A high-throughput privacy information retrieval method suitable for dynamic databases

Abstract

The application relates to the technical field of information security and relates to a high-throughput private information retrieval method suitable for a dynamic database.The method comprises the following steps: S1, server preprocessing: inputting security parameters, a public seed and a database, and outputting offline hints containing the first dimension of the database; S2, client generating query information: inputting the security parameters, the public seed and an index (i, j) to be queried, and outputting query information qu and a private key sk; S3, server online responding to the query: inputting the database, the query information qu and the offline hints, and outputting response information; and S4, client decrypting the response information: inputting the private key sk and the response information, and outputting retrieved data items.The application further improves the throughput, eliminates the need for downloading offline hints by the client, ensures that the server only returns the information required by the user, greatly shortens the time for private information retrieval, and significantly improves the user experience and data retrieval efficiency.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and more particularly, to a high-throughput private information retrieval method suitable for dynamic databases. BACKGROUND

[0002] Private information retrieval (PIR) is a privacy-enhancing technique that allows a user to retrieve an item from a database server without revealing to the server which item is being retrieved. The core purpose is to protect the user's query privacy from the database owner.

[0003] Recently, researchers have proposed a SimplePIR scheme, which is a PIR scheme with very high throughput on the server side, and have given an application example in certificate transparency, showing the practicality of PIR technology. However, Menon and Wu pointed out that the SimplePIR scheme requires the client to download the client hint in advance, and when the database is dynamic and frequently updated, it will cause the update of the client hint, and then require the client to download the new client hint, which wastes the communication bandwidth, and even makes the PIR scheme less efficient than the trivial download database. In order to solve this problem, they proposed a YPIR scheme based on key switching technology, which realizes silent preprocessing, thereby eliminating the communication demand between the client and the server in the offline stage. Similarly, Henzinger et al. and Li et al. also independently proposed a HintlessPIR scheme that does not require the client to download data in the offline stage, and they use the technology of uploading an encrypted private key. However, these solutions are direct improvements of the SimplePIR type database, and cannot directly handle the case where the number of database items is medium and the size of each item is relatively large. The YPIR scheme and the HintlessPIR scheme both use the SimplePIR method to handle the case where the database items are large. However, SimplePIR returns more content to the user than the user's query requirements in one query, which does not meet the requirements when the server also has privacy requirements for its own database. SUMMARY

[0004] The purpose of the present application is to overcome the deficiencies of the prior art in the case of medium-sized databases and large database items, which makes database updating difficult or requires the server to return more data, thereby improving the throughput and eliminating the need for the client to download the offline hint, and ensuring that the server only returns the information required by the user.

[0005] To solve the above technical problems, the technical scheme adopted by the present application is:

[0006] A high-throughput private information retrieval method for dynamic databases is provided, comprising the following steps:

[0007] S1. Server preprocessing: input includes security parameters, public seed and database, output includes offline hint containing the first dimension of the database;

[0008] S2. Client generates query information: input includes security parameters, public seed and the index (i, j) to be queried, output includes query information qu and private key sk;

[0009] S3. Server online response to query: input includes database, query information qu and offline hint, output includes response information;

[0010] S4. Client decrypts response information: input includes private key sk and response information, output includes retrieved data item.

[0011] The application provides a high-throughput private information retrieval method for dynamic databases. The offline stage is completely executed by the server independently, and a key offline hint is generated. With the help of the hint, the client can significantly reduce the computational burden in the subsequent online query stage, thereby accelerating the response speed. Importantly, the offline stage only needs to be executed once, maximizing resource utilization. The offline hint generated by the server in the offline stage has a very high reuse value and can support any number of queries initiated by any number of clients. In the face of database content updates, the scheme provided by the application only needs to recalculate the offline hint on the server side, and the client does not need to make any adjustments. This feature ensures the robustness and adaptability of the system when facing dynamic data changes. The application further improves the throughput and eliminates the need for client offline hint download, ensuring that the server only returns the information required by the user, significantly shortening the time of private information retrieval, and significantly improving user experience and data retrieval efficiency.

