High-throughput privacy information retrieval method suitable for dynamic database

Abstract

The invention relates to the technical field of information security, in particular to a high-throughput privacy information retrieval method suitable for a dynamic database. Comprising the following steps: S1, server preprocessing: inputting a security parameter, a public seed and a database, and outputting an offline prompt comprising a first dimension of the database; s2, the client generates query information: inputting a security parameter, a public seed and an index (i, j) to be queried, and outputting query information qu and a private key sk; s3, service device online response query: inputting a database, query information qu and an offline prompt, and outputting response information; and S4, the client decrypts the response information: inputting the private key sk and the response information, and outputting a data item including retrieval. According to the method and the device, the throughput is further improved, the demand for offline prompt downloading of the client is eliminated, the server is ensured to only return information required by the user, the time of private information retrieval is greatly shortened, and the user experience and the data retrieval efficiency are remarkably improved.

Description

Technical Field

[0001] The present invention relates to the technical field of information security, and more particularly to a high-throughput privacy information retrieval method suitable for a dynamic database. Background Art

[0002] Private Information Retrieval (PIR) is a privacy-enhancing technique that allows users to retrieve items from a database server without revealing to the server which item is being retrieved. Its core purpose is to protect the privacy of users' queries from being known by the database owner.

[0003] Recently, researchers proposed the SimplePIR scheme, a PIR scheme with extremely high throughput on the server side, and gave an example of its application in certificate transparency, demonstrating the practicality of PIR technology. However, Menon and Wu pointed out that the SimplePIR scheme requires the client to pre-download the client prompts. When the database is dynamic and frequently updated, it will cause the client prompts to be updated, and then require the client to re-download the new client prompts, which wastes communication bandwidth and even makes the PIR scheme less efficient than the ordinary download of the database. To solve this problem, they proposed a YPIR scheme based on key switching technology, which implements silent preprocessing, thereby eliminating the need for communication between the client and the server in the offline phase. Similarly, Henzinger et al. and Li et al. also independently proposed HintlessPIR schemes that do not require the client to download data in the offline phase. They adopted the technology of uploading encrypted private keys. However, these solutions are direct improvements on SimplePIR-type databases. When the number of database items is medium and the size of each item is relatively large, they cannot directly handle it. The YPIR scheme and the HintlessPIR scheme both use the SimplePIR approach to handle the situation where the database items are large. However, the content returned to the user by SimplePIR in one query exceeds the user's query requirements, which does not meet the requirements when the server also has privacy requirements for its own database. Summary of the invention

[0004] The purpose of the present invention is to overcome the shortcomings of the prior art for medium-sized databases, where database updates are difficult when the database items are large, or the server needs to return more data, thereby improving throughput and eliminating the need for offline prompt downloads on the client, ensuring that the server only returns the information required by the user.

[0005] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0006] A high-throughput privacy information retrieval method for a dynamic database is provided, comprising the following steps:

[0007] S1. Server preprocessing: Input includes security parameters, public seeds and databases, and output includes offline prompts containing the first dimension of the database;

[0008] S2. The client generates query information: the input includes security parameters, public seeds, and the index (i, j) to be queried, and the output includes query information qu and private key sk;

[0009] S3. Server online response query: input includes database, query information qu and offline prompt, output includes response information;

[0010] S4. The client decrypts the response information: the input includes the private key sk and the response information, and the output includes the retrieved data item.

[0011] The present invention provides a high-throughput privacy information retrieval method for a dynamic database. The offline stage is completely executed autonomously by the server to generate a key offline prompt. With this prompt, the client can significantly reduce the computing burden in the subsequent online query stage, thereby accelerating the response speed. More importantly, the offline stage only needs to be executed once, which maximizes resource utilization. The offline prompts pre-calculated and generated by the server in the offline stage have extremely high reuse value and can support any number of queries initiated by any number of clients. In the face of updates to the database content, the solution provided by the present invention only requires the server to recalculate the offline prompts, and the client does not need to make any adjustments. This feature ensures the robustness and adaptability of the system in the face of dynamic changes in data. The present invention further improves throughput and eliminates the need for the client to download offline prompts, ensuring that the server only returns the information required by the user, greatly shortening the time for privacy information retrieval, and significantly improving user experience and data retrieval efficiency.

