Multi-data hidden query method and system

Abstract

The invention discloses a multi-data hidden query method and system. The method comprises the following steps: constructing a correlation matrix and a difference matrix; the query party generates a blind confusion index vector based on the query index set and sends the blind confusion index vector to the data party, and the query party calculates a first key vector and constructs a bucket identifier set; the data party calculates a noise vector, a second key vector and a ciphertext; and the data party sends the ciphertext to the query party, and the query party retrieves the target ciphertext and decrypts the target ciphertext to obtain a query result. The method ensures that a data party cannot acquire a query index set and an attacker cannot reversely deduce sensitive information through intermediate data through relevance matrix, index confusion, blinding and dynamic bucking technologies; and by utilizing matrix operation and batch processing, the communication and calculation overhead is reduced, and efficient query under a large-scale data scene is supported.

Description

Technical Field

[0001] The present invention relates to the field of privacy computing technology, and in particular to a multi-data hidden query method and system. Background Art

[0002] With the development of big data and cloud computing technologies, data security and privacy protection have become important research areas. In sensitive fields such as finance and healthcare, it is often necessary to retrieve specific data without revealing the query intent. Existing hidden query technologies, such as homomorphic encryption and searchable encryption, while achieving a certain degree of privacy protection, suffer from high computational overhead and low query efficiency. Therefore, improving query efficiency while ensuring the privacy of query indexes has become a pressing technical challenge. Summary of the Invention

[0003] The embodiments of the present invention provide a multi-data hidden query method and system to solve the problem in the prior art of how to simultaneously ensure query index privacy and query efficiency.

[0004] To achieve the above-mentioned purpose, on the one hand, the present invention provides a multi-data hidden query method, which includes: S1, the data party constructs a first correlation matrix H and a correlation value Δ; the query party constructs a second correlation matrix H′ and a difference matrix T, satisfying H′=T·Δ+H; S2, the query party blinds and confuses the query index vector h(x) of the query index set to obtain a blinded obfuscated index vector c, and sends the blinded obfuscated index vector c to the data party; S3, the query party calculates a first key vector based on the second correlation matrix H′ and the blinded obfuscated index vector c; S4, the query party constructs a bucket identifier set based on the query index set and the secure hash function, and sends the bucket identifier set to the data party; S5, the data party The data party calculates a noise vector based on the first correlation matrix H and the blinded confusion index vector c; S6, the data party calculates a second key vector and ciphertext of all data indexes based on the noise vector, the correlation value Δ and the bucket identifier set; the data party randomly selects an index tag to perform salted hash indexing on the second key vector to obtain a second key index; the data party sends the second key index and the corresponding ciphertext, as well as the index tag, to the query party; S7, the query party performs salted hash indexing on the first key vector based on the index tag to obtain a first key index; the query party retrieves the target ciphertext corresponding to the first key index based on the first key index and the second key index; the query party decrypts the target ciphertext based on the first key vector to obtain a query result.

[0005] Optionally, the difference matrix T is obtained by the following method: the querying party randomly selects a matrix B whose diagonal elements are 1 and the remaining elements are random 0s or 1s, and splices the matrix B and the zero matrix B0 to generate a splicing matrix M, where the matrix B is a reversible matrix; the querying party randomly selects a permutation matrix π, and confuses the splicing matrix M according to the permutation matrix π to obtain the difference matrix T.

[0006] Optionally, the query party constructs the second correlation matrix H′ including: the query party and the data party collaboratively call the oblivious transfer protocol, and use the data party's first correlation matrix H and correlation value Δ, and the query party's difference matrix T as inputs of the protocol, so that the query party receives the second correlation matrix H′ output by the protocol.

[0007] Optionally, S2 includes: the query party generates a query index vector h(x) according to a secure hash function for the query index set; the query party blinds the query index vector h(x) according to the inverse matrix of matrix B to obtain a blinded index vector; the query party selects a random vector, and splices the blinded index vector and the random vector to generate a spliced ​​vector; the query party confuses the spliced ​​vector according to the permutation matrix Π to obtain a blinded confused index vector c, and sends the blinded confused index vector to the data party.

[0008] Optionally, S4 includes: the querying party takes each query index in the query index set as the current query index in turn; the querying party randomly selects a current salt value, and generates a current hash value by using a secure hash function for the current query index and the current salt value; performs a congruence mapping based on a decreasing modulus set on the current hash value to obtain a current bucket number; combines the current salt value and the current bucket number to obtain a current bucket identifier; and summarizes the current bucket identifiers corresponding to each query index to obtain a bucket identifier set.

