGSW algorithm to convert the LWE ciphertext group into the LweGSW ciphertext group: ct LWEGSW，k ,k=0,1,…,p-1;

[0046] (2) Perform dense state query calculation based on homomorphic outer product:

[0047] Use the first group of ciphertext ct LWE Process the first dimension data;

[0048] Use ct LWEGSW,0 to ct LWEGSW,p-1 , processing subsequent dimensional data based on the homomorphic outer product of LWE ciphertext in LWE scheme to LWEGSW encoding in LWEGSW scheme;

[0049] After the processing is completed, the query feedback is output.

[0050] In some embodiments, the query c from the ciphertext query Extract N LWE ciphertexts, including:

[0051] Define a transformation that reverses the order of consecutive elements from 0 to i of the coefficient vector of the polynomial, and reverses the order of consecutive elements from i+1 to N-1;

[0052] Based on the defined transformation, from the ciphertext query c query Extract N LWE ciphertexts from .

[0053] In some embodiments, the LWETOGSW algorithm comprises:

[0054] Calculate the LWE ciphertext and conversion key K in the LWE ciphertext group i The homomorphic outer product of

[0055] The ciphertext vectors obtained by the homomorphic outer product are combined into a new ciphertext by column, that is, the LweGSW ciphertext group is obtained.

[0056] The present invention also provides a lattice-based privacy information retrieval system based on coefficient extraction, comprising a first processing module, a second processing module and a fourth processing module arranged at a user, and a third processing module arranged at a server;

[0057] The first processing module is configured to execute a system establishment phase: a user generates parameters and sends the generated parameters to a server; the parameters include database parameters, parameters and corresponding private keys of the RLWE scheme, the LWE scheme, and the LWEGSW scheme, and a conversion key of the LWEGSW scheme; the RLWE scheme, the LWE scheme, and the LWEGSW scheme maintain the same algebraic structure;

[0058] The second processing module is configured to execute a query generation phase: the user generates a query tuple according to the database structure and the query target, generates a ciphertext query based on the query tuple and the RLWE scheme, and sends the ciphertext query to the server;

[0059] The third processing module is used to perform a response calculation phase, in which the server performs ciphertext expansion on the received ciphertext query based on the received parameters and the LWE scheme and the LWEGSW scheme, and performs homomorphic calculation according to the database structure to obtain query feedback and send it to the user;

[0060] The fourth processing module is used to execute the result acquisition phase, where the user receives the query feedback and uses the private key and the LWE scheme to decrypt the query feedback to obtain the query result.

[0061] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0062] The present application is based on the RLWE / LWE difficult problem, and realizes a safe and efficient PIR scheme through direct coefficient extraction and efficient homomorphic outer product calculation, which significantly improves the query efficiency, reduces the communication overhead, and realizes better noise control. BRIEF DESCRIPTION OF DRAWINGS

[0063] Figure 1 The principle diagram of the lattice-based privacy information retrieval method based on coefficient extraction in the embodiment of the present application. DETAILED DESCRIPTION

[0064] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings herein can be arranged and designed in various different configurations.

[0065] Therefore, the detailed description of the embodiments of the present application provided in the drawings below is not intended to limit the scope of the claimed present application, but only represents selected embodiments of the present application. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in the present application without making creative efforts are within the scope of protection of the present application.

[0066] EMBODIMENT

[0067] As shown in the drawings, Figure 1 The embodiment of the present application proposes a lattice-based privacy information retrieval method based on coefficient extraction, which comprises:

[0068] System establishment stage: the user generates parameters and sends the generated parameters to the server; the parameters include database parameters, parameters and corresponding private keys of RLWE scheme, LWE scheme and LWEGSW scheme, and LWEGSW scheme conversion key; the RLWE scheme, the LWE scheme and the LWEGSW scheme maintain the same algebraic structure;

[0069] Inquiry generation stage: the user generates a query tuple according to the database structure and the query target, and generates a ciphertext inquiry based on the query tuple and the RLWE scheme, and sends the ciphertext inquiry to the server;

[0070] Response calculation stage, the server performs ciphertext expansion on the received ciphertext inquiry according to the received parameters and the LWE scheme and the LWEGSW scheme, and performs homomorphic calculation according to the database structure, obtains inquiry feedback and sends it to the user;

[0071] In the result acquisition stage, the user receives the query feedback and uses the private key and LWE scheme to decrypt the query feedback to obtain the query result.

