Encryption and decryption method and system based on careless transmission extension and electronic equipment

Abstract

The invention discloses an encryption and decryption method and system based on casual transmission extension and electronic equipment. The method comprises the following steps: step 1, a sender and a receiver carry out casual transmission; step 2, the receiver sends the casual selection bit mask to the sender; 3, the sender encrypts the original data and sends the original data to the receiver; and step 4, the receiver decrypts the ciphertext sent by the sender. According to the invention, the efficiency of the protocol is improved, the application scene of casual transmission is expanded, and greater flexibility and operability are provided for the deployment of an actual system.

Description

Technical Field

[0001] The present invention belongs to the technical field of cryptography, and in particular relates to an encryption and decryption method, system and electronic device based on oblivious transmission extension. Background Art

[0002] Oblivious transfer is an important primitive in cryptography, which can protect the privacy of interactive data between the receiver and the sender. Specifically, the sender is allowed to pass one of multiple messages to the receiver. While the receiver obtains the information, it has no idea of ​​the status of which message it has received, and the sender can only understand the requested information and cannot obtain other information. Therefore, the oblivious transfer method has the characteristics of protecting the privacy of both parties in communication, plays a vital role in the process of data transmission and sharing, and provides a solid theoretical basis for building various cryptographic protocols.

[0003] (1) Oblivious Transfer Protocol In 1981, the prior art proposed a probabilistic oblivious transfer algorithm based on RSA public key encryption, that is, when the sender and the receiver communicate, the probability of the receiver obtaining the information is 1 / 2, and the sender cannot know whether the receiver has received the information, which laid a theoretical foundation for the development of oblivious transfer. Subsequently, the concept of oblivious transfer continued to evolve, and the classic 2-choice 1 oblivious transfer protocol (1-out-of-2 Oblivious Transfers, abbreviated as 1-out-of-2) was first proposed in the prior art. ), the protocol consists of two parties, and its ideal function is as follows Figure 1 shown. The protocol requires the sender (Sender, referred to as ) provides a pair of strings, the receiver (Receiver, referred to as ) can only select one of them, and can only obtain the string, but cannot learn anything about the other string; and Can't be sure Which option is selected.

[0004] Later, the prior art further pointed out that the classic 2-choose-1 oblivious transfer protocol and the probabilistic oblivious transfer protocol are equivalent. Based on the protocol, some researchers constructed Select 1. The general construction framework of the oblivious transfer protocol proposes a multi-branch encryption system, that is, only one mode can correctly decrypt the data. Later, a new type of general composable Select 1 oblivious transfer protocol, the protocol overhead is reduced to a linear level. However, if the existing oblivious transfer protocol based on public key cryptography is directly deployed in the cloud distributed architecture, the computing and communication overhead of the distributed sharing solution will increase exponentially with the increase in the number of servers, making it impossible to instantiate it in the application scenario.

[0005] (2) Oblivious Transfer Extension Protocol Research on oblivious transfer mainly focuses on reducing the number of OT protocol executions and computational overhead. Currently, two main methods have been proposed: pre-computed OT (Random Oblivious Transfer, ROT) technology and oblivious transfer extension (OTE) technology. On the one hand, some researchers have used ideas similar to Beaver triples to propose a pre-computed OT protocol with theoretical significance, and designed a standard 2-choice-1 oblivious transfer protocol for the first time, migrating a large amount of calculations to offline pre-computation, while only a small number of operations need to be performed during the online execution of the protocol. Although the Beaver pre-computation idea does not reduce the amount of calculation, it improves the efficiency of online calculations. Both parties only need symmetrical operations and an additional interaction online.

[0006] In addition, the oblivious transfer extension technology uses symmetric encryption instead of public key encryption to significantly reduce the algorithm overhead. Some researchers have also used the "row to column" idea to propose a classic OTE protocol, called the IKNP03 protocol. Specifically, assuming that the size of the matrix to be transmitted is ( ), traditional OT protocols need to be implemented Second-rate Agreement, that is However, IKNP03 performs The next row OT is replaced In The next line is transmitted, represents the number of columns. Their protocol successfully reduces the number of base OT runs from Reduce to , which greatly improves the efficiency of the protocol operation and provides security for semi-honest receivers. The IKNP protocol mainly consists of three phases: base OT phase, OTE phase and output phase.