[0009] Optionally, the data party calculates the second key vector of all data indexes according to the noise vector, the associated value Δ and the bucket identifier set, and the ciphertext includes: S61, the data party establishes two empty buckets, namely: a processed data bucket and a to-be-processed data bucket; puts all the data indexes of the data party into the to-be-processed data bucket; S62, takes each bucket identifier in the bucket identifier set as the current bucket identifier in turn; S63, traverses all the data indexes in the to-be-processed data bucket; takes the data index that meets the matching condition of the current bucket identifier from the to-be-processed data bucket and puts it into the processed data bucket, and calculates the ciphertext according to the noise vector. Calculate the elements of the second key vector and the elements of the ciphertext of the data index based on the corresponding elements and associated values; S64, repeat S63 until the data index that meets the matching conditions of all bucket identifiers is taken out from the data bucket to be processed and placed in the processed data bucket; S65, calculate the elements of the second key vector and the elements of the ciphertext of all the remaining data indexes in the data bucket to be processed according to the noise vector and the associated values; S66, obtain the second key vector by the set of elements of the second key vector of all data indexes; obtain the ciphertext by the set of elements of the ciphertext of all data indexes.

[0010] On the other hand, the present invention provides a multi-data hidden query system, which includes: a matrix construction unit, which is used by the data party to construct a first correlation matrix H and a correlation value Δ; the query party constructs a second correlation matrix H′ and a difference matrix T, satisfying H′=T·Δ+H; a blinding confusion unit, which is used by the query party to blindly confuse the query index vector h(x) of the query index set to obtain a blinded confusion index vector c, and send the blinded confusion index vector c to the data party; a first calculation unit, which is used by the query party to calculate a first key vector based on the second correlation matrix H′ and the blinded confusion index vector c; a bucket identifier construction unit, which is used by the query party to construct a bucket identifier set based on the query index set and the secure hash function, and send the bucket identifier set to the data party; A calculation unit is used for the data party to calculate a noise vector based on the first correlation matrix H and the blinded confusion index vector c; an encryption unit is used for the data party to calculate a second key vector and ciphertext of all data indexes based on the noise vector, the correlation value Δ and the bucket identifier set; the data party randomly selects an index tag to perform salted hash indexing on the second key vector to obtain a second key index; the data party sends the second key index and the corresponding ciphertext and the index tag to the query party; a decryption unit is used for the query party to perform salted hash indexing on the first key vector based on the index tag to obtain a first key index; the query party retrieves a target ciphertext corresponding to the first key index based on the first key index and the second key index; the query party decrypts the target ciphertext based on the first key vector to obtain a query result.

[0011] Optionally, the difference matrix T is obtained by the following method: the querying party randomly selects a matrix B whose diagonal elements are 1 and the remaining elements are random 0s or 1s, and splices the matrix B and the zero matrix B0 to generate a splicing matrix M, where the matrix B is a reversible matrix; the querying party randomly selects a permutation matrix π, and confuses the splicing matrix M according to the permutation matrix π to obtain the difference matrix T.

[0012] Optionally, the query party constructs the second correlation matrix H′ including: the query party and the data party collaboratively call the oblivious transfer protocol, and use the data party's first correlation matrix H and correlation value Δ, and the query party's difference matrix T as inputs of the protocol, so that the query party receives the second correlation matrix H′ output by the protocol.

[0013] Optionally, the blinded confusion unit includes: a generation subunit, used by the query party to generate a query index vector h(x) according to a secure hash function based on the query index set; a blinding subunit, used by the query party to blind the query index vector h(x) according to the inverse matrix of the matrix B to obtain a blinded index vector; a splicing subunit, used by the query party to select a random vector, and splice the blinded index vector and the random vector to generate a splicing vector; a confusion subunit, used by the query party to confuse the splicing vector according to the permutation matrix Π to obtain a blinded confusion index vector c, and send the blinded confusion index vector to the data party.

[0014] Beneficial effects of the present invention:

[0015] The present invention provides a multi-data hidden query method and system, wherein the method uses a correlation matrix, index obfuscation, blinding technology, and separates sensitive information in a query index set based on the correlation matrix to construct a blinded obfuscated index vector, thereby ensuring that the data party cannot obtain the query index set and attackers cannot infer sensitive information through intermediate data; utilizing dynamic bucketing technology, the data processed in batches has the advantages of load balancing and flexible expansion, reducing communication and computing overhead while reducing the risk of exposure of sensitive information, and supporting efficient query in large-scale data scenarios; the correlation matrix supports multi-index parallel query and is suitable for a variety of different data query scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 This is a flow chart of a multi-data hidden query method provided by an embodiment of the present invention;

[0017] Figure 2 This is a flowchart of blinding and obfuscating a query index vector provided by an embodiment of the present invention;

[0018] Figure 3 This is a structural diagram of a multi-data hidden query system provided by an embodiment of the present invention;

[0019] Figure 4 2 is a schematic diagram of the structure of a blinded confusion unit provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0020] To make the objectives, technical solutions, and advantages of the present invention more apparent, the present invention will be further described in detail below with reference to the accompanying drawings. It is apparent that the embodiments described are only some, not all, of the present invention. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present invention without creative effort are intended to fall within the scope of protection of the present invention.