[0072] The method of the present invention can avoid the iterative coefficient extraction process of local homomorphic calculation in existing privacy information retrieval technology, thereby reducing computational overhead; it does not require a complex ciphertext conversion mechanism and additional conversion keys, thereby reducing the communication burden; it optimizes the homomorphic outer product operation and achieves controllable noise growth.

[0073] The following describes in detail a lattice-based privacy information retrieval method based on coefficient extraction proposed in an embodiment of the present invention.

[0074] 1. Symbol related instructions

[0075] The symbols used in the embodiments of the present invention are specifically described as follows:

[0076] In terms of basic notation, italicized bold lowercase letters represent vectors (e.g. ), use italic bold capital letters to represent matrices (e.g. ). represents the ring of integers, represents the set of natural numbers. [n] represents the set {1,2,...,n}. For positive integers represents the residue class of integers modulo q. With a≤b, let [a,b] denote the set {a,a+1,...,b}. λ denotes the security parameter.

[0077] In terms of algebraic structure, the embodiment of the present invention mainly performs operations on the following ring: Let N be a power of 2, is a polynomial over the ring. The element a in R is represented by Its coefficient vector is (a0,a1,...,a N-1 ). For integers The business ring is recorded as

[0078] In terms of randomness, when A is a set, x←A means randomly selecting an element x from the set A. When χ is a distribution, x←χ means randomly sampling an element x from the distribution χ; when f is a function, x←f means the output of function f.

[0079] 2. LWE Hard Problem Assumption

[0080] LWE instance generation: Given parameters N,q and distribution χσ, select a random matrix Secret Vector Error vector Calculate b = As + e mod q and output (A, b) as an LWE instance.

[0081] Search LWE problem Search_LWE_{n,q,χ σ}:Given an LWE instance (A, b = As + e mod q), where For secret, is a “small” error vector, required to recover the secret vector s.

[0082] Decisional LWE problemDecisional_LWE_{n,q,χ σ}: Given multiple samples, it is required to distinguish the following two distributions:

[0083] Distribution 1, (A,b=As+e mod q), where

[0084] Distribution 2 is: (A,u), where Uniformly random.

[0085] Extensive research has shown that the aforementioned LWE problem, with appropriate parameter selection, can be reduced to a worst-case lattice problem and is therefore considered resistant to quantum computing attacks. This provides a solid theoretical foundation for building secure private information retrieval schemes.

[0086] 3. RLWE solution

[0087] The RLWE scheme is a symmetric homomorphic encryption scheme based on RLWE, which is described as follows:

[0088] RLWE.Setup(1 λ ): Input security parameter λ, let distribution X key Represents the distribution of the key, and generates parameters Params based on the decision-type RLWE problem RLWE =(N,q,σ,B,l,t,Δ), ​​so that the complexity of solving difficult problems is not less than 2 λ ,in

[0089] RLWE.KeyGen(Params RLWE ): Input parameters Params RLWE , randomly selected Output key sk = s∈R;

[0090] RLWE.Enc(sk,m): Input plaintext m∈R t , randomly select a←R q and Calculate and output ciphertext

[0091] RLWE.Dec(sk,ct): Input ciphertext ct = (c0, c1) and decryption key sk, calculate and output plaintext

[0092] 4. LWE solution

[0093] The LWE scheme is a symmetric homomorphic encryption scheme based on LWE, which is described as follows:

[0094] LWE.Setup(1 λ ): Input security parameter λ, let distribution χ key Represents the distribution of the key, and generates parameters Params based on the decision-type RLWE problem RLWE =(N,q,σ,B,l,t,Δ), ​​so that the complexity of solving difficult problems is not less than 2 λ ,in

[0095] LWE.KeyGen(Params RLWE ): Input parameters Params RLWE , randomly selected Let the key be

[0096] LWE.Enc(sk,m): input plaintext In random Randomly select a vector Randomly select e←χ σ , calculate and output the ciphertext

[0097] LWE.Dec(sk,ct): input ciphertext And decryption key sk=(1,s), calculate and output

[0098] 5. LWEGSW solution

[0099] Given a basis B, let First, the tool vector g and tool matrix G are introduced. The tool vector g is expressed as:

[0100]

[0101] Definition of g -1 Transformation: For a∈R q , decompose it based on B in It can be seen that g T g -1 (a)=a. Then for G can be defined -1 (v)=(g -1 (a),g -1 (b)). It can be seen that g T g -1 (a) = a, G T G -1 (v) = v.

[0102] The LWEGSW scheme is a GSW-type symmetric homomorphic encryption scheme based on LWE, which is described as follows:

[0103] LweGSW.Setup(1 λ ): Input security parameter λ, let distribution χ key Represents the distribution of the key, and generates parameters Params based on the decision-type RLWE problem RLWE =(N,q,σ,B,l,t,Δ), ​​so that the complexity of solving difficult problems is not less than 2 λ ,in

[0104] LweGSW.KeyGen(Params RLWE ): Input parameters Params RLWE , randomly selected Let the key be

[0105] LweGSW.Enc(sk,m): input plaintext exist Randomly select a l(N+1)×N dimensional matrix In the discrete Gaussian distribution χ σ Randomly select a l(N+1)-dimensional vector Calculate the output ciphertext:

[0106]

[0107] in

[0108] LweGSW.Dec(sk,C): input ciphertext And the decryption key sk=(1,s), calculate c=C·sk=e+ΔmG·skmodq. Take the first element of vector c and calculate

[0109] LweGSW.Encode(sk,m): plaintext exist Randomly select a l(N+1)×N dimensional matrix In the discrete Gaussian distribution χ σRandomly select a l(N+1)-dimensional vector Calculate the output encoding:

[0110]

[0111] in

[0112] It is easy to verify that D·sk=e+mG·sk mod q.

[0113] 6. Homomorphic outer product of LWE ciphertext and LWEGSW encoding

[0114] Let an LWE ciphertext It's news Encryption, that is, ct = LWE.Enc (sk, m0). A LweGSW encoding is the encrypted code of message m1∈{0,1}, i.e. D=LweGSW.Encode(sk,m1). The decryption keys corresponding to these two ciphertexts are the same, sk=(1,s). Define the operator Represents a homomorphic outer product operation:

[0115]

[0116] 7. Extract LWE ciphertext from RLWE ciphertext

[0117] make Let c = a·b, since x N ≡-1modx N +1, then their coefficients have the following relationship:

[0118]

[0119] That is c i For vector (a0, a1, ..., a N-1 ) and (b i ,b i-1 ,…,b0,-b N-1 ,-b N-2 ,…,-b i+1 ) inner product, and then modulo q. Define the transformation ρ i (b)=(b i ,b i-1 ,…,b0,-b N-1 ,-b N-2 ,…,-b i+1 ).but:

[0120] c i = <a,ρ i (b)>

[0121] Let vector polynomial b = b0 + b1x + … + b N-1 x N-1 ∈R q , whose coefficient vector is (b0, b1, …, b N-1 ), define the transformation p i (b) = (b i , b i-1 , …, b0, -b N-1 , -b N-2 , …, -b i+1 ).