[0012] Preferably, the step S1 comprises:

[0013] S11. Assume that database D is organized as 2 v1 Row and 2 v2 Column, each entry in the database is an n×n matrix, each element in the matrix is ​​a polynomial ring, unless otherwise specified, the subscript starts at 0 and the range of traversal x is [0, x);

[0014] S12. The server generates 2 based on the public seed v1 Simulated matrix Regev ciphertext C reg , the dimension is (n+1)×n; specifically, traverse 2 v1 , for each i, calculate Creg[i]←CipherGen(1 λ ,s d||i); The server uses an oblivious pseudorandom function PRF (Pseudorandom Function) to instantiate the CipherGen algorithm. The input of the PRF is a public seed, and the output is a simulated matrix Regev ciphertext C reg ;

[0015] S13. Calculate the product of the generated simulation matrix Regev ciphertext and each row of the database, and then multiply the newly obtained 2 v2 The calculation results are accumulated by column;

[0016] S14. Finally, the accumulated 2 is obtained. v2 The calculation result is recorded as the offline prompt C hint .

[0017] Preferably, in step S12, the first simulation matrix Regev ciphertext is multiplied by all elements of the first row of the database to obtain 2 v2 The calculation results are used as the basis to calculate each of the following rows; then the newly obtained 2 v2 The calculation results are accumulated by column; specifically, traverse 2 v2 , for each j, calculate C hint [j]←ScalarMul(C reg [0], D[0][j]), for this C hint [j], traverse from 1 to 2 v1 , for each i, calculate Chint[j]←Add(C hint [j],ScalarMul(C reg [i], D[i][j])); wherein, the ScalarMul algorithm performs the multiplication of the matrix Regev ciphertext and a record (plaintext matrix) in the database, and the Add algorithm performs the addition of two matrix Regev ciphertexts.

[0018] Preferably, step S2 comprises:

[0019] S21. The client passes KeyGen(1 λ , 1 n ) algorithm randomly generates a secret key S=sk;

[0020] S22. The client generates 2 v1 Simulated matrix Regev ciphertext C reg , and according to C reg Generate semi-plaintext Z reg ;

[0021] S23. The client encodes the query index i into the semi-plaintext Zreg ;

[0022] S24. The client will query the index Use the packing algorithm provided by Spiral to encode into a polynomial ring, and then generate a query key s = qk to encrypt and obtain a constant Regev ciphertext c, which contains the column query information; the steps of the packing algorithm given here include, for l∈[v2], define the polynomial So The final encoded polynomial is Among them, Z GSW is the decomposition basis of the GSW ciphertext,

[0023] S25. The client uses the RegevToGSWSetup method provided by Spiral to generate a conversion key ck, which is used to convert the constant Regev ciphertext with the key s into the GSW ciphertext with the key S;

[0024] S26. The client assembles the query information qu←(Z reg , c, ck) and sk are taken as the output of step S2.

[0025] Preferably, in step S22, traverse 2 v1 , for each i, calculate C reg [i]←CipherGen(1 λ ,s d ||i) and Z reg [i]←HalfDecrypt(S,C reg [i]); in step S23, calculate Among them, floor is the floor function, p is the plaintext modulus, q is the ciphertext modulus, Δ′ is an adjustable integer parameter. The HalfDecrypt algorithm performs func is the rounding function.

[0026] Preferably, in step S25, the RegevToGSWSetup algorithm inputs the keys s and S and the decomposition basis Z of the GSW ciphertext GSW and the factorization basis z for conversion conv , output conversion key ck;

[0027] Includes the structure of the conversion key ck, input source key and the target key And the decomposition basis Z GSW and z conv v, we get:

[0028]

[0029]

[0030] in, is the Kronecker product, n is the matrix dimension, t conv is the decomposition basis z conv The length of the corresponding decomposition string, Permutation Matrix satisfy: Where m GSW =(n+1)t GSW .