[0012] Preferably, the step S1 comprises:

[0013] S11. Assuming that the database D is organized as 2 v1 rows and 2 v2 columns, each entry of the database is an n x n matrix, and each element in the matrix is a polynomial ring, unless otherwise specified, the subscript starts from 0, and the range of x is [0, x);

[0014] S12. The server generates 2 v1 Regev ciphertext C reg matrices according to the public seed, and the dimension is (n+1) x n; specifically, 2 v1 for each i, calculate Creg[i] <- CipherGen(1 λ , s d||i); the server instantiates the CipherGen algorithm using a non-cryptographic pseudorandom function (PRF) with an input of a public seed and an output of a simulated matrix Regev ciphertext C reg ;

[0015] S13. The generated simulated matrix Regev ciphertext is multiplied with each row of the database, and then the newly obtained 2 v2 results are accumulated column by column;

[0016] S14. Finally, the accumulated 2 v2 results are obtained, and are denoted as the offline hint C hint .

[0017] Preferably, in step S12, the first simulated matrix Regev ciphertext is multiplied with all elements of the first row of the database, and 2 v2 results are obtained, and based on this, each subsequent row is calculated; then the newly obtained 2 v2 results are accumulated column by column; specifically, 2 v2 is traversed, for each j, C hint [j] is calculated as ScalarMul(C reg [0], D[0][j]), for this C hint [j], 2 v1 is traversed from 1, for each i, Chint[j] is calculated as Add(C hint [j], ScalarMul(C reg [i], D[i][j])); wherein the ScalarMul algorithm performs multiplication of a matrix Regev ciphertext and a record (plaintext matrix) in the database, and the Add algorithm performs addition of two matrix Regev ciphertexts.

[0018] Preferably, the step S2 comprises:

[0019] S21. The client randomly generates a secret key S = sk through the KeyGen(1 λ , 1 n ) algorithm;

[0020] S22. The client generates 2 v1 simulated matrix Regev ciphertexts C reg according to the public seed, and generates a semi-plaintext Z reg according to C reg ;

[0021] S23. The client encodes the subscript i of the query into the semi-plaintext Zreg ;

[0022] S24. The client encodes the query index into a polynomial ring using the packing algorithm provided by Spiral, and then generates a constant Regev ciphertext c containing the information of the column query by encrypting the query key s = qk; the steps of the packing algorithm are given as follows: for l ∈ [v2], define the polynomial Then The final encoded polynomial is where Z GSW is the decomposition basis of the GSW ciphertext,

[0023] S25. The client generates the conversion key ck using the RegevToGSWSetup method provided by Spiral, which is used to convert the constant Regev ciphertext with key s into the GSW ciphertext with key S;

[0024] S26. The client assembles the query information qu ← (Z reg , c, ck) and sk as the output of step S2.

[0025] Preferably, in the step S22, the following is performed: for i = 0, 1, 2, …, v - 1, v1 for each i, calculate C reg [i] ← CipherGen(1 λ , s d || i) and Z reg [i] ← HalfDecrypt(S, C reg [i]); and in the step S23, calculate where floor is the floor function, p is the plaintext modulus, q is the ciphertext modulus, Δ' is an adjustable integer parameter, and the HalfDecrypt algorithm performs func is the rounding function.

[0026] Preferably, in the step S25, the RegevToGSWSetup algorithm inputs the key s and S and the decomposition basis Z GSW of the GSW ciphertext and the decomposition basis z conv for conversion, and outputs the conversion key ck.

[0027] The structure of the conversion key ck is given, the input source key and the target key and the decomposition basis Z GSW and z conv v, and the following is obtained:

[0028]

[0029]

[0030] wherein, is the Kronecker product, n is the dimension of the matrix, t conv is the decomposition basis z conv corresponds to the length of the decomposition string, the permutation matrix satisfies: wherein m GSW = (n+1)t GSW .