[0122] The transformation p i (b) is equivalent to reversing the order of the 0th to i consecutive elements of the coefficient vector of the vector polynomial b, and reversing the order of the i+1 to N-1 consecutive elements and negating, outputting an N-1 dimensional vector on .

[0123] Let the input be an RLWE ciphertext c RLWE = RLWE.Enc s (m) = (c0, c1) = (-as + e + Am, a), where the plaintext m = m0 + m1x + … + m N-1 x N-1 . Denote the coefficient vector of the key with vector s, and c 0,i represents the coefficient of the i-th term of the polynomial element c0 on the ring R q . Then the present application can directly extract the LWE ciphertext of the plaintext polynomial coefficient from c RLwE . Specifically as follows:

[0124] LWE.Enc(s, m i ) = (c 0,1 , p i (c1)), i = 0, 1, …, N-1

[0125] 8. Constructing LweGSW ciphertext based on LWE ciphertext group

[0126] Let the input be l LWE ciphertexts ct (0) = LWE.Enc(s, B 0 m), ct (1) = LWE.Enc(s, B 1 m), …, ct (l-1) = LWE.Enc(s, B l-1 m), which needs to be converted into an LweGSW ciphertext C * of an encrypted message m. In order to be able to complete the conversion, an additional conversion ciphertext is required, that is, K i = LweGSW.Encode(s, s i),i=0,1,…,N-1.

[0127] LWETOGSW(ct (0) ,ct (1) ,…,ct (l-1) ,K0,K1,…,K N-1 )The specific conversion process is as follows:

[0128] (1) For i = 0, 1, ..., l-1, calculate the homomorphic outer product:

[0129]

[0130] (2) These lN ciphertexts are regarded as row vectors. Then these lN ciphertexts are combined into a new ciphertext by column:

[0131] C *

[0132] =(ct (0) ,ct (1) ,…,ct (l-1) ,ct (0,0) ,ct (1,0) ,…,ct (l-1,0) ,ct (0,1) ,ct (1,1) ,…,ct (l -1,1) ,…,ct (0,N-1) ,ct (1,N-1) ,…,ct (l-1,N-1) )

[0133] (3) Output this new ciphertext C * , the ciphertext C * It is the LweGSW ciphertext of m.

[0134] 9. Ciphertext query generation algorithm

[0135] To achieve efficient privacy query, the ciphertext query generation algorithm of the present invention includes two key steps: query index conversion and ciphertext query construction.

[0136] In this embodiment, the database structure is designed as follows:

[0137] (1) The server stores n records: DB = {d0, d1, ..., d n-1};

[0138] (2) Using (p+1)-dimensional hypercube organization:

[0139] 1st Dimension: units;

[0140] Dimensions 2 to p+1: 2 units per dimension;

[0141] Parameters p and p1 can be flexibly configured according to the database scale.

[0142] Step 1: Query Index Conversion

[0143] Input: user query target index∈{0,1,…,n-1};

[0144] Output: p+1-dimensional query tuple (i, j1, j2, ..., j p ), where i∈{0,1,...,2 p1}, j1, j2, …, j p ∈{0,1};

[0145] Query index conversion algorithm QueryTupleGen(idex):

[0146] (1) Calculate the first dimension index:

[0147] (2) Get the remainder: tmp = index - i · 2 p ;

[0148] (3) Calculate the index of each dimension:

[0149] Loop k from 1 to p:

[0150]

[0151] tmp=tmp-j k 2 p-k

[0152] (4) Output p+1-dimensional query tuple (i, j1, j2, ..., j p ).

[0153] Step 2: Ciphertext query construction

[0154] Input: RLWE private key s, query tuple (i, j1, j2, ..., j p );

[0155] Output: RLWE ciphertext c query ;

[0156] Encrypted query construction algorithm EncQueryGen((s,(i,j1,j2,…,j p ))):

[0157] (1) Initialize the polynomial: μ(x) = Δx i ;

[0158] (2) Each dimension information is cyclically embedded in self-addition mode on the polynomial μ(x):

[0159] For k = 1 to v:

[0160]

[0161] (3) Based on the polynomial μ(x) after cyclically embedding each dimension information, the encrypted query c is calculated using the encryption calculation in the RLWE scheme: query = RLWE.Enc(s, μ(x));

[0162] (4) The encrypted query c is output. query

[0163] Technical constraints: require to ensure correctness.