[0021] Figure 1 This is a flow chart of a multi-data hidden query method provided by an embodiment of the present invention. Figure 1 As shown, the method includes:

[0022] S1. The data side constructs a first correlation matrix H and correlation value Δ; the query side constructs a second correlation matrix H′ and difference matrix T, satisfying H′=T·Δ+H;

[0023] In an optional embodiment, before S1, the steps include: initializing common parameters;

[0024] In order to ensure the encryption security and correctness verification during the hidden query process, the following public parameter set needs to be selected during the system initialization phase: pp = {q, p, vID}

[0025] ①Safe large prime number q

[0026] Definition: q is a sufficiently large prime number used to define the basic domain of encryption calculations

[0027] Domain: All element operations are in a finite field On, where:

[0028]

[0029] ② Large prime number p

[0030] Definition: p is another large prime number, but smaller than q, that is: p<<q.

[0031] Domain: element operations in a smaller finite field In which:

[0032]

[0033] ③Verification ID vID

[0034] Definition: vID is a verification identifier used for result verification, randomly selected from the set

[0035] Domain: vID∈F q-p , that is, selected from the difference domain {0,1,2,…,qp-1}.

[0036] Among the system's public parameters, q provides a strong encryption foundation; p is the value range of the information the querying party wants to query; and vID implements decryption correctness verification.

[0037] In an optional embodiment, the difference matrix T is obtained by the following method:

[0038] The querying party randomly selects a matrix B whose diagonal elements are 1 and the remaining elements are random 0s or 1s, and concatenates the matrix B and the zero matrix B0 to generate a concatenated matrix M, where the matrix B is a reversible matrix;

[0039] The querying party randomly selects a permutation matrix π, and confuses the concatenated matrix M according to the permutation matrix π to obtain a difference matrix T.

[0040] Specifically, the query party R is in the domain Randomly generate a matrix of dimension g×g The following conditions are met:

[0041] When i=j, b ij =1, that is, the main diagonal elements are fixed to 1; when i≠j, b ij A random value of 0 or 1.

[0042] Then determine whether the matrix B is in the domain The method includes: calculating the determinant det(B) of the matrix B; if det(B)≠0(mod q), then B is Upward reversibility, (mod q) means taking the modulo q of a certain value, that is, taking the remainder after dividing by q; if it is not reversible (that is, the determinant is 0 modulo q), then regenerate the matrix B until the reversibility requirement is met.

[0043] For example, the query party R generates a matrix B in the following form, and the matrix B is in the domain Reversible on:

[0044]

[0045] Then, the query party R constructs a concatenation matrix M of dimension g×2g, which is defined as: concatenating the matrix B with the zero matrix B0 of the same dimension in the column direction, in the form of: M=[B|B0];

[0046] For example, the concatenation matrix

[0047] The querying party randomly selects a permutation matrix π of 2g×2g dimensions, such that only one element in each row and column is 1, and the rest are 0;

[0048] Based on the permutation matrix π, the columns of the concatenated matrix M are obfuscated to obtain a difference matrix T of 2g×2g dimensions: that is, T=M×π is calculated.

[0049] In an optional embodiment, the querying party constructs the second correlation matrix H′ including:

[0050] The query party and the data party jointly call the oblivious transfer protocol, and use the data party's first correlation matrix H and correlation value Δ, and the query party's difference matrix T as inputs of the protocol, so that the query party receives the second correlation matrix H′ output by the protocol.

[0051] Specifically, the data party P randomly selects the first correlation matrix H and a correlation value Δ∈F q ; The first correlation matrix H is a matrix of g×2g dimensions, specifically:

[0052] Among them, h ab is an element of H.

[0053] The query party R and the data party P jointly call the "oblivious transfer" protocol.

[0054] Protocol input: elements and associated values ​​of the first correlation matrix H of data party P: h ab and Δ;

[0055] Query the element t of the difference matrix T of the square R ab , where (a∈g,b∈2g)

[0056] Protocol output: The querying party R obtains the corresponding element h′ ab =h ab +t ab Δ(mod q) means taking the modulus q of a number, that is, taking the remainder after dividing it by q.

[0057] Element t of the difference matrix T ab =1, h′ ab =h ab +Δ(mod q);

[0058] Element t of the difference matrix T ab = 0, h′ ab =h ab ;

[0059] After loop execution of all (a,b)∈[g]×[2g] positions, the query party R finally obtains the second correlation matrix H' of g×2g dimension, which is in the form of:

[0060] h′ ab is an element of H′.

[0061] The querying party holds the difference matrix T, knows only partial information about the first correlation matrix H, and does not know the correlation value Δ. The data party holds the first correlation matrix H and the correlation value Δ, but because the data party does not know the difference matrix T, it cannot infer the construction of the second correlation matrix H′.