[0031] Preferably, the step S3 comprises:

[0032] S31. The server processes the obtained semi-plaintext to obtain Z reg ← Z reg · Δ', Δ' being an integer parameter;

[0033] S32. The server obtains the database encrypted information corresponding to the row of the required search index i;

[0034] S33. The server traverses 2 v2 , using the obtained h i , the column query ciphertext c and the conversion key ck, using the Spiral Coefficient Expansion, RegevToGSW, Folding and ModulusSwitch algorithms, to obtain the online response.

[0035] Preferably, in the step S32, 2 v2 is traversed, for each j, Z hint [j] is calculated as Z reg [0] · D[0][j], for Z hint [j], 2 v1 is traversed starting from 1, for each i, Z hint [j] is calculated as Z hint [j] + Z reg [i] · D[i][j], after traversing 2 v1 , for the current traversal j, h j = C hint [j] - [0|Z hint [j] T ] T .

[0036] Preferably, the step S33 comprises:

[0037] S331. Coefficient Expansion algorithm is used to obtain the column information ciphertext of the query, input a polynomial Output the expanded coefficient The server receives the query information qu, and for the ciphertext c, calls the Coefficient Expansion algorithm to obtain the ciphertext GSW V2) times of iteration steps to obtain a series of ciphertexts Where t GSW is the decomposition base Z GSW , the length of the decomposition string, and ceil is the ceiling function.

[0038] S332. For the ciphertext , perform j∈[v2] times of iteration to calculate The RegevToGSW algorithm inputs the conversion key ck and a series of Regev ciphertexts Calculate C i ←ScalToMat(W, c i ), where i∈[t GSW ], and the ScalToMat algorithm inputs the conversion matrix W and the Regev ciphertext c (assuming it encrypts the message m), and outputs the matrix Regev ciphertext mI n ; then, output the GSW ciphertext Where V is given by the RegevToGSWSetup algorithm mentioned above, is a functional function, and z is a variable parameter, which is used to traverse each number in the input element in z-base decomposition, and then arrange the decomposed values in reverse order by column, for example,

[0039] S333. Execute the Folding algorithm, for r∈[v2] and for Calculate Save the result ciphertext in , where Add is ciphertext addition, Multiply is ciphertext multiplication, and the Complement function performs the inverse operation on a GSW ciphertext with plaintext 0 or 1;

[0040] S334. Obtain the online response The ModulusSwitch algorithm inputs the ciphertext Where Let Output r←(c′1, C′2), where func is the rounding function; all division operations and rounding functions are calculated on the polynomial ring.

[0041] Preferably, the step S4 comprises: after the client receives the response information, calculating through a decryption algorithm of the homomorphic encryption scheme and the saved private key, and then extracting the required search entry.

[0042] Compared with the prior art, the present application has the beneficial effects that:

[0043] 1. The high-throughput privacy information retrieval method for dynamic database of the present application fuses the Spiral scheme and the SimplePIR scheme, introduces a pre-computation process in the Spiral scheme, further improves the throughput of the Spiral, eliminates the need for offline prompt download of the client, and ensures that the server only returns the information required by the user.

[0044] 2. The high-throughput privacy information retrieval method for dynamic database of the present application has high efficiency in the offline stage, which is completely performed by the server independently to generate a key offline prompt. With the prompt, the client can significantly reduce the computing burden in the subsequent online query stage, thereby accelerating the response speed. Importantly, the offline stage only needs to be performed once, realizing the maximization of resource utilization. The offline prompt generated by the server in the offline stage has a very high reuse value and can support any number of queries initiated by any number of clients. This "once and for all" feature greatly improves the flexibility and efficiency of the system.