[0164] 10. Encrypted query expansion algorithm

[0165] The input and specific process of the encrypted query expansion algorithm are as follows:

[0166] Input: RLWE ciphertext c RLWE = RLWE.Enc s (m) = (c0, c1) = (-as + e + Δm, a), where the plaintext m = m0+ m1x + … + m N-1 x N-1 .

[0167] Step 1: Coefficient ciphertext extraction:

[0168] Define the transformation ρ i (b) = (b i ,b i-1 ,…,b0,-b N-1 ,-b N-2 ,…,-b i+1 ), where the polynomial b ∈ R q ; this transformation reverses the order of the 0th to i-th coefficients and reverses the order of the i+1th to N-1th coefficients.

[0169] Directly extract N LWE ciphertexts from the RLWE ciphertext:

[0170] LWE.Enc(s, m i ) = (c 0,i , ρ i (c1)), i = 0, 1, …, N-1

[0171] where c 0,i represents the i-th coefficient of c0.

[0172] Step 2: Ciphertext group construction: ​

[0173] Divide N LWE ciphertexts into p+1 groups:

[0174] Group 1:

[0175] ct LWE =(c LWE,0 ,c LWE,1 ....,c LWE,2p1-1 )

[0176] Subsequent p group:

[0177] Convert the LWE ciphertext group to the LweGSW ciphertext group by calling the algorithm LWETOGSW: LWEGSW，k ,k=0,1,…,p-1.

[0178] Based on the above solution description, an embodiment of the present invention proposes a lattice-based privacy information retrieval method based on coefficient extraction, which is specifically as follows:

[0179] Step 1: System establishment phase (executed by user User):

[0180] Generate relevant scheme parameters based on security parameter λ:

[0181] RLWE scheme parameters: Params RLWE ←RLWE.Setup(1 λ );

[0182] LWE scheme parameters: Params LWE ←LWE.Setup(1 λ );

[0183] LweGSW scheme parameters: Parmas LWEGSW ←LWEGSW.Setup(1 λ );

[0184] The above three solutions are required to use the same algebraic structure

[0185] Generate the corresponding private key: s←RLWE.KeyGen(Params RLWE ),make Vector s=(s0,s1,…,s N-1 );

[0186] Generate LweGSW conversion key: K i =LweGSW.Encode(s,s i ),i=0,1,…,N-1;

[0187] Determine database parameters p and p1 based on database size;

[0188] Step 2: Query generation phase (executed by user User):

[0189] Generate query tuple based on query target index:

[0190] According to the query index conversion algorithm QueryTupleGen(index), a p+1-dimensional query tuple (i, j1, j2, ..., j p )←QueryTupleGen(index).

[0191] Generate RLWE ciphertext query:

[0192] According to the ciphertext query construction algorithm EncQueryGen(s,(i,j1,j2,…,j p )), generate ciphertext query c query ←EncQueryGen(s,(i,j1,j2,…,j p )).

[0193] c query and Params RLWE 、Params LWE 、Params LWEGSW , and LweGSW conversion key K i , and parameters p1 and p are sent to the server.

[0194] Step 3: Response calculation phase (server execution):

[0195] (1) Ciphertext query extension:

[0196] Query c from the ciphertext query Extract N LWE ciphertexts:

[0197] LWE.Enc(s,m i )=(c 0,i ,ρ i (c1)),i=0,1,…,N-1

[0198] Based on N LWE ciphertexts, construct p+1 groups of ciphertexts corresponding to each dimension in the database structure:

[0199] Generate ct LWE Group and ct LWEGSW,0 to ct LWEGSW,p-1 group; N LWE ciphertexts (c LWE,0 ,c LWE,1 ....,c LWE,N ) is divided into p+1 groups:

[0200] Group 1:

[0201]

[0202] Subsequent p group:

[0203] Convert the key K by inputting the LWEGSW scheme i And call the LWETOGSW algorithm to convert the LWE ciphertext group into the LweGSW ciphertext group: ct LWEGSW，k ,k=0,1,…,p-1.