[0007] In the base-OT phase, the sender and receiver exchange identities, and the receiver ( ) as the sender input For length A string of bits, forming a matrix and , the sender ( ) as the receiver inputs a length Column vector of , where the column vector With the matrix , The relationship is as Figure 2 shown.

[0008] Randomly select a row vector , Own Matrix , , both execute Subbase OT protocol. According to Bit value selection matrix , One of the columns will receive Group string composition matrix The interaction process is as follows Figure 3 shown.

[0009] In the OTE stage, when hour, Using the Matrix ,calculate ;when hour, .at this time, Have a set of messages , Possess and The corresponding matrix Row vector ,like Figure 4 As shown. It can be found that Available Matrix For each row of the data, hash and XOR operations are performed on the data to achieve symmetric encryption of the data.

[0010] In the output stage, Use the matrix to decrypt the data, and only the selected data can be obtained, and no information about other data can be obtained. The decryption idea is as follows Figure 5 shown.

[0011] Then, some researchers found that IKNP03 consumed 42% of the computational overhead in matrix transposition and was unable to resist attacks from malicious recipients. They constructed a strong security OTE protocol based on pseudorandom function (PRF) under the standard model, called ALSZ13 protocol. The computational complexity of matrix transposition is Reduce to ,in is the CPU register size. At the same time, they added a consistency phase to resist malicious receivers and ensure that they can resist malicious models. Some researchers have used a small amount of , commitment technology, and pseudorandom generator (PRG) technology to resist malicious receivers. Some researchers have found that IKNP03 uses repeated encoding technology to generate selected strings. , limiting the sender to only one implementation per OTE instance .

[0012] To address this limitation, researchers introduced error-correcting codes (ECC) to replace repeated codes and generate strings. Based on this, they designed Protocol, that is, an OTE instance from Extensions In order to further optimize and apply OTE, some researchers used pseudorandom functions (PRF) instead of error correction codes and designed protocol, that is, only one The instance implements a string equality check. However, The algorithm cannot achieve the defined Hamming correlation robustness. In order to efficiently construct the OTE protocol in the random oracle, some researchers have constructed a secure oblivious transfer protocol based on DDH, instantiating OTE through the Crystals.Kyber key protocol, and completing the interaction with only one round of communication. Some researchers have made improvements based on the literature in terms of communication load, abandoning the time-consuming matrix transmission and using OTE is realized by polynomial transmission, which reduces the communication complexity from Down to Some researchers have optimized the literature from the perspective of communication load and operation efficiency balance, and by transforming the output of the error correction code from a string to a matrix, the communication complexity has been reduced from Down to . Some researchers pointed out that simply reusing the protocol to achieve batch processing of OTE is an unsafe method. They used the region separation technology between OTE instances to achieve secure batch processing of OTE. Some researchers first proposed to instantiate the OTE protocol as a whole , which reduces the communication overhead by half compared to the traditional OTE protocol. Some researchers pointed out that the security parameters of the OT instance in IKNP03 are , the cost of generating OTE is still very high. They optimized the communication cost of IKNP03 in the Minicrypt model and proposed the SoftSpoken OT protocol, which reduced the size of the security parameter to . Some researchers have constructed the OTE protocol in the reverse firewall. Some researchers have designed a multi-party matrix calculation scheme based on OTE, which effectively reduces the number of communication rounds. However, the existing oblivious transfer extension protocol cannot be applied to distributed scenarios, and does not consider the problems of easy leakage of access mode and single transmission mode of shared data during transmission.