[0045] 3. The high-throughput privacy information retrieval method for dynamic database of the present application only needs to recompute the offline prompt on the server side in the face of updates of the database content, and the client does not need to make any adjustment. This feature ensures the robustness and adaptability of the system in the face of dynamic changes of data.

[0046] 4. The high-throughput privacy information retrieval method for dynamic database of the present application not only greatly shortens the time of privacy information retrieval, significantly improves the user experience and data retrieval efficiency, but also provides an invincible privacy protection barrier for personal information and sensitive data of users through the homomorphic encryption technology. This innovative scheme not only guarantees data security, but also promotes the boundaries of privacy information retrieval technology, bringing revolutionary progress to the field of information retrieval. BRIEF DESCRIPTION OF DRAWINGS

[0047] Figure 1 The figure is a method flowchart of the present application. DETAILED DESCRIPTION

[0048] The present invention will be further described below with reference to specific embodiments. The accompanying drawings are for illustrative purposes only, representing schematic diagrams rather than actual physical objects, and should not be construed as limiting the scope of this patent. To better illustrate the embodiments of the present invention, some components in the drawings may be omitted, enlarged, or reduced, and do not represent the actual dimensions of the product. It is understandable to those skilled in the art that some well-known structures and their descriptions may be omitted in the drawings.

[0049] In the accompanying drawings of the embodiments of the present invention, the same or similar reference numerals correspond to the same or similar components. In the description of the present invention, it should be understood that if terms such as "upper," "lower," "left," "right," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the drawings, they are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, the terms used to describe positional relationships in the drawings are only for illustrative purposes and should not be construed as limiting the present patent. For those skilled in the art, the specific meaning of the above terms can be understood according to the specific circumstances.

[0050] Example 1

[0051] This embodiment is a first embodiment of a high-throughput privacy information retrieval method for dynamic databases, such as... Figure 1 As shown, it includes the following steps:

[0052] Step S1. Server preprocessing: Inputs include security parameters, public seeds, and databases; outputs include offline hints containing the first dimension of the database.

[0053] S11. Assume database D is organized into 2 groups. v1 row and 2 v2 In the database, each entry is an n×n matrix, and each element in the matrix is ​​a polynomial ring. Unless otherwise specified, the index starts from 0, and the range of x is [0, x).

[0054] S12. The server generates 2 based on the publicly available seed. v1 The simulation matrix Regev ciphertext C reg The dimension is (n+1)×n; specifically, iterate through 2... v1 For each i, calculate C reg [i]←CipherGen(1 λ s d ||i); For example: multiplying the first simulated matrix Regev ciphertext with all elements of the first row of the database yields 2. v2 Based on the first calculation result, perform calculations on each subsequent row; then, for the newly obtained 2... v2The calculation results are accumulated column by column; specifically, traversing 2 v2 For each j, calculate C hint [j]←ScalarMul(C reg [0],D[0][j]), for this C hint [j], starting from 1, iterate through 2. v1 For each i, calculate C hint [j]←Add(C hint [j], ScalarMul(C reg [i],D[i][j]));

[0055] S13. Calculate the product between the generated simulation matrix Regev ciphertext and each row of the database, and then calculate the product of the newly obtained 2... v2 The calculation results are summed column by column;

[0056] S14. Finally, we obtain the sum of 2. v2 The calculation result is recorded as offline prompt C. hint .

[0057] Step S2. The client generates query information: the input includes security parameters, the public seed, and the index (i, j) to be queried, and the output includes query information qu and private key sk.