[0031] Preferably, step S3 comprises:

[0032] S31. The server processes the semi-plaintext and obtains Z reg ←Z reg Δ′, Δ′ is an integer parameter;

[0033] S32. The server obtains the row of database encryption information corresponding to the required search index i;

[0034] S33. Server traversal completed 2 v2 , using the obtained h i , query the ciphertext c and conversion key ck, and use Spiral's Coefficient Expansion, RegevToGSW, Folding and ModulusSwitch algorithms to obtain online responses.

[0035] Preferably, in step S32, traverse 2 v2 , for each j, calculate Z hint [j]←Z reg [0]·D[0][j], for Z hint [j], traverse from 1 to 2 v1 , for each i, calculate Z hint [j]←Z hint [j]+Z reg [i]·D[i][j], traverse 2 v1 , for the current traversal j, execute h j =C hint [j]-[0|Z hint [j] T ] T .

[0036] Preferably, the step S33 comprises:

[0037] S331.Coefficient Expansion algorithm is used to obtain the ciphertext of the query column information. Input a polynomial Output expansion factor After receiving the query information qu, the server calls the Coefficient Expansion algorithm to calculate ceil(logt GSW V2) iteration steps, get a series of ciphertext where t GSW is the decomposition basis Z GSW Corresponding to the length of the decomposed string, ceil is the upward rounding function;

[0038] S332. For ciphertext Perform j∈[v2] iterations and calculate The RegevToGSW algorithm takes as input the conversion key ck and a series of Regev ciphertexts Calculate C i ←ScalToMat(W, c i ), where i∈[t GSW ], the ScalToMat algorithm inputs the transformation matrix W and the Regev ciphertext c (assuming it encrypts the message m), and the output is the matrix Regev ciphertext mI n ; Then, output the GSW ciphertext Where V is given by the RegevToGSWSetup algorithm mentioned above, is a function, z is a variable parameter, its function is to traverse each number in the input element, perform z-base decomposition, and then arrange the decomposed values ​​in reverse columns, for example,

[0039] S333. Execute the Folding algorithm, for r∈[v2] and for calculate Save the resulting ciphertext in In which, Add is ciphertext addition, Multiply is ciphertext multiplication, and the Complement function performs the inversion operation on a GSW ciphertext whose plaintext is 0 or 1;

[0040] S334. Get online response ModulusSwitch algorithm input ciphertext in make Output r←(c′1, C′2), where func is the rounding function; all division operations and rounding functions are performed on the polynomial ring.

[0041] Preferably, step S4 includes: after the client receives the response information, it uses the decryption algorithm of the homomorphic encryption scheme and the stored private key to calculate and then extract the entry to be searched.

[0042] Compared with the prior art, the present invention has the following beneficial effects:

[0043] 1. A high-throughput privacy information retrieval method for a dynamic database of the present invention integrates the Spiral scheme and the SimplePIR scheme, introduces a pre-computation process into the Spiral scheme, further improves the throughput of Spiral, and eliminates the need for offline prompt downloads on the client, ensuring that the server only returns the information required by the user.

[0044] 2. The high-throughput privacy information retrieval method for dynamic databases of the present invention is highly efficient in the offline stage, which is completely executed autonomously by the server to generate a key offline prompt. With this prompt, the client can significantly reduce the computing burden in the subsequent online query stage, thereby accelerating the response speed. What is particularly important is that the offline stage only needs to be executed once, thereby maximizing resource utilization. The offline prompts pre-calculated and generated by the server in the offline stage have extremely high reuse value and can support any number of queries initiated by any number of clients. This "once and for all" feature greatly improves the flexibility and efficiency of the system.

[0045] 3. The high-throughput privacy information retrieval method for dynamic databases of the present invention, in the face of database content updates, the solution provided by the present invention only requires the server to recalculate offline prompts, and the client does not need to make any adjustments. This feature ensures the robustness and adaptability of the system in the face of dynamic changes in data.