[0013] In summary, domestic and foreign researchers have conducted extensive research on the security, performance optimization, and application expansion of data oblivious transmission. However, most existing oblivious transmission protocols and oblivious transmission extension protocols based on public key cryptography only consider one-to-one application scenarios, which are suitable for two-party application scenarios, but not for protocols of cloud distributed storage architecture. At the same time, the current distributed oblivious transmission protocols mainly use secret sharing technology to achieve data interaction, which is difficult to adapt to distributed scenarios. In addition, the oblivious transmission protocol only protects the privacy information of the two communicating parties, and there are risks such as leaking access modes and transmission traces when multiple parties interact. Therefore, the oblivious transmission protocol of data needs further research in terms of security, performance optimization, and scenario adaptation.

[0014] In recent years, protocols such as IKNP03, ALSZ13, and ALSZ15 have adopted a 2-choose-1 oblivious transmission algorithm in the oblivious transmission expansion phase. The above protocols require that the sender can only send 2 messages to the receiver at a time, and the receiver can only select one of the 2 messages during each interaction. In other words, during the interaction, the receiver cannot request 2 or more messages from the sender at the same time, which severely limits the flexibility of retrieving information during the interaction. In addition, some researchers introduced error-correcting codes (ECC) to replace repeated codes and generate strings. Based on this, they designed Protocol, that is, an OTE instance from Extensions In order to further optimize and apply OTE, some researchers used pseudorandom functions (PRF) instead of error correction codes and designed protocol, that is, only one The instance implements a string equality test.

[0015] although The oblivious transfer protocol of option 1 is effective in theory, but it faces great limitations in practical applications. Especially when the receiver wants to obtain Messages must be repeated Second-rate Choose 1: Oblivious Transfer Protocol. Each execution of the existing protocol involves complex cryptographic operations such as key generation, encryption, transmission, and decryption. Therefore, repeated execution will lead to a linear increase in computing and communication costs. This feature makes the traditional Option 1: Oblivious transfer protocols are inefficient in actual scenarios that require large-scale data interaction. For example, in distributed database queries, private information retrieval, or secure computing of machine learning models, the receiver often needs to obtain a large amount of data. If a whole set of oblivious transfer protocols needs to be re-executed for each query, the overall overhead of the system will expand rapidly as the number of queries increases. This approach is difficult to meet the actual needs of high efficiency and low latency. In addition, existing technical solutions also face the problem of insufficient data flexibility. In the setting of option 1, each protocol can only obtain one specific piece of information, and cannot flexibly obtain multiple pieces of data at the same time. This constraint is particularly inconvenient in some application scenarios. For example, the receiver needs to obtain multiple related information from a large data set at one time. The existing method requires transmission one by one, which is difficult to meet the efficient interaction in actual needs.

[0016] In summary, although Option 1: Oblivious transmission is designed to meet the requirements of privacy protection, but its limitations in efficiency and flexibility make it difficult to adapt to modern practical application scenarios that require large-scale data interaction. Summary of the invention

[0017] A key technical bottleneck in the current oblivious transmission scheme is that it is impossible to efficiently obtain multiple messages in one communication interaction between two parties. This problem seriously limits the flexibility and scalability of the protocol. The traditional oblivious transmission protocol only supports the ability to obtain one message in a single transmission. If the receiver wants to obtain a message, it must repeat the oblivious transmission protocol. Although this method is feasible in theory, its communication and computing overhead will increase linearly with the increase of, resulting in a significant decrease in efficiency in practical applications, especially in scenarios requiring large-scale data interaction. In order to solve this problem, the present invention proposes an encryption and decryption method and system based on the selected oblivious transmission extension, which can achieve the goal of the receiver obtaining multiple messages in one oblivious transmission. Compared with the prior art, the present invention significantly reduces the communication cost and computing overhead by optimizing the transmission process and reducing the number of interaction rounds, so that the protocol has a great improvement in efficiency. In the present invention, the receiver can flexibly select a message of interest through a protocol interaction, while ensuring that the sender remains completely unaware of the receiver's choice. The present invention not only improves the efficiency of the protocol, but also expands the application scenarios of oblivious transmission, providing greater flexibility and operability for the deployment of actual systems.

[0018] The present invention adopts the following technical scheme: The encryption and decryption method based on oblivious transmission extension includes the following steps: Step 1: The sender and receiver perform an oblivious transfer; Step 2: The receiver sends the inadvertent transmission selection bit mask to the sender; Step 3: The sender encrypts the original data and then sends it to the receiver; Step 4: The receiver decrypts the ciphertext sent by the sender.