[0058] S21. The client uses KeyGen(1) λ 1 n The algorithm randomly generates a secret key S = sk;

[0059] S22. The client will generate 2 based on the publicly available seed. v1 The simulation matrix Regev ciphertext C reg , and according to C reg Generate semi-plaintext Z reg Specifically, iterate through 2 v1 For each i, calculate C reg [i]←CipherGen(1 λ s d ||i) and Z reg [i]←HalfDecrypt(S,C) reg [i]);

[0060] S23. The client encodes the queried index i into the semi-plaintext Zreg; specifically, it calculates... Where floor is the floor function, p is the plaintext modulus, and q is the ciphertext modulus. Δ′ is an integer parameter;

[0061] S24. The client encodes the query index into a polynomial ring using the packing algorithm provided by Spiral, and then generates a constant Regev ciphertext c with the query key s = qk, which contains the information of the column query;

[0062] S25. The client generates a conversion key ck using the RegevToGSWSetup method provided by Spiral, which is used to convert the constant Regev ciphertext with the key s into the GSW ciphertext with the key S; the RegevToGSWSetup algorithm inputs the key s and S and the decomposition base Z of the GSW ciphertext GSW and the decomposition base z for conversion conv , and outputs the conversion key ck; including the structure of the conversion key ck, the input source key and the target key and the decomposition base Z GSW and z conv v, to obtain:

[0063]

[0064]

[0065] where t conv is the length of the decomposition string corresponding to the decomposition base z conv , the permutation matrix satisfies: where m GSW = (n + 1) t GSW ;

[0066] S26. The client assembles the query information qu←(Z reg , c, ck) and sk as the output of step S2.

[0067] Step S3. The server responds to the query online: input includes the database, the query information qu and the offline hint, and output includes the response information.

[0068] S31. The server processes the obtained semi-plaintext to obtain Z reg ← Z reg · Δ', Δ' is an integer parameter;

[0069] S32. The server obtains the encrypted information of the row corresponding to the required search index i; specifically, traversing 2 v2 , for each j, calculate Z hint [j] ← Z reg [0] · D[0][j], for Z hint [j], traverse 2​v1 For each i, compute Z hint [j]←Z hint [j]+Z reg [i]·D[i][j], for i∈[v2] v1 For the current iteration j, perform h j = C hint [j]-[0|Z hint [j] T ] T ;

[0070] S33. The server traverses v2 v2 , using the obtained h, the query ciphertext c and the conversion key ck, using the Spiral's Coefficient Expansion, RegevToGSW, Folding and ModulusSwitch algorithms, to obtain the online response. Specifically, it includes:

[0071] S331. The Coefficient Expansion algorithm is used to obtain the queried column information ciphertext, input a polynomial Output the expanded coefficients After the server receives the query information qu, for the ciphertext c, call the Coefficient Expansion algorithm to perform ceil(logt GSW V2) times of iteration steps to obtain a series of ciphertexts Where t GSW is the length of the decomposition string corresponding to the decomposition base Z GSW , and ceil is the ceiling function;

[0072] S332. For the ciphertext , perform j∈[v2] times of iteration to compute The RegevToGSW algorithm inputs the conversion key ck and a series of Regev ciphertexts Compute C i ←ScalToMat(W, c i ), where i∈[t GSW ] Then, output the GSW ciphertext

[0073] S333. Perform the Folding algorithm, for r∈[v2] and for Compute Save the result ciphertext in , where Add is the ciphertext addition, Multiply is the ciphertext multiplication, and the Complement function performs the negation operation on a GSW ciphertext with plaintext 0 or 1;

[0074] S334. Obtain Online Response ModulusSwitch algorithm input ciphertext in make Output r←(c′1,C′2), where func is the rounding function.

[0075] Step S4. Client decrypts response information: Input includes private key sk and response information; output includes the retrieved data item. After receiving the response information, the client uses the homomorphic encryption scheme's decryption algorithm and the stored private key to calculate and then extract the desired item.