[0062] For each new batch of query requests (querying data of g target indexes), the query party R and the data party P complete the hidden query according to the following steps:

[0063] S2. The query party performs blind obfuscation on the query index vector h(x) of the query index set to obtain a blind obfuscated index vector c, and sends the blind obfuscated index vector c to the data party;

[0064] In an optional embodiment, Figure 2 Flowchart of blinding and obfuscating query index vectors provided by an embodiment of the present invention; Figure 2 As shown, the S2 includes:

[0065] S21. The querying party generates a query index vector h(x) using a secure hash function for the query index set.

[0066] The query side is based on the query index set X:{x1,x2,…,x g}, for each query index x i Apply the secure hash function h(·) to generate the query index vector h(x), which is in the form of:

[0067] h(x)=(h(x1),h(x2)…,h(x g )) T

[0068] The hash function h(·) satisfies irreversibility and uniformity to avoid leaking the original index; the query index vector h(x) is a g-dimensional column vector.

[0069] S22. The querying party blinds the query index vector h(x) according to the inverse matrix of the matrix B to obtain a blinded index vector c1.

[0070] Use the inverse matrix B of matrix B -1 Transform the query index vector h(x) to obtain the blinded index vector c1. The specific calculation formula is:

[0071] c1=B -1 ×h(x)(mod q)

[0072] Among them, all matrix operations are performed in finite fields c1 is the blinded index vector, which is a g-dimensional column vector.

[0073] S23: The querying party selects a random vector and concatenates the blinded index vector and the random vector to generate a concatenated vector.

[0074] The query side R selects a random vector c2 is a g-dimensional row vector; the query party R transposes the blinded index vector c1 to generate Then it is spliced ​​with the random vector c2 to form a long vector of 1×2g, that is, the splicing vector

[0075] The introduction of the random vector c2 further enhances the obfuscation effect, making it impossible to infer the actual index content even if some information is leaked.

[0076] S24. The query party confuses the splicing vector according to the permutation matrix π to obtain a blinded obfuscation index vector c, and sends the blinded obfuscation index vector c to the data party.

[0077] Perform column permutation according to the generated permutation matrix π and calculate the blinded confusion index vector After being disrupted by the permutation matrix π, the original structure cannot be recognized by the data party P.

[0078] S3. The querying party calculates the first key vector based on the second correlation matrix H′ and the blinded confusion index vector c;

[0079] The querying party R calculates the first key vector based on the transpose of the second correlation matrix H' and the blinded obfuscation index vector c, specifically:

[0080] s1=(s11,…,s1 g ) T =H′×c T (mod q)

[0081] H′ is the second correlation matrix, which is a matrix of g×2g dimensions; c T It is a vector of 2g×1 dimension; the product result s1 is the first key vector of g×1 dimension, which is subsequently used for data decryption.

[0082] S4. The querying party constructs a bucket identification set based on the query index set and the secure hash function, and sends the bucket identification set to the data party;

[0083] In an optional embodiment, the S4 includes:

[0084] The querying party takes each query index in the query index set as the current query index in turn;

[0085] The querying party randomly selects the current salt value and generates the current hash value by using the current query index and the current salt value through a secure hash function;

[0086] Perform a congruence map based on a decreasing modulus set on the current hash value to obtain the current bucket number;

[0087] Combine the current salt value and the current bucket number to get the current bucket ID;

[0088] The current bucket identifiers corresponding to each query index are summarized to obtain a bucket identifier set.

[0089] Specifically, the query index set X:{x1,x2,…,x g}, construct the bucket identifier set through the secure hash function h(·):

[0090] ①Generate the first bucket number:

[0091] The query party R randomly selects a salt value r1∈F q , so that the following conditions are met:

[0092] For all j≠1, h(x1|r1)≠h(x j |r1)(mod g), mod g means: take the modulus g of a number, that is, take the remainder after dividing it by g.

[0093] That is, after the first index x1 is hashed with the salt value, the modulo g is taken, and the resulting value is unique among all remaining indices.

[0094] Calculate and record the first bucket number:

[0095] R1=h(x1|r1)(mod g)

[0096] Here, x1|r1 represents the concatenation (e.g., concatenation or binary concatenation) of index x1 and salt value r1, and mod g means taking the modulo g of a value, that is, taking the remainder after dividing by g.

[0097] ②Generate the second bucket number:

[0098] The query party R randomly selects the salt value r2∈F q , so that the following conditions are met:

[0099] For all j≠1,2, we have: h(x2|r2)≠h(x j |r2)(mod g-1)

[0100] That is, after removing the first index, the hash value modulo g-1 of index x2 is still guaranteed to be unique.