[0019] Preferably, in step 1, the sender randomly selects a string , composed of 0 and 1, with a length of ; Represents a string No. bits; this string It means that in the basic oblivious transfer, the sender acts as the receiver, and The string is the selection bit that is transmitted inadvertently each time 2 chooses 1, indicating the subscript of the message it wants to select; the receiver's input has two parts: the first part is Select a number ,in, The range is ; Indicated in The receiver's selection bit in the first oblivious transmission indicates which data he wants to select; the second part is a collision-resistant homomorphic encryption algorithm , and has the encryption public key and the decryption private key ; The common input is a decimal-to-binary function F, where Represents a decimal number The binary form of bits; finally, a collision-resistant hash function is required .

[0020] Preferably, in step 1, the receiver generates two Matrix of size , : Randomly generated And by calculating To determine The value of ; where , Respectively , No. In basic oblivious transfer, the receiver acts as the sender and what needs to be sent is and After sending these two messages, the sender generates the string according to step 1. , select a message to receive, thus realizing the basic function of 2-choose-1 oblivious transmission; the detailed process is as follows: The sender and receiver follow the steps below The second 2-choose-1 oblivious transfer It represents the matrix , Number of columns: Step 1.1: The receiver sends two messages , ,in, , Respectively represent matrices , No. List; Step 1.2: The sender selects to select one of them to receive; if , then it receives ;if , then it receives ; After completing the above steps, the sender will get string, this By merging the strings by column, we can get a matrix ;make represents the first OK, it satisfies .

[0021] Preferably, step 2 is as follows: After step 1 is completed, the first part: basic oblivious transmission has been completed. After the information exchange in the previous steps, it can be obtained that the receiver has a matrix , the sender has the matrix ,matrix and matrix The relationship is ; Then, for , where m represents the matrix The receiving party performs the following operations: , then the receiver calculates and send it to the sender; if , the receiver generates a random string and uses it as and sends it to the sender; A bit mask indicating the selection of oblivious transfer receivers.

[0022] Preferably, step three is as follows: After step two is completed, the preliminary preparations are all completed, and the sender only needs to encrypt the original data and then send it to the receiver for decryption. , where m represents the matrix The sender's input is a set of information , where each message The length is Bit, Representative The first The sender encrypts the data according to the following formula Data and send to the receiver: ; Preferably, step 4 is as follows: for the ciphertext sent by the sender, some of the messages can be directly decrypted by the receiver, because the receiver has the key required for the decryption operation; while for the other part of the messages, they are no different from random numbers to the receiver, so it cannot be decrypted to obtain the original data; and which messages can be decrypted and which messages cannot be decrypted are determined by the receiver's input. It has been shown in the previous section that the receiver first constructs a binary string, where 0 represents information that does not need to be obtained and 1 represents information that needs to be obtained, and converts this string into a decimal number and assigns this number to In the specific agreement, The receiver uses the following formula from Decrypt what you want from the ciphertext Messages: .

[0023] The process of the present invention is now complete. Next, its effectiveness is demonstrated, that is, the receiver can finally decrypt the data he wants, as shown by the following formula: ; From the above formula, we can see that the receiver can finally use As the key, decrypt A ciphertext, and this The positions of the ciphertexts are all in Winning bid.

[0024] The present invention also discloses an encryption and decryption system based on oblivious transmission extension, which is used to execute the above method, and includes the following modules: Oblivious transfer module: used to perform oblivious transfer between sender and receiver; Selection bit mask sending module: used to execute the receiver to send the inadvertent transmission selection bit mask to the sender; Encryption module: used for the sender to encrypt the original data and then send it to the receiver; Decryption module: used to execute the receiver to decrypt the ciphertext sent by the sender.

[0025] The present invention also discloses an electronic device, comprising: processor; The memory is used to store a program. When the program is called and executed by the processor, the processor executes the above method or system.