[0076] This embodiment provides a high-throughput privacy information retrieval method for dynamic databases. The offline phase is entirely executed autonomously by the server, generating a crucial offline hint. With this hint, the client can significantly reduce the computational burden during the subsequent online query phase, thereby accelerating response speed. Crucially, the offline phase only needs to be executed once, maximizing resource utilization. The offline hint pre-calculated by the server during the offline phase has high reusability, supporting any number of queries initiated by any number of clients. When the database content is updated, the solution provided in this embodiment only requires the server to recalculate the offline hint; the client does not need to make any adjustments. This feature ensures the system's robustness and adaptability in the face of dynamic data changes. This embodiment significantly shortens the privacy information retrieval time and significantly improves user experience and data retrieval efficiency.

[0077] Example 2

[0078] This embodiment is a second embodiment of a high-throughput privacy information retrieval method for dynamic databases. This embodiment is similar to the first embodiment, except that in this embodiment, it is assumed that the database has a total of N=2... 9 ·2 6 =2 15 There are 10 records, each a polynomial ring matrix of size n × n. Here, we assume n = 2, the polynomial dimension is d = 2048, the ciphertext modulus q = 66974689739603969 is a 56-bit integer, the plaintext modulus p = 256, and Δ′ = 2. 16 Since this invention utilizes algorithms provided by Spiral, the corresponding parameters are listed here for Coefficient Expansion and RegevToGSW's t. GSW =9,t conv=4, and for ModulusSwitch, q1 = 1024, q2 = 786433. Suppose the database wants to retrieve the 1234th data item, the corresponding index is (i, j) = (19, 18).

[0079] Includes the following steps:

[0080] Step 1: The server performs preprocessing and generates offline prompts.

[0081] S11. Database D is organized as 2 9 row and 2 6 Each entry in the database is a 2×2 matrix, and each element in the matrix is ​​a polynomial ring with a dimension of 2048.

[0082] S12. The server will generate 2 based on the publicly available seed. 9 The simulation matrix Regev ciphertext C reg The dimension is 3×2; the server uses an unintentional pseudo-random function (PRF) to instantiate the CipherGen algorithm. The input of the PRF is a public seed, and the output is a simulated matrix Regev ciphertext C. reg Specifically, traverse 2 9 For each i, calculate C reg [i]←CipherGen(1 λ s d ||i).

[0083] S13. Multiply the generated simulation matrix Regev ciphertext with each row of the database. For example, multiply the first simulation matrix Regev ciphertext with all elements of the first row of the database to obtain 2. 6 Based on the first calculation result, perform calculations on each subsequent row, and then calculate the newly obtained 2. 6 The calculation results are accumulated column by column; specifically, traversing 2 6 For each j, calculate C hint [j]←ScalarMul(C reg [0],D[0][j]), for this C hint [j], starting from 1, iterate through 2. 9 For each i, calculate C hint [j]←Add(C hint [j], ScalarMul(C reg [i],D[i][j])).

[0084] S14. Finally, we obtain the sum of 2. 6The result of this computation is denoted by offline hint C hint .

[0085] Step 2: Client generates query information for row index and column index respectively.

[0086] S21. Client randomly generates a secret key S = sk by KeyGen(l λ , 1 n ).

[0087] S22. Client generates 2 9 Regev ciphertexts C reg and a semi-plaintext Z reg from C reg according to the public seed; specifically, iterate over 2 9 , for each i, compute C reg [i] ← CipherGen(l λ , s d || i) and Z reg [i] ← HalfDecrypt(S, C reg [i]).

[0088] S23. Client encodes the index i of the query into the semi-plaintext Z reg , specifically, compute where floor is the floor function, p is the plaintext modulus, q is the ciphertext modulus, Δ' = 2 16 .

[0089] S24. Client encodes the query index j = 18 = (0, 1, 0, 0, 1, 0) into a polynomial ring using the packing algorithm of Spiral, and then generates a query key s = qk to encrypt a constant Regev ciphertext c, which contains the information of the column query.

[0090] S25. Client generates a conversion key ck using the RegevToGSWSetup algorithm of Spiral, which is used to convert the constant Regev ciphertext with key s into GSW ciphertext with key S. The structure of the conversion key ck has been mentioned above and will not be repeated here.