[0046] 4. The high-throughput privacy information retrieval method for dynamic databases of the present invention not only greatly shortens the time of privacy information retrieval, significantly improves user experience and data retrieval efficiency, but also provides an indestructible privacy protection barrier for user personal information and sensitive data through homomorphic encryption technology. This innovative solution not only ensures data security, but also pushes the boundaries of privacy information retrieval technology, bringing revolutionary progress to the field of information retrieval. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 The figure is a schematic diagram of the method flow of the present invention. DETAILED DESCRIPTION

[0048] The present invention is further described below in conjunction with specific implementation methods. The accompanying drawings are only used for exemplary descriptions and are only schematic diagrams, not actual drawings, and cannot be understood as limiting this patent; in order to better illustrate the embodiments of the present invention, some parts of the accompanying drawings may be omitted, enlarged or reduced, and do not represent the size of the actual product; for those skilled in the art, it is understandable that some well-known structures and their descriptions in the accompanying drawings may be omitted.

[0049] The same or similar numbers in the drawings of the embodiments of the present invention correspond to the same or similar parts; in the description of the present invention, it should be understood that if the terms "upper", "lower", "left", "right" and the like indicate directions or positional relationships based on the directions or positional relationships shown in the drawings, it is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific direction, be constructed and operated in a specific direction. Therefore, the terms describing the positional relationship in the drawings are only used for illustrative purposes and cannot be understood as limitations on this patent. For ordinary technicians in this field, the specific meanings of the above terms can be understood according to specific circumstances.

[0050] Embodiment 1

[0051] This embodiment is a first embodiment of a high-throughput privacy information retrieval method for a dynamic database. Figure 1 As shown, the following steps are included:

[0052] Step S1. Server preprocessing: The input includes security parameters, public seeds and databases, and the output includes offline prompts containing the first dimension of the database.

[0053] S11. Assume that database D is organized as 2 v1 Row and 2 v2 Column, each entry in the database is an n×n matrix, each element in the matrix is ​​a polynomial ring, unless otherwise specified, the subscript starts at 0 and the range of traversal x is [O, x);

[0054] S12. The server generates 2 based on the public seed v1 Simulated matrix Regev ciphertext C reg , the dimension is (n+1)×n; specifically, traverse 2 v1 , for each i, calculate C reg [i]←CipherGen(1 λ ,s d ||i); For example: the first simulated matrix Regev ciphertext is multiplied by all the elements in the first row of the database to obtain 2 v2 The calculation results are used as the basis to calculate each of the following rows; then the newly obtained 2 v2The calculation results are accumulated by column; specifically, traverse 2 v2 , for each j, calculate C hint [j]←ScalarMul(C reg [0], D[0][j]), for this C hint [j], traverse from 1 to 2 v1 , for each i, calculate C hint [j]←Add(C hint [j],ScalarMul(C reg [i], D[i][j]));

[0055] S13. Calculate the product of the generated simulation matrix Regev ciphertext and each row of the database, and then multiply the newly obtained 2 v2 The calculation results are accumulated by column;

[0056] S14. Finally, the accumulated 2 is obtained. v2 The calculation result is recorded as offline prompt C hint .

[0057] Step S2. The client generates query information: the input includes security parameters, a public seed, and the index (i, j) to be queried, and the output includes query information qu and a private key sk.

[0058] S21. The client passes KeyGen(1 λ , 1 n ) algorithm randomly generates a secret key S=sk;

[0059] S22. The client generates 2 v1 Simulated matrix Regev ciphertext C reg , and according to C reg Generate semi-plaintext Z reg ; Specifically, traverse 2 v1 , for each i, calculate C reg [i]←CipherGen(1 λ ,s d ||i) and Z reg [i]←HalfDecrypt(S,C reg [i]);

[0060] S23. The client encodes the query index i into the semi-plaintext Zreg; specifically, calculate Among them, floor is the floor function, p is the plaintext modulus, q is the ciphertext modulus, Δ′ is an integer parameter;

[0061] S24. The client will query the index Use the packing algorithm provided by Spiral to encode into a polynomial ring, then generate the query key s=qk and encrypt it to get a constant Regev ciphertext c, which contains the column query information;