[0026] The technical solution submitted by the present invention significantly improves the efficiency of oblivious transmission and breaks through the limitation of single transmission capacity of traditional protocols. By reducing the number of interaction rounds and optimizing the communication process, the present invention realizes efficient multi-message transmission capability and has broad application prospects, especially in the fields of recommendation systems and privacy computing.

[0027] The present invention optimizes the traditional oblivious transfer protocol and proposes a solution that can efficiently transmit multiple messages in one protocol interaction, fundamentally solving the limitations of the existing technical solutions in terms of efficiency and flexibility. Traditional oblivious transfer protocols usually only allow the recipient to select and obtain one message in one interaction. If the recipient needs to obtain k messages, the protocol must be repeated k times. Although this method is theoretically feasible, its communication and computing overhead will increase linearly with the increase of k, especially in practical applications that require large-scale data interaction, which can easily lead to problems such as inefficiency, response delays, and waste of system resources. This limitation makes it difficult for traditional oblivious transfer to adapt to modern and efficient privacy protection scenarios.

[0028] In order to solve this problem, the present invention introduces a new mechanism by optimizing the protocol design and transmission process, which enables the receiver to flexibly select and obtain multiple messages of interest in a single protocol interaction, while the sender remains completely unaware of the receiver's specific selection during this process, and the receiver cannot obtain unselected messages. This improvement significantly reduces the number of interaction rounds and communication costs, greatly improving the overall efficiency of the protocol. Compared with traditional solutions, the present invention not only achieves the goal of obtaining multiple messages in a single protocol, but also expands the application scenarios of inadvertent transmission, making it more practical in actual applications with high privacy protection requirements and large amounts of interactive data.

[0029] The present invention has shown great value in the recommendation system. The recommendation system usually needs to push multiple pieces of content that may be of interest to the user, and the user selects several items of interest from them. However, the traditional solution requires multiple separate executions of the protocol for each user selection, which is not only inefficient but also increases the communication burden of the platform. The present invention allows the user to select multiple pieces of content of interest from the recommendation list in one interaction, and the platform cannot know which items the user has selected during this process. This mechanism not only protects the user's privacy, but also greatly reduces the communication and computing resources required for protocol execution.

[0030] In addition, the present invention can also be widely used in multiple fields such as distributed database query, private information retrieval, and privacy-preserving machine learning. In a distributed database, users can efficiently query multiple data items of interest from the database at one time, and the database itself cannot know the specific query content of the user. In privacy-preserving machine learning, users can obtain multiple prediction results or parameters from the model at one time without multiple interactions. This capability not only improves the performance of the protocol, but also meets the urgent need for efficient privacy interaction in data-intensive scenarios.

[0031] In summary, this invention significantly improves the efficiency and flexibility of oblivious transmission, breaks through the limitations of traditional protocols, and provides an efficient, secure, and practical solution for privacy protection and large-scale data interaction scenarios. This innovation has shown broad application potential in fields such as recommendation systems, distributed databases, and privacy computing, laying a solid foundation for the future development of privacy protection technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 Is to select the oblivious transfer protocol interaction flow chart; Figure 2 It is a column vector and matrix,relationship graph; Figure 3 It is a diagram of the basic OT protocol interaction process; Figure 4 It is the interactive process diagram of the OTE stage; Figure 5 It is the interactive process diagram of the output stage; Figure 6 It is a block diagram of an encryption and decryption system based on oblivious transfer extension according to a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0033] The preferred embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0034] like Figure 1 As shown, the encryption and decryption method based on oblivious transfer extension in this embodiment involves two participants: a sender of data and a receiver of data.

[0035] The overall solution of this embodiment can be divided into two stages: the first stage is basic oblivious transfer (base-OT), in which the sender and the receiver will exchange identities, the receiver sends data, the sender receives data, and several 2-choose-1 oblivious transfers are performed. The second stage is the oblivious transfer extension part, in which the sender sends the data it has prepared, and the receiver selects a part of the data to receive according to its own selection bits. The amount of received data can be flexibly adjusted, and the receiver does not know the data it has not received, and the sender does not know the situation of the receiver receiving data. The specific steps of this embodiment are described in detail below: Step 1 is as follows: The sender randomly selects a string , composed of 0 and 1, with a length of . Represents a string No. bits, string In the basic oblivious transfer, the sender acts as the receiver, and (The string is the selection bit that is transmitted inadvertently each time 2 chooses 1, indicating the subscript of the message it wants to select.