[0091] S26. Client assembles the query information qu = (Z reg , c, ck) and sk as the output of step S2.

[0092] Step 3: Server performs online computation, which is implemented as follows.

[0093] S31. The server processes the obtained semi-plaintext to obtain Z reg ← Z reg · 2 16 .

[0094] S32. The server obtains the database encrypted information corresponding to the row with index i required for searching. Specifically, traverse 2 6 , for each j, calculate Z hint [j]← Z reg [0]·D[0][j], for this Z hint [j], traverse 2 9 , for each i, calculate Z hint [j]← Z hint [j]+Z reg [i]·D[i][j], traverse 2 9 , for the current j, execute h j =C hint [j]-[0|Z hint [j] T ] T .

[0095] S33. The server traverses 2 6 , uses the obtained h, column query ciphertext c and conversion key ck, uses Spiral's Coefficient Expansion, RegevToGSW, Folding and ModulusSwitch algorithms to obtain an online response.

[0096] S34. The Coefficient Expansion algorithm is used to obtain the column information ciphertext of the query, input a polynomial Output the expanded coefficients After the server receives the query information qu, for the ciphertext c, call the Coefficient Expansion algorithm for ceil(log 54) iteration steps to obtain a series of ciphertexts

[0097] S35. For the ciphertext , perform j∈[6] iterations to calculate The RegevToGSW algorithm inputs the conversion key ck and a series of Regev ciphertexts Calculate C i ← ScalToMat(W, c i ) for i∈[9]. Then, output the GSW ciphertext

[0098] S36. Now execute the Folding algorithm, for r∈[6] and for j∈[0,2 6-r -1], compute The resulting ciphertext is saved in where Add is ciphertext addition, Multiply is ciphertext multiplication, and the Complement function inverts a GSW ciphertext with plaintext 0 or 1.

[0099] S37. Get the online response The ModulusSwitch algorithm inputs ciphertext where Let The output is r←(c′1, C′2), where q1=1024, q2=786433.

[0100] Step 4: After the client receives the response, the following steps are executed:

[0101] Calculate through the decryption algorithm of the homomorphic encryption scheme and the saved private key, and then extract the required lookup entry.

[0102] Embodiment Three

[0103] The embodiment provides a device, including a memory, a processor and a computer program stored on the memory and executable on the processor, and the processor executes the computer program to implement the high-throughput private information retrieval method for dynamic databases in the embodiment one.

[0104] In the specific content of the above specific embodiments, each technical feature can be combined in any manner without contradiction, and to make the description concise, all possible combinations of the above technical features are not described, however, as long as the combination of the technical features does not exist contradiction, it should be considered as the scope of the present application.

[0105] Obviously, the above embodiments of the present application are only examples for clearly illustrating the present application, and are not intended to limit the implementation manners of the present application. Based on the above description, other different forms of changes or modifications can be made by those skilled in the art. Here, all the implementation manners do not need to be exhausted. Any modification, equivalent replacement and improvement within the spirit and principle of the present application should be included in the protection scope of the claims of the present application.