[0062] S25. The client uses the RegevToGSWSetup method provided by Spiral to generate a conversion key ck, which is used to convert the constant Regev ciphertext with key s into the GSW ciphertext with key S; the RegevToGSWSetup algorithm inputs the keys s and S and the decomposition basis Z of the GSW ciphertext GSW and the factorization basis z for conversion conv , output conversion key ck; including giving the structure of conversion key ck, input source key and the target key And the decomposition basis Z GSW and z conv v, we get:

[0063]

[0064]

[0065] Among them, t conv is the decomposition basis z conv The length of the corresponding decomposition string, Permutation Matrix satisfy: Where m GSW =(n+1)t GSW ;

[0066] S26. The client assembles the query information qu←(Z reg , c, ck) and sk are taken as the output of step S2.

[0067] Step S3. The server responds to the query online: the input includes the database, the query information qu and the offline prompt, and the output includes the response information.

[0068] S31. The server processes the semi-plaintext and obtains Z reg ←Z reg Δ′, Δ′ is an integer parameter;

[0069] S32. The server obtains the row of database encryption information corresponding to the required search index i; specifically, traverse 2 v2 , for each j, calculate Z hint [j]←Z reg [0]·D[0][j], for Z hint [j], traverse from 1 to 2v1 , for each i, calculate Z hint [j]←Z hint [j]+Z reg [i]·D[i][j], traverse 2 v1 , for the current traversal j, execute h j =C hint [j]-[0|Z hint [j] T ] T ;

[0070] S33. Server traversal completed 2 v2 , use the obtained h, column to query the ciphertext c and conversion key ck, and use Spiral's Coefficient Expansion, RegevToGSW, Folding and ModulusSwitch algorithms to obtain online responses. Specifically include:

[0071] S331.Coefficient Expansion algorithm is used to obtain the ciphertext of the query column information. Input a polynomial Output expansion factor After receiving the query information qu, the server calls the Coefficient Expansion algorithm to calculate ceil(logt GSW V2) iteration steps, get a series of ciphertext where t GSW is the decomposition basis Z GSW Corresponding to the length of the decomposed string, ceil is the upward rounding function;

[0072] S332. For ciphertext Perform j∈[v2] iterations and calculate The RegevToGSW algorithm takes as input the conversion key ck and a series of Regev ciphertexts Calculate C i ←ScalToMat(W, c i ), where i∈[t GSW ] Then, output the GSW ciphertext

[0073] S333. Execute the Folding algorithm, for r∈[v2] and for calculate Save the resulting ciphertext in In which, Add is ciphertext addition, Multiply is ciphertext multiplication, and the Complement function performs the inversion operation on a GSW ciphertext whose plaintext is 0 or 1;

[0074] S334. Get online response ModulusSwitch algorithm input ciphertext in make Output r←(c′1, C′2), where func is the rounding function.

[0075] Step S4. The client decrypts the response information: the input includes the private key sk and the response information, and the output includes the retrieved data item. After receiving the response information, the client uses the decryption algorithm of the homomorphic encryption scheme and the saved private key to calculate and then extract the item to be searched.

[0076] This embodiment provides a high-throughput privacy information retrieval method for a dynamic database. The offline stage is completely executed autonomously by the server to generate a key offline prompt; with this prompt, the client can significantly reduce the computing burden in the subsequent online query stage, thereby accelerating the response speed. What is particularly important is that the offline stage only needs to be executed once, which maximizes resource utilization. The offline prompts pre-calculated and generated by the server in the offline stage have extremely high reuse value and can support any number of queries initiated by any number of clients. In the face of updates to the database content, the solution provided by this embodiment only requires the server to recalculate the offline prompts, and the client does not need to make any adjustments. This feature ensures the robustness and adaptability of the system in the face of dynamic changes in data. This embodiment greatly shortens the time for privacy information retrieval and significantly improves user experience and data retrieval efficiency.