[0036] The receiver's input has two parts. The first part is Select a number ,in The range is (The value of n is the same as the value of n in OTn select k, indicating that in each OT instance, the sender transmits n messages to the receiver). Indicated in The receiver's selection bit in the first oblivious transmission indicates which data he wants to select; the second part is a collision-resistant homomorphic encryption algorithm , and has the encryption public key and the decryption private key .

[0037] The public input includes a decimal-to-binary function F and a collision-resistant hash function ,in, Represents a decimal number The binary form of Bit.

[0038] The receiver generates two Matrix of size , : Randomly generated And by calculating To determine The value of . The meaning is the value of the jth bit of the string r. The F function is to convert The value is converted from decimal to binary. , Respectively , No. In basic oblivious transfer, the receiver acts as the sender and what needs to be sent is and After sending these two messages, the sender generates the string according to step 1. , select a message to receive, thus realizing the basic function of 2-choose-1 oblivious transmission. The following describes the process in detail: The sender and receiver follow the steps below The second 2-choose-1 oblivious transfer, where Representation Matrix , Number of columns: Step 1.1: The receiver sends two messages , ,in, , Respectively represent matrices , No. List; Step 1.2: The sender selects to select one to receive. , then it receives ;if , then it receives .

[0039] After completing the above steps, the sender will get string, this By merging the strings by column, we can get a matrix .make The Q matrix is If it is satisfied .

[0040] Step 2 is as follows: After step 1 is completed, the first stage, i.e., basic oblivious transmission, is completed. After the information exchange in the previous steps, it can be obtained that the receiver has a matrix , the sender has the matrix ,matrix and matrix The relationship is . Then, for , where m represents the matrix The receiving party performs the following operations: ( The meaning is the value of the jth bit of the string r. The F function is to convert The value is converted from decimal to binary, and the subscript k refers to the kth bit of the binary string), then the receiver uses the encryption key calculate and send it to the sender; if , the receiver generates a random string and uses it as and sends it to the sender. A bit mask indicating the selection of oblivious transfer receivers.

[0041] Step 3 is as follows: After step 2 is completed, the preliminary preparations are complete. The next step is for the sender to encrypt the original data and then send it to the receiver for decryption. , where m represents the matrix The sender's input is a set of information , where each message The length is Bit, Representative The first The sender encrypts the data according to the following formula Data and send to the receiver: ; in, It represents the plaintext message transmitted by the sender in each OT instance (oblivious transfer instance), j represents the jth OT instance, and k represents the kth message transmitted in this OT instance. Indicates the ciphertext received by the receiver. j and k have the same meaning as above.

[0042] Step 4 is as follows: For the ciphertext sent by the sender, some messages can be directly decrypted by the receiver because the receiver has the key required for the decryption operation; while for the other messages, they are no different from random numbers to the receiver, so it is impossible to decrypt and get the original data. Which messages can be decrypted and which messages cannot be decrypted is determined by the receiver's input. It has been shown in the previous section that the receiver first constructs a binary string, where 0 represents information that does not need to be obtained and 1 represents information that needs to be obtained, and converts this string into a decimal number and assigns this number to In the specific implementation, for The receiver uses the following formula from Decrypt the ciphertext to get what you want Messages: ; in, Meaning, Indicates that the receiver receives the ciphertext After that, it is decrypted to obtain the decrypted message, in which j and k have the same meanings as above.

[0043] After all the above steps are completed, the effectiveness of the present invention is demonstrated, that is, the receiver can finally decrypt the data he wants, as proved by the following formula: ; in, appears in step 1.2 and is a matrix generated previously.

[0044] From the above formula, we can see that the receiver can finally use As the key, decrypt A ciphertext, and this The positions of the ciphertexts are all in Winning bid.