Claims

1. A high-throughput privacy information retrieval method for dynamic databases, characterized in that, The method comprises the following steps: S1. Server preprocessing: input includes security parameters, public seed and database, output includes offline prompts containing the first dimension of the database; S2. Client generates query information: input includes security parameters, public seed and index (i, j) to be queried, output includes query information qu and private key sk; Step S2 includes: S21. The client passes An algorithm randomly generates a secret key S = sk; S22. The client generates 2 v1 simulated matrices Regev ciphertexts from the public seed and semi-plaintext ; iterate 2 v1 for each i, compute and ; S23. The client encodes the index i of the query into the semi-plaintext ; compute where floor is the floor function, p is the plaintext modulus, q is the ciphertext modulus, , is an adjustable integer parameter; S24. The client will query the subscript The query key s = qk is encrypted into a constant Regev ciphertext c, which contains the information of the column query. S25. The client generates a conversion key ck for converting constant Regev ciphertexts with key s to GSW ciphertexts with key S using the RegevToGSWSetup algorithm; the RegevToGSWSetup algorithm inputs the keys s and S and a decomposition basis for GSW ciphertexts and a decomposition basis for the conversion and outputs the conversion key ck; including a structure for giving a conversion key ck, an input source key and a target key and a decomposition base and v, resulting in: permutation matrix , satisfying: wherein wherein is a Kronecker product, n is the matrix dimension, is a decomposition basis corresponds to the length of the decomposition string, , , ; S26. The client assembles the query information and sk as output of step S2. S3. Server online response to query: input includes database, query information qu and offline prompt, output includes response information; S4. Client decrypts response information: input includes private key sk and response information, output includes retrieved data items.

2. The high throughput privacy information retrieval method for dynamic databases of claim 1, wherein, The step S1 includes: S11. Assume that database D is organized as 2 v1 rows and 2 v2 columns, and each entry of the database is an n x n matrix, where each element of the matrix is a polynomial ring with the index starting from 0 and the range of x is [0, x). S12. The server generates 2 v1 simulated matrices Regev ciphertexts of dimension (n + 1) x n; in particular, for each i, compute v1 ;​ S13. The resulting simulated matrix Regev ciphertext is multiplied with each row of the database, and the resulting 2 v2 new computations are accumulated column-wise. S14. Finally, the accumulated 2 v2 computation results are obtained, which are denoted as offline hints .

3. The high throughput privacy information retrieval method for dynamic databases of claim 2, wherein, In step S12, the first simulation matrix Regev ciphertext is multiplied by all elements of the first row of the database to obtain 2. v2 Based on the first calculation result, perform calculations on each subsequent row; then, for the newly obtained 2... v2 The calculation results are accumulated column by column; specifically, traversing 2 v2 For each j, calculate Regarding this Iterate through 2 starting from 1 v1 For each i, calculate .

4. The high throughput privacy information retrieval method for dynamic databases of claim 1, wherein, The step S3 includes: S31. The server processes the obtained semi-plaintext to obtain , is an adjustable integer parameter; S32. The server acquires the database encryption information corresponding to the required search index i; S33. The server traverses 2 v2 , using the obtained , column query ciphertext c and conversion key ck, using Spiral's Coefficient Expansion, RegevToGSW, Folding and ModulusSwitch algorithms, obtaining an online response.

5. The high throughput privacy information retrieval method for dynamic databases of claim 4, wherein, The step S32, traversing 2 v2 For each j, compute For Traverse 2 starting at 1 v1 For each i, compute Traverse 2 complete v1 For the current traversal j, perform .

6. The high throughput privacy information retrieval method for dynamic databases of claim 4, wherein, The step S33 includes: S331. After the server receives the query information qu, for the ciphertext c, the Coefficient Expansion algorithm is called to obtain one Regev ciphertext where is the decomposition base is the length of the corresponding decomposition string, and ceil is the ceiling function; S332. For ciphertext , perform iterations of computation ; RegevToGSW algorithm input conversion key ck and a series of Regev ciphertexts , compute , where , then output GSW ciphertext ; S333. Perform the Folding algorithm on and compute Save the result ciphertext in where Add is ciphertext addition, Multiply is ciphertext multiplication, and the Complement function negates a GSW ciphertext with plaintext 0 or 1.​ S334. Obtaining an online response ; Algorithm input ciphertext wherein let output ( , ), wherein func is a rounding function.

7. The high-throughput privacy information retrieval method for dynamic databases according to any of claims 1 to 6, characterized in that, The step S4 includes: after receiving the response information, the client calculates through the decryption algorithm of the homomorphic encryption scheme and the saved private key, and then extracts the required search items.

Images