[0077] Embodiment 2

[0078] This embodiment is a second embodiment of a high-throughput privacy information retrieval method for a dynamic database. This embodiment is similar to the first embodiment, except that, in this embodiment, it is assumed that the database has a total of N=2 9 2 6 =2 15 records, each record is an n×n polynomial ring matrix, here we assume n=2, the polynomial dimension is d=2048, the ciphertext modulus q=66974689739603969 is a 56-bit integer, the plaintext modulus p=256, Δ′=2 16 Since the present invention uses the relevant algorithms provided by Spiral, the corresponding parameters are also listed here for Coefficient Expansion, RegevToGSW GSW =9,t conv=4, q1 = 1024, q2 = 786433 for ModulusSwitch. Assume that the database wants to retrieve the 1234th data, the corresponding subscript is (i, j) = (19, 18).

[0079] The following steps are involved:

[0080] Step 1: The server performs preprocessing and generates offline prompts.

[0081] S11. Database D is organized as 2 9 Row and 2 6 Column, each entry in the database is a 2×2 matrix, and each element in the matrix is ​​a polynomial ring with a dimension of 2048.

[0082] S12. The server will generate 2 9 Simulated matrix Regev ciphertext C reg , the dimension is 3×2; the server uses an oblivious pseudorandom function PRF (Pseudorandom Function) to instantiate the CipherGen algorithm. The input of the PRF is a public seed, and the output is a simulated matrix Regev ciphertext C reg ; Specifically, traverse 2 9 , for each i, calculate C reg [i]←CipherGen(1 λ ,s d ||i).

[0083] S13. Perform product calculation based on the generated simulation matrix Regev ciphertext and each row of the database. For example, perform product calculation based on the first simulation matrix Regev ciphertext and all elements of the first row of the database to obtain 2 6 The calculation results are used as the basis for calculating each of the following rows, and then the newly obtained 2 6 The calculation results are accumulated by column; specifically, traverse 2 6 , for each j, calculate C hint [j]←ScalarMul(C reg [0], D[0][j]), for this C hint [j], traverse from 1 to 2 9 , for each i, calculate C hint [j]←Add(C hint [j],ScalarMul(C reg [i],D[i][j])).

[0084] S14. Finally, the accumulated 2 is obtained. 6The calculation result is recorded as offline prompt C hint .

[0085] Step 2: The client generates query information for row index and column index respectively.

[0086] S21. The client passes KeyGen(1 λ , 1 n ) algorithm randomly generates a secret key S=sk.

[0087] S22. The client generates 2 9 Simulated matrix Regev ciphertext C reg , and according to C reg Generate semi-plaintext Z reg ; Specifically, traverse 2 9 , for each i, calculate C reg [i]←CipherGen(1 λ ,s d ||i) and Z reg [i]←HalfDecrypt(S,C reg [i]).

[0088] S23. The client encodes the query index i into the semi-plaintext Z reg Specifically, calculate Among them, floor is the floor function, p is the plaintext modulus, q is the ciphertext modulus, Δ′=2 16 .

[0089] S24. The client encodes the query index j=18=(0, 1, 0, 0, 1, 0) into a polynomial ring using Spiral's packing algorithm, and then generates a query key s=qk and encrypts it to obtain a constant Regev ciphertext c, which contains the column query information.

[0090] S25. The client generates a conversion key ck using Spiral's RegevToGSWSetup algorithm, which is used to convert the constant Regev ciphertext whose key is s into the GSW ciphertext whose key is S. The structure of the conversion key ck has been mentioned above and will not be repeated here.

[0091] S26. The client assembles the query information qu←(Z reg , c, ck) and sk are taken as the output of step S2.

[0092] Step 3: The server performs online calculations, which are implemented as follows.

[0093] S31. The server processes the semi-plaintext and obtains Z reg ←Z reg 2 16 .

[0094] S32. The server obtains the row of database encryption information corresponding to the required search index i. Specifically, traverse 2 6 , for each j, calculate Z hint [j]←Z reg [0]·D[0][j], for this Z hint [j], traverse from 1 to 2 9 , for each i, calculate Z hint [j]←Z hint [j]+Z reg [i]·D[i][j], traverse 2 9 , for the current traversal j, execute h j =C hint [j]-[0|Z hint [j] T ] T .

[0095] S33. Server traversal completed 2 6 ,Use the obtained h, column to query the ciphertext c and the conversion key ck, and use Spiral's Coefficient Expansion, RegevToGSW, Folding and ModulusSwitch algorithms to obtain the online response.