[0045] It can be seen from the above that the present invention select Oblivious transfer extension method, which only needs to be executed once to implement existing protocol execution The effect of times.

[0046] like Figure 6 As shown, this embodiment discloses an encryption and decryption system based on oblivious transmission extension, which is used to execute the above method, and includes the following modules: Oblivious transfer module: used to perform oblivious transfer between sender and receiver; Selection bit mask sending module: used to execute the receiver to send the inadvertent transmission selection bit mask to the sender; Encryption module: used for the sender to encrypt the original data and then send it to the receiver; Decryption module: used to execute the receiver to decrypt the ciphertext sent by the sender.

[0047] For other contents of this embodiment, please refer to the above method embodiment.

[0048] The present invention also discloses an electronic device, comprising: processor; The memory is used to store a program. When the program is called and executed by the processor, the processor executes the above method or system.

[0049] The potential application scenarios of the present invention in recommendation systems are particularly significant. For example, if an institution wants to investigate the relationship between a certain lung disease and a patient's lung disease history, the institution needs to interact with the hospital to obtain a data set of the patient's disease history. However, in order to protect user privacy, the hospital only wants to provide medical history related to lung disease, and does not want to expose other medical history data of the patient. Applied to this protocol, the hospital acts as the sender and the institution acts as the receiver, and the above functions and requirements can be completed.

[0050] In step one, the hospital prepares the data set to be transmitted and classifies it by disease type; the institution searches for the number of the lung-related medical history based on the classification and sets the selection bit. (The same patient may have multiple lung disease histories, that is, there are multiple numbers to be selected. The patient's medical history is arranged in order of number, with the history of lung-related diseases set to 1 and the history of non-lung-related diseases set to 0. This will get a string of binary numbers, and then compress the binary numbers to get a decimal selection bit.) Then the hospital and the institution carry out the rest of step one and step two. The purpose of these two steps is to negotiate the encryption and decryption keys. In step three, the hospital uses the negotiated key to encrypt all the patient's medical histories and sends the ciphertext to the agency; in step four, the agency decrypts the ciphertext with the negotiated key, but it can only decrypt the medical history related to lung disease, and cannot decrypt the medical history of other diseases (the reason is that when the selection bit was set earlier, only the number of the lung-related disease history was specified, and the encryption and decryption key is related to the selection bit, so only the lung disease history can be decrypted here, and no other information is known). At the same time, the hospital is not clear about what data the agency has obtained (because the hospital only classified and numbered the medical history, and did not know what data the other party wanted).

[0051] The following is a real machine test of the protocol proposed in the present invention, and a performance comparison with the previous protocol. The performance evaluation standard is set to the number of messages obtained by the receiver per millisecond. In the oblivious transmission extension protocol, the receiver is a more important party, and the speed at which it obtains data is also very important. In the KK protocol proposed in the prior art, the time required for the receiver to obtain 800,000 data is 363.5 milliseconds, which is approximately 2,200 messages per millisecond; in the KKRT protocol proposed in the prior art, the time required for the receiver to obtain 800,000 data is 404.5 milliseconds, which is approximately 1,978 messages per millisecond; and in the protocol of the present invention, the time required for the receiver to obtain 800,000 data is 89.3 milliseconds, which is approximately 8,958 messages per millisecond. It can be seen that the protocol of the present invention has a 4-5 times performance improvement compared to the previous protocol, and can be better applied in actual life production.

[0052] In addition, the present invention can also be extended to other large-scale data interaction scenarios that require privacy protection. For example, in a distributed database query, a user can select multiple data items of interest from the database at one time, and the database itself cannot know the user's specific selection. In machine learning based on privacy protection, users can efficiently obtain multiple model parameters or prediction results, and the model provider cannot track the user's query preferences. This efficient multi-message transmission capability enables the present invention to not only meet current privacy computing needs, but also provide new ideas for inadvertent transmission technology in future complex application scenarios.

[0053] The preferred embodiments and principles of the present invention are described in detail above. For those skilled in the art, according to the ideas provided by the present invention, there may be changes in the specific implementation methods, and these changes should also be regarded as the protection scope of the present invention.