[0204] (2) Confidential query calculation:

[0205] Use the first group of ciphertext ct LWE Processing the first dimension data:

[0206] right calculate:

[0207]

[0208] Use ct LWEGSW,0 to ct LWEGSW,p-1 , based on the homomorphic outer product of LWE ciphertext in LWE scheme to LWEGSW encoding in LWEGSW scheme, the subsequent dimensional data is processed:

[0209] initialization

[0210] Loop for k=0,1,...,v-1:

[0211] num=num / 2;

[0212] Calculate for h=0,1,…,num-1:

[0213]

[0214] Use the results for the next round of calculations;

[0215] Output query feedback

[0216] Step 4: Result acquisition phase (executed by user):

[0217] Receive inquiry feedback respond ;

[0218] Using the private key s, the query feedback is decrypted based on the LWE scheme to obtain the query result:

[0219] d index ←LWE.Dec(s,c respond )

[0220] As can be seen from the above, this invention implements a secure and efficient PIR scheme through direct coefficient extraction and efficient homomorphic outer product computation. The security of the entire scheme is based on the RLWE / LWE hard problem, and it also significantly improves performance compared to existing schemes.

[0221] Based on the same technical concept, an embodiment of the present invention further provides a lattice-based privacy information retrieval system based on coefficient extraction, comprising a first processing module, a second processing module, and a fourth processing module provided on the user, and a third processing module provided on the server;

[0222] The first processing module is configured to execute a system establishment phase: a user generates parameters and sends the generated parameters to a server; the parameters include database parameters, parameters and corresponding private keys of the RLWE scheme, the LWE scheme, and the LWEGSW scheme, and a conversion key of the LWEGSW scheme; the RLWE scheme, the LWE scheme, and the LWEGSW scheme maintain the same algebraic structure;

[0223] The second processing module is configured to execute a query generation phase: the user generates a query tuple according to the database structure and the query target, generates a ciphertext query based on the query tuple and the RLWE scheme, and sends the ciphertext query to the server;

[0224] The third processing module is used to perform a response calculation phase, in which the server performs ciphertext expansion on the received ciphertext query based on the received parameters and the LWE scheme and the LWEGSW scheme, and performs homomorphic calculation according to the database structure to obtain query feedback and send it to the user;

[0225] The fourth processing module is used to execute the result acquisition phase, where the user receives the query feedback and uses the private key and the LWE scheme to decrypt the query feedback to obtain the query result.

[0226] The specific working principles of the above-mentioned processing modules can be referred to the description in the above-mentioned method embodiment, which will not be repeated here.

[0227] The foregoing description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Those skilled in the art will readily appreciate that various modifications and variations of the present invention are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention are intended to be within the scope of protection of the present invention.

Claims

1. A lattice-based privacy information retrieval method based on coefficient extraction, characterized in that: include: System establishment phase: users generate parameters and send them to the server; The parameters include database parameters, plan, Program and The scheme's parameters and corresponding private keys, and Scheme conversion key; plan, Program and The scheme maintains the same algebraic structure; Query generation phase: The user generates query tuples according to the database structure and query objectives, and The solution generates a ciphertext query and sends the ciphertext query to the server; During the response calculation phase, the server calculates the response based on the received parameters and Program and The scheme expands the ciphertext of the received ciphertext query and performs homomorphic calculation according to the database structure to obtain the query feedback and send it to the user; In the result acquisition phase, the user receives the query feedback and uses the private key and The solution decrypts the query feedback to obtain the query result; The user-generated parameters include: According to safety parameters and the decision-making RLWE problem, generating plan, Program and Input parameters of the solution; according to The input parameters of the scheme generate the corresponding private key; Generated based on the private key Conversion key; Determine database parameters based on database size; The database structure adopts Dimensional hypercube organization: 1st Dimension: units; 2nd to Dimension: 2 units per dimension; The database parameters include and ; The query generation stage includes: Based on database structure and query objectives , using query index conversion algorithm ,generate Dimension query tuple ; Based on private key and stated Dimension query tuple , construct an algorithm based on ciphertext query , generate ciphertext query .