[0096] S34. Coefficient Expansion algorithm is used to obtain the ciphertext of the query column information. Input a polynomial Output expansion factor After receiving the query information qu, the server calls the Coefficient Expansion algorithm for ceil(log 54) iterations for the ciphertext c to obtain a series of ciphertexts

[0097] S35. For ciphertext Perform j∈[6] iterations and calculate The RegevToGSW algorithm takes as input the conversion key ck and a series of Regev ciphertexts Calculate C i ←ScalToMat(W, c i ) for i∈[9]. Then, output the GSW ciphertext

[0098] S36. Now execute the Folding algorithm for r∈[6] and for j∈[0, 2 6-r -1], calculate The resulting ciphertext is stored in In which, Add is ciphertext addition, Multiply is ciphertext multiplication, and the Complement function performs the inversion operation on a GSW ciphertext whose plaintext is 0 or 1.

[0099] S37. Get online response ModulusSwitch algorithm input ciphertext in make Output r←(c′1, C′2), where q1=1024, q2=786433.

[0100] Step 4: After receiving the response, the client performs the following steps:

[0101] The decryption algorithm of the homomorphic encryption scheme is used and the saved private key is used to calculate and then extract the entry to be found.

[0102] Embodiment 3

[0103] This embodiment provides a device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the high-throughput privacy information retrieval method for a dynamic database described in Embodiment 1.

[0104] In the specific contents of the above-mentioned specific implementation methods, the various technical features can be combined in any non-contradictory manner. In order to make the description concise, not all possible combinations of the above-mentioned technical features are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0105] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the present invention, and are not intended to limit the embodiments of the present invention. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the embodiments here. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the claims of the present invention.

Claims

1. A high-throughput privacy information retrieval method for dynamic databases, characterized in that: The following steps are involved: S1. Server preprocessing: Input includes security parameters, public seeds and databases, and output includes offline prompts containing the first dimension of the database; S2. The client generates query information: the input includes security parameters, public seeds, and the index to be queried (i, j), and the output includes query information qu and private key sk; S3. Server online response query: input includes database, query information qu and offline prompt, output includes response information; S4. The client decrypts the response information: the input includes the private key sk and the response information, and the output includes the retrieved data item.

2. The high-throughput privacy information retrieval method for dynamic databases according to claim 1, characterized in that: The step S1 comprises: S11. Assume that database D is organized as 2 v1 Row and 2 v2 Column, each entry in the database is an n×n matrix, each element in the matrix is ​​a polynomial ring, unless otherwise specified, the subscript starts at 0 and the range of traversal x is [0, x); S12. The server generates 2 based on the public seed v1 Simulated matrix Regev ciphertext C reg , the dimension is (n+1)×n; specifically, traverse 2 v1 , for each i, calculate C reg [i]←CipherGen(1 λ ,s d ||i); S13. Calculate the product of the generated simulation matrix Regev ciphertext and each row of the database, and then multiply the newly obtained 2 v2 The calculation results are accumulated by column; S14. Finally, the accumulated 2 is obtained. v2 The calculation result is recorded as offline prompt C hint .

3. The high-throughput privacy information retrieval method for dynamic databases according to claim 2, characterized in that: In step S12, the first simulated matrix Regev ciphertext is multiplied by all the elements in the first row of the database to obtain 2 v2 The calculation results are used as the basis to calculate each of the following rows; then the newly obtained 2 v2 The calculation results are accumulated by column; specifically, traverse 2 v2 , for each j, calculate C hint [j]←ScalarMul(C reg [0], D[0][j]), for this C hint [j], traverse from 1 to 2 v1 , for each i, calculate C hint [j]←Add(C hint [j],ScalarMul(C reg [i],D[i][j])).