[0101] Calculate and record the second bucket number:

[0102] R2=h(x2|r2)(mod g-1)

[0103] ③Generate the third bucket number:

[0104] The query party R randomly selects the salt value r3∈F q , so that the following conditions are met:

[0105] For all j≠1,2,3, we have: h(x3|r3)≠h(x j |r3)(mod g-2)

[0106] Calculate and record the third bucket number:

[0107] R3=h(x3|r3)(mod g-2)

[0108] ④And so on, until the g-1th index

[0109] The querying party R randomly selects a salt value r g-1 ∈F q , so that the following conditions are met:

[0110] For all j≠1,2,3,…,g-1, we have: h(x g-1 |r g-1 )≠h(x j |r g-1 )(mod 2) Calculate and record the g-1th bucket number:

[0111] R g-1 =h(x g-1 |r g-1 )(mod 2)

[0112] Organize the salt value and bucket number corresponding to each index into a tuple:

[0113] ({r1,R1},{r2,R2},…,{r g-1 ,R g-1})

[0114] Recorded as bucket identifier set: hr=({r1,R1},{r2,R2},…,{r g-1 ,R g-1})

[0115] The query party R sends the bucket identifier set hr to the data party P; the data party P performs subsequent data bucketing and encryption operations based on the received bucket identifier set.

[0116] In this application, a random salt value is introduced to ensure that even if the data party observes the bucket number, the specific query index cannot be deduced. The modulus space is gradually reduced (from g to 2) to ensure that the hash results at different stages are as collision-free as possible.

[0117] S5. The data entity calculates a noise vector based on the first correlation matrix H and the blinded confusion index vector c.

[0118] In an optional embodiment, the data square P is the transpose of the first correlation matrix H and the blinded confusion index vector c, and the noise vector e is calculated. i , specifically:

[0119] Noise vector e=(e1,…,e g ) T =H×c T (mod q)

[0120] S6. The data party calculates the second key vector and ciphertext of all data indexes based on the noise vector e, the correlation value Δ, and the bucket identifier set hr. The data party randomly selects an index tag and performs a salted hash index on the second key vector to obtain a second key index. The data party sends the second key index, the corresponding ciphertext, and the index tag to the query party.

[0121] In an optional embodiment, the data party calculates the second key vector of all data indexes based on the noise vector, the correlation value Δ and the bucket identifier set, and the ciphertext includes:

[0122] S61. The data cube creates two empty buckets: a processed data bucket and a pending data bucket. All data indexes of the data cube are placed in the pending data bucket.

[0123] S62, taking each bucket identifier in the bucket identifier set as the current bucket identifier in turn;

[0124] S63, traversing all data indexes in the data bucket to be processed; taking the data index that meets the matching condition of the current bucket identifier from the data bucket to be processed and placing it into the processed data bucket, and calculating the elements of the second key vector and the ciphertext elements of the data index based on the corresponding elements and associated values ​​of the noise vector;

[0125] S64, repeat S63 until the data indexes that meet the matching conditions of all bucket identifiers are taken out from the to-be-processed data bucket and put into the processed data bucket;

[0126] S65. Calculate the elements of the second key vector and the ciphertext of all the remaining data indexes in the data bucket to be processed according to the noise vector and the associated value.

[0127] S66. Obtain a second key vector by taking the element set of the second key vector indexed by all data; and obtain a ciphertext by taking the element set of the ciphertext indexed by all data.

[0128] Specifically,

[0129] (1) Data input: Data party P holds the entire data set:

[0130] {(y1,m1),(y2,m2),...,(y N ,m N )}; where y i Indicates the index of the i-th data; m i Indicates the original value corresponding to the i-th data.

[0131] Auxiliary input: Data party P receives a set of bucket identifiers from query party R:

[0132] hr=({r1,R1},{r2,R2},…,{r g-1 ,R g-1})

[0133] Other inputs: associated values Noise Vector

[0134] (2) Establish initial buckets: processed data bucket bin1 and pending data bucket bin2.

[0135] Initially, all indices {y1,y2,…,y N}{y1,y2,...,y N}Place it in bucket bin2.

[0136] (3) Bucketing and encryption process:

[0137] Data provider P performs data bucketing, key generation, and data encryption according to the multi-round batch processing rules, as follows:

[0138] ①The first round of bucketing (module g)

[0139] Traverse each index y in bucket bin2 i , calculate h(y i |r1); if: h(y i |r1)≡R1(mod g), then do the following:

[0140] Calculate the elements of the second key vector: s2 i =h(y i )·Δ+e1mod q

[0141] Compute the elements of the ciphertext:

[0142] Among them, ⊕ represents the bitwise exclusive OR operation; (m i |vID) indicates that the data value m i After being concatenated with the verification identifier vID, it is processed.

[0143] Will meet h(y i |r1)≡R1(mod g) i Place it in the processed data bucket bin1; other unmatched indexes are retained in the pending data bucket bin2.

[0144] ② Second round of bucketing (modulo g-1)

[0145] Traverse the remaining index yi in the current bucket bin2 and calculate h(y i |r2); if: h(y i |r2)≡R2(mod g-1), then do the following:

[0146] Calculate the elements of the second key vector: s2 i =h(y i )·Δ+e2mod q

[0147] Compute the elements of the ciphertext:

[0148] Will meet h(y i |r2)≡R2(mod g-1) i The data to be processed is placed from the bucket bin2 into the processed data bucket bin1.