2. The lattice-based privacy information retrieval method based on coefficient extraction according to claim 1, characterized in that: The query index conversion algorithm includes: Calculate the first dimension index: ; Get the remainder: ; Calculate the index of each dimension: cycle From 1 to : Output Dimension query tuple .

3. The lattice-based privacy information retrieval method based on coefficient extraction according to claim 2, characterized in that: The ciphertext query construction algorithm includes: Initialize a polynomial ; In the polynomial The self-adding method cyclically embeds the information of each dimension; Based on the polynomial after cyclic embedding of information in each dimension ,use Encryption calculation in the scheme generates query ; Output ciphertext query .

4. The lattice-based privacy information retrieval method based on coefficient extraction according to claim 3 is characterized in that: The response calculation stage includes: (1) Ciphertext query extension: Query from ciphertext Extract indivual Ciphertext; based on indivual Ciphertext, construct the corresponding dimensions in the database structure Group ciphertext: generate Group and arrive group; LWE ciphertext Divided into Group: Group 1: ; Follow-up Group: By input Scheme conversion key and call The algorithm will The ciphertext group is converted to Ciphertext Group: ; (2) Perform dense state query calculation based on homomorphic outer product: Use the first group of ciphertext Process the first dimension data; use arrive , processing subsequent dimensional data based on the homomorphic outer product of LWE ciphertext in LWE scheme to LWEGSW encoding in LWEGSW scheme; After the processing is completed, the query feedback is output.

5. The lattice-based privacy information retrieval method based on coefficient extraction according to claim 4, characterized in that: The ciphertext query Extract indivual Ciphertext, including: Define a transformation that transforms the coefficient vector of the polynomial from 0th to reverse the order of consecutive elements, and arrive consecutive elements are reversed; Based on the defined transformation, query the ciphertext Extract indivual Ciphertext.

6. The lattice-based privacy information retrieval method based on coefficient extraction according to claim 5, characterized in that: described The algorithms include: calculate Each ciphertext group Ciphertext and conversion key The homomorphic outer product of The ciphertext vectors obtained by the homomorphic outer product are combined into a new ciphertext by column, that is, Ciphertext group.

7. A lattice-based privacy information retrieval system based on coefficient extraction, used to implement the lattice-based privacy information retrieval method based on coefficient extraction according to any one of claims 1 to 6, characterized in that: The system comprises a first processing module, a second processing module and a fourth processing module provided at the user, and a third processing module provided at the server; The first processing module is used to execute the system establishment phase: the user generates parameters and sends the generated parameters to the server; the parameters include database parameters, plan, Program and The scheme's parameters and corresponding private keys, and Scheme conversion key; plan, Program and The scheme maintains the same algebraic structure; The second processing module is used to execute the query generation phase: the user generates a query tuple according to the database structure and the query target, and The solution generates a ciphertext query and sends the ciphertext query to the server; The third processing module is used to execute the response calculation phase, and the server calculates the response according to the received parameters and Program and The scheme expands the ciphertext of the received ciphertext query and performs homomorphic calculation according to the database structure to obtain the query feedback and send it to the user; The fourth processing module is used to execute the result acquisition phase, the user receives the query feedback, and uses the private key and The solution decrypts the query feedback to obtain the query result.

Images