Claims

1. The encryption and decryption method based on oblivious transfer extension is characterized by: The steps include: Step 1: The sender and receiver perform an oblivious transfer; Step 2: The receiver sends the inadvertent transmission selection bit mask to the sender; Step 3: The sender encrypts the original data and then sends it to the receiver; Step 4: The receiver decrypts the ciphertext sent by the sender.

2. The encryption and decryption method based on oblivious transfer extension as claimed in claim 1, characterized in that: In step 1, the sender randomly selects a string , composed of 0 and 1, with a length of ; Represents a string No. bits; The receiver's input includes: the first part is Select a number ,in, ; Indicated in The receiver's selection bit in the oblivious transmission, n means that in each OT instance, the sender transmits n messages to the receiver; the second part is a collision-resistant homomorphic encryption algorithm , and has the encryption public key and the decryption private key ; The public input is a decimal-to-binary function F and a collision-resistant hash function. ;in, Represents a decimal number The binary form of Bit.

3. The encryption and decryption method based on oblivious transfer extension as claimed in claim 2, characterized in that: In step 1, the receiver generates Size Matrix and : Random Generation And by calculating To determine The value of ; where , Respectively , No. row value; Represents the value of the jth bit of string r; the F function is to convert The value of is converted from decimal to binary; The receiver acts as the sender and sends and Two messages, after sending the message, the sender generates the string according to step 1 , select a message to receive to achieve 2-choice-1 oblivious transmission.

4. The encryption and decryption method based on oblivious transfer extension as claimed in claim 3, characterized in that: In step 1, the sender and receiver follow the steps below The second 2-choose-1 oblivious transfer, where It represents the matrix , Number of columns: Step 1.1: The receiver sends two messages , ,in, , Respectively represent matrices , No. List; Step 1.2: The sender selects To select one of the messages in step 1.1 to receive, if , then receive ;if , then receive ; After completing the above steps, the sender gets string, this Merge the strings by column to get a matrix ;make The Q matrix is If OK, then it satisfies .

5. The encryption and decryption method based on oblivious transfer extension as claimed in claim 4, characterized in that: Step 2 is as follows: , where m represents the matrix The receiving party performs the following operations: like , the receiver uses the encryption key calculate and will Sent to the sender; if , the receiver generates a random string as The value is sent to the sender; Indicates the optional bit mask of the oblivious transmission recipient for subsequent encryption ; It means that the F function will Convert the value from decimal to binary.

6. The encryption and decryption method based on oblivious transfer extension as claimed in claim 5, characterized in that: Step 3 is as follows: for , the sender's input is a set of information , where each message The length is Bit, Representative The first individual data; The sender encrypts according to the following formula Data and send to the receiver: ； in, Indicates the plaintext message transmitted by the sender in each OT instance, j indicates the jth OT instance, and k indicates the kth message transmitted in this OT instance; Indicates the ciphertext received by the receiver.

7. The encryption and decryption method based on oblivious transfer extension as claimed in claim 6, characterized in that: Step 4 is as follows: For the ciphertext sent by the sender, the receiver decrypts part of the message using the key; for the other part of the message: the receiver first constructs a binary string, where 0 represents information that does not need to be obtained and 1 represents information that needs to be obtained, and converts the binary string into a decimal number, and assigns the number to ;for , the receiver uses the following formula from Decrypt the desired Messages: ； Indicates that the receiver receives the ciphertext After that, decryption is performed to obtain the decrypted message.

8. An encryption and decryption system based on oblivious transfer extension, used to execute the method according to any one of claims 1 to 7, characterized in that: Includes the following modules: Oblivious transfer module: used to perform oblivious transfer between sender and receiver; Selection bit mask sending module: used to execute the receiver to send the inadvertent transmission selection bit mask to the sender; Encryption module: used for the sender to encrypt the original data and then send it to the receiver; Decryption module: used to execute the receiver to decrypt the ciphertext sent by the sender.

9. An electronic device, characterized in that: include: processor; A memory for storing a program, wherein when the program is called and executed by a processor, the processor executes the method according to any one of claims 1 to 7 or the system according to claim 8.

Images