[0149] ③The third round of bucketing (module g-2)

[0150] Traverse the remaining index y in the current bucket bin2 i , calculate h(y i |r3); if satisfied: h(y i |r3)≡R3(mod g-2), then do the following:

[0151] Calculate the elements of the second key vector: s2 i =h(y i )·Δ+e3mod q

[0152] Compute the elements of the ciphertext:

[0153] Will meet h(y i |r3)≡R3(mod g-2) i The data to be processed is placed from the bucket bin2 into the processed data bucket bin1.

[0154] ④ Bucketing in the g-1th round (modulo 2)

[0155] Traverse the remaining index y in the current bucket bin2 i , calculate h(y i |r g-1 ); if: h(y i |r g-1 )≡R g-1 (mod2), then do the following:

[0156] Calculate the elements of the second key vector: s2 i =h(y i )·Δ+e g-1 mod q

[0157] Compute the elements of the ciphertext:

[0158] Will meet h(y i |r3)≡R3(mod g-2) i The data to be processed is placed from the bucket bin2 into the processed data bucket bin1.

[0159] ⑤ Bucketing in round g (modulo 2)

[0160] For all indexes y that ultimately remain in bucket bin2 i , execute directly:

[0161] Calculate the elements of the second key vector: s2 i =h(y i )·Δ+e g mod q

[0162] Compute the elements of the ciphertext:

[0163] No need to check hash matching anymore, all processing is complete.

[0164] (4) Encrypted output:

[0165] After completing the traversal, the data party P obtains the second key vector: s2=(s21,s22,…,s2 N )

[0166] Ciphertext vector: cip=(cip1,cip2,…,cip N );

[0167] Data party P randomly selects an index label rand∈F q ; For each s2 i∈N , calculate the salted hash index and get the second key index: h(s2 i |rand) 1×N;

[0168] The data party P sends the following data to the query party R:

[0169] {(h(s21|rand),cip1),(h(s22|rand),cip2),…,(h(s2 N |rand),cip N )}

[0170] That is, each piece of data contains an encrypted index and the corresponding ciphertext value. At the same time, the index tag rand is sent for subsequent decryption and matching by the querying party.

[0171] S7. The querying party performs a salted hash index on the first key vector according to the index tag to obtain a first key index; the querying party retrieves a target ciphertext corresponding to the first key index according to the first key index and the second key index; the querying party decrypts the target ciphertext according to the first key vector to obtain a query result.

[0172] In an optional embodiment, the querying party R holds a first key vector:

[0173] s1=9s11,s12,…,s1 g )

[0174] where s1 i For each query index x i .

[0175] The query party R uses the random index label rand sent by the data party P before, and for each s1 i∈g Perform salted hash calculation to obtain the first key index: h(s1 i |rand) i∈g

[0176] The query party R calculates each h(s1 i∈g |rand), retrieve the corresponding ciphertext cip j That is, if the query party calculates the current h(s1 i |rand) and a certain h(s2 j |rand) are equal, then according to the corresponding relationship (h(s2 j |rand),cip j ), take out the cip j As the corresponding x i ciphertext.

[0177] For each query index x i∈g , the querying party R performs the following decryption operation:

[0178]

[0179] The results obtained It consists of two parts: the front part is the query result data The back is the verification identifier vID.

[0180] Further, after obtaining the query result, the query party R Extract the end Check whether the extracted last bit is equal to the preset verification identifier vID: If the extracted verification identifier is equal to the preset vID, the decryption is determined to be correct and the query result is returned. If the verification fails (i.e. the last digit does not match the vID), decryption is considered to have failed and the corresponding query result is set to zero:

[0181] This verification mechanism effectively prevents incorrect decryption caused by index matching errors or data tampering.

[0182] Figure 3 This is a structural diagram of a multi-data hidden query system provided by an embodiment of the present invention. Figure 3 As shown, the system includes:

[0183] The matrix construction unit 201 is used for the data side to construct a first correlation matrix H and a correlation value Δ; the query side to construct a second correlation matrix H′ and a difference matrix T, satisfying H′=T·Δ+H;

[0184] In an optional embodiment, the difference matrix T is obtained by the following method:

[0185] The querying party randomly selects a matrix B whose diagonal elements are 1 and the remaining elements are random 0s or 1s, and concatenates the matrix B and the zero matrix B0 to generate a concatenated matrix M, where the matrix B is a reversible matrix;

[0186] The querying party randomly selects a permutation matrix π, and confuses the concatenated matrix M according to the permutation matrix π to obtain a difference matrix T.

[0187] In an optional embodiment, the querying party constructs the second correlation matrix H′ including:

[0188] The query party and the data party jointly call the oblivious transfer protocol, and use the data party's first correlation matrix H and correlation value Δ, and the query party's difference matrix T as inputs of the protocol, so that the query party receives the second correlation matrix H′ output by the protocol.