4. The high-throughput privacy information retrieval method for dynamic databases according to claim 2, characterized in that: The step S2 comprises: S21. The client passes KeyGen(1 λ ,1 n ) algorithm randomly generates a secret key S=sk; S22. The client generates 2 v1 Simulated matrix Regev ciphertext C reg , and according to C reg Generate half plaintext Z reg ; S23. The client encodes the query index i into the semi-plaintext Z reg ; S24. The client will query the index Use the packing algorithm provided by Spiral to encode into a polynomial ring, then generate the query key s=qk and encrypt it to get a constant Regev ciphertext c, which contains the column query information; S25. The client uses the RegevToGSWSetup method provided by Spiral to generate a conversion key ck, which is used to convert the constant Regev ciphertext with the key s into the GSW ciphertext with the key S; S26. The client assembles the query information qu←(Z reg ,c,ck) and sk are taken as the output of step S2.

5. The high-throughput privacy information retrieval method for dynamic databases according to claim 4, characterized in that: In step S22, traverse 2 v1 , for each i, calculate C reg [i]←CipherGen(1 λ ,s d ||i) and Z reg [i]←HalfDecrypt(S,C reg [i]); in step S23, calculate Among them, floor is the floor function, p is the plaintext modulus, q is the ciphertext modulus, Δ ′ Is an adjustable integer parameter.

6. The high-throughput privacy information retrieval method for dynamic databases according to claim 4, characterized in that: In step S25, the RegevToGSWSetup algorithm inputs the keys s and S and the decomposition basis z of the GSW ciphertext. GSW and the factorization basis z for conversion conv , output conversion key ck; Includes the structure of the conversion key ck, input source key and the target key And the decomposition basis z GSW and z conv v, we get: in, is the Kronecker product, n is the matrix dimension, t conv is the decomposition basis z conv The length of the corresponding decomposition string, Permutation Matrix satisfy: Where m GSW =(n+1)t GSW .

7. The high-throughput privacy information retrieval method for dynamic databases according to claim 4, characterized in that: The step S3 comprises: S31. The server processes the semi-plaintext and obtains Z reg ←Z reg Δ ′ , Δ ′ is an integer parameter; S32. The server obtains the row of database encryption information corresponding to the required search index i; S33. Server traversal completed 2 v2 , using the obtained h j , query the ciphertext c and conversion key ck, and use Spiral's Coefficient Expansion, RegevToGSW, Folding and ModulusSwitch algorithms to obtain online responses.

8. The high-throughput privacy information retrieval method for dynamic databases according to claim 7, characterized in that: In step S32, traverse 2 v2 , for each j, calculate Z hint [j]←Z reg [0]·D[0][j], for Z hint [j], traverse from 1 to 2 v1 , for each i, calculate Z hint [j]←Z hint [j]+Z reg [i]·D[i][j], traverse 2 v1 , for the current traversal j, execute h j =C hint [j]-[0|Z hint [j] T ] T .

9. The high-throughput privacy information retrieval method for dynamic databases according to claim 7, characterized in that: The step S33 comprises: S331. Coefficient Expansion algorithm is used to obtain the ciphertext of the query column information. Enter a polynomial Output expansion factor After receiving the query information qu, the server calls the Coefficient Expansion algorithm to calculate ceil(logt GSW v2) Iteration step, get a series of ciphertext where t GSW is the decomposition basis z GSW Corresponding to the length of the decomposed string, ceil is the upward rounding function; S332. For ciphertext Perform j∈[v2] iterations and calculate The RegevToGSW algorithm takes as input the conversion key ck and a series of Regev ciphertexts Calculate C i ←ScalToMat(W,c i ), where i∈[t GSW ], then output the GSW ciphertext S333. Execute the Folding algorithm, for r∈[v2] and for calculate Save the resulting ciphertext in In which, Add is ciphertext addition, Multiply is ciphertext multiplication, and the Complement function performs the inversion operation on a GSW ciphertext whose plaintext is 0 or 1; S334. Get online response ModulusSwitch algorithm input ciphertext in make Output r←(c ′ 1,C ′ 2), where func is the rounding function.

10. The high-throughput privacy information retrieval method for a dynamic database according to any one of claims 1 to 9, characterized in that: The step S4 includes: after the client receives the response information, it uses the decryption algorithm of the homomorphic encryption scheme and the stored private key to calculate and then extract the entry to be searched.

Images