[0189] A blinded obfuscation unit 202 is configured to perform blinded obfuscation on the query index vector h(x) of the query index set by the query party to obtain a blinded obfuscated index vector c, and send the blinded obfuscated index vector c to the data party;

[0190] In an optional embodiment, Figure 4 : is a schematic diagram of the structure of the blind confusion unit provided by an embodiment of the present invention; Figure 4 As shown, the blinding confusion unit 202 includes:

[0191] A generating subunit 2021 is configured for the querying party to generate a query index vector h(x) from the query index set according to a secure hash function;

[0192] A blinding subunit 2022 is configured for the querying party to blind the query index vector h(x) according to the inverse matrix of the matrix B to obtain a blinded index vector;

[0193] The concatenation subunit 2023 is configured for the querying party to select a random vector and concatenate the blinded index vector and the random vector to generate a concatenated vector;

[0194] The obfuscation subunit 2024 is configured to cause the query party to obfuscate the concatenated vector according to the permutation matrix π to obtain a blinded obfuscation index vector c, and send the blinded obfuscation index vector to the data party.

[0195] A first calculation unit 203 is configured for the querying party to calculate a first key vector according to the second correlation matrix H′ and the blinded confusion index vector c;

[0196] Bucket identifier construction unit 204, configured for the querying party to construct a bucket identifier set based on the query index set and the secure hash function, and to send the bucket identifier set to the data party;

[0197] The second calculation unit 205 is configured for the data party to calculate a noise vector according to the first correlation matrix H and the blinded confusion index vector c;

[0198] Encryption unit 206 is configured to calculate a second key vector and ciphertext for all data indexes based on the noise vector, the correlation value Δ, and the bucket identifier set; the data party randomly selects an index tag and performs a salted hash index on the second key vector to obtain a second key index; the data party sends the second key index, the corresponding ciphertext, and the index tag to the querying party;

[0199] The decryption unit 207 is configured to cause the querying party to perform a salted hash index on the first key vector according to the index tag to obtain a first key index; the querying party to retrieve a target ciphertext corresponding to the first key index according to the first key index and the second key index; and the querying party to decrypt the target ciphertext according to the first key vector to obtain a query result.

[0200] The system of the present invention corresponds to the above method, and the specific embodiments of the system will not be repeated here.

[0201] Beneficial effects of the present invention:

[0202] The present invention provides a multi-data hidden query method and system, wherein the method uses a correlation matrix, index obfuscation, blinding technology, and separates the sensitive information of the query index set based on the correlation matrix to construct a blinded obfuscated index vector, ensuring that the data party cannot obtain the query index set and the attacker cannot infer sensitive information through intermediate data; using dynamic bucketing technology, the data processed in batches has the advantages of load balancing and flexible expansion, reducing communication and computing overhead while reducing the risk of exposure of sensitive information, and supporting efficient query in large-scale data scenarios; the correlation matrix supports multi-index parallel query and is suitable for a variety of different data query scenarios.

[0203] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A multi-data hidden query method, characterized in that: include: S1. The data side constructs the first correlation matrix H and the correlation value Δ; the query side constructs the second correlation matrix H ′ and the difference matrix T, satisfying H ′ =T·Δ+H; S2. The query party performs blind obfuscation on the query index vector h(x) of the query index set to obtain a blind obfuscated index vector c, and sends the blind obfuscated index vector c to the data party; S3, the querying party calculates the value of the second correlation matrix H ′ The first key vector is calculated by adding the blinded obfuscation index vector c; S4. The querying party constructs a bucket identification set based on the query index set and the secure hash function, and sends the bucket identification set to the data party; S5. The data entity calculates a noise vector based on the first correlation matrix H and the blinded confusion index vector c. S6. The data party calculates the second key vector and ciphertext of all data indexes based on the noise vector, the correlation value Δ, and the bucket identifier set. The data party randomly selects an index tag and performs a salted hash index on the second key vector to obtain a second key index. The data party sends the second key index, the corresponding ciphertext, and the index tag to the query party. S7. The querying party performs a salted hash index on the first key vector according to the index tag to obtain a first key index; the querying party retrieves a target ciphertext corresponding to the first key index according to the first key index and the second key index; the querying party decrypts the target ciphertext according to the first key vector to obtain a query result.

2. The method according to claim 1, characterized in that The difference matrix T is obtained by the following method: The querying party randomly selects a matrix B whose diagonal elements are 1 and the remaining elements are random 0s or 1s, and concatenates the matrix B and the zero matrix B0 to generate a concatenated matrix M, where the matrix B is a reversible matrix; The querying party randomly selects a permutation matrix π, and confuses the concatenated matrix M according to the permutation matrix π to obtain a difference matrix T.

3. The method according to claim 1, characterized in that The querying party constructs a second correlation matrix H ′ include: The query party and the data party jointly call the oblivious transfer protocol, taking the first correlation matrix H and correlation value Δ of the data party and the difference matrix T of the query party as the input of the protocol, so that the query party receives the second correlation matrix H output by the protocol. ′ .

4. The method according to claim 2, characterized in that The S2 includes: The query party generates a query index vector h(x) based on the query index set according to the secure hash function; The querying party blinds the query index vector h(x) according to the inverse matrix of matrix B to obtain a blinded index vector; The querying party selects a random vector and concatenates the blinded index vector and the random vector to generate a concatenated vector. The query party confuses the splicing vector according to the permutation matrix π to obtain a blinded obfuscation index vector c, and sends the blinded obfuscation index vector to the data party.

5. The method according to claim 1, characterized in that The S4 includes: The querying party takes each query index in the query index set as the current query index in turn; The querying party randomly selects the current salt value and generates the current hash value by using the current query index and the current salt value through a secure hash function; Perform a congruence map based on a decreasing modulus set on the current hash value to obtain the current bucket number; Combine the current salt value and the current bucket number to get the current bucket ID; The current bucket identifiers corresponding to each query index are summarized to obtain a bucket identifier set.

6. The method according to claim 5, characterized in that The data party calculates the second key vector of all data indexes based on the noise vector, the correlation value Δ and the bucket identifier set, and the ciphertext includes: S61. The data cube creates two empty buckets: a processed data bucket and a pending data bucket. All data indexes of the data cube are placed in the pending data bucket. S62, taking each bucket identifier in the bucket identifier set as the current bucket identifier in turn; S63, traversing all data indexes in the data bucket to be processed; taking the data index that meets the matching condition of the current bucket identifier from the data bucket to be processed and placing it into the processed data bucket, and calculating the elements of the second key vector and the ciphertext elements of the data index based on the corresponding elements and associated values ​​of the noise vector; S64, repeat S63 until the data indexes that meet the matching conditions of all bucket identifiers are taken out from the to-be-processed data bucket and put into the processed data bucket; S65. Calculate the elements of the second key vector and the ciphertext of all the remaining data indexes in the data bucket to be processed according to the noise vector and the associated value. S66. Obtain a second key vector by taking the element set of the second key vector indexed by all data; and obtain a ciphertext by taking the element set of the ciphertext indexed by all data.

7. A multi-data hidden query system, characterized in that: include: Matrix construction unit, used by the data side to construct the first correlation matrix H and correlation value Δ; the query side to construct the second correlation matrix H ′ and the difference matrix T, satisfying H ′ =T·Δ+H; A blinded obfuscation unit, configured for the query party to perform blinded obfuscation on the query index vector h(x) of the query index set to obtain a blinded obfuscated index vector c, and to send the blinded obfuscated index vector c to the data party; The first calculation unit is used for querying the second correlation matrix H ′ The first key vector is calculated by adding the blinded obfuscation index vector c; A bucket identifier construction unit, configured for the querying party to construct a bucket identifier set based on the query index set and the secure hash function, and to send the bucket identifier set to the data party; A second calculation unit is used for the data party to calculate a noise vector according to the first correlation matrix H and the blinded confusion index vector c; The encryption unit is configured to calculate a second key vector and ciphertext for all data indexes based on the noise vector, the correlation value Δ, and the bucket identifier set; the data party randomly selects an index tag and performs a salted hash index on the second key vector to obtain a second key index; and the data party sends the second key index, the corresponding ciphertext, and the index tag to the querying party; The decryption unit is configured to enable the querying party to perform a salted hash index on the first key vector according to the index tag to obtain the first key index; the querying party to retrieve the target ciphertext corresponding to the first key index according to the first key index and the second key index; and the querying party to decrypt the target ciphertext according to the first key vector to obtain the query result.

8. The system according to claim 7, characterized in that The difference matrix T is obtained by the following method: The querying party randomly selects a matrix B whose diagonal elements are 1 and the remaining elements are random 0s or 1s, and concatenates the matrix B and the zero matrix B0 to generate a concatenated matrix M, where the matrix B is a reversible matrix; The querying party randomly selects a permutation matrix π, and confuses the concatenated matrix M according to the permutation matrix π to obtain a difference matrix T.

9. The system according to claim 7, wherein: The querying party constructs a second correlation matrix H ′ include: The query party and the data party jointly call the oblivious transfer protocol, taking the first correlation matrix H and correlation value Δ of the data party and the difference matrix T of the query party as the input of the protocol, so that the query party receives the second correlation matrix H output by the protocol. ′ .

10. The system according to claim 8, wherein: The blinding confusion unit includes: A generation subunit, configured for the querying party to generate a query index vector h(x) from the query index set according to a secure hash function; A blinding subunit is used for the querying party to blind the query index vector h(x) according to the inverse matrix of the matrix B to obtain a blinded index vector; A splicing subunit, configured for the querying party to select a random vector and splice the blinded index vector and the random vector to generate a spliced ​​vector; The obfuscation subunit is configured to cause the query party to obfuscate the concatenated vector according to the permutation matrix π to obtain a blinded obfuscation index vector c, and send the blinded obfuscation index vector to the data party.

Images