A multi-data privacy query method and system

Abstract

This invention discloses a method and system for hidden multi-data queries. The method includes: constructing an association matrix and a difference matrix; the querying party generates a blinded and obfuscated index vector based on a query index set and sends it to the data party; the querying party calculates a first key vector and constructs a bucket identifier set; the data party calculates a noise vector, a second key vector, and ciphertext; the data party sends the ciphertext to the querying party; the querying party retrieves the target ciphertext and decrypts it to obtain the query result. This method, through association matrix, index obfuscation, blinding, and dynamic bucketing techniques, ensures that the data party cannot know the query index set, and attackers cannot deduce sensitive information through intermediate data; it utilizes matrix operations and batch processing to reduce communication and computational overhead, supporting efficient queries in large-scale data scenarios.

Description

Technical Field

[0001] This invention relates to the field of privacy computing technology, and more specifically, to a method and system for multi-data hidden query. Background Technology

[0002] With the development of big data and cloud computing technologies, data security and privacy protection have become important research areas. In sensitive fields such as finance and healthcare, it is often necessary to retrieve specific data without revealing the query intent. Existing covert query technologies, such as homomorphic encryption and searchable encryption, can achieve a certain degree of privacy protection, but they suffer from high computational overhead and low query efficiency. Therefore, how to improve query efficiency while ensuring the privacy of the query index has become an urgent technical problem to be solved. Summary of the Invention

[0003] This invention provides a method and system for multi-data hidden query to solve the problem of how to simultaneously ensure query index privacy and query efficiency in the prior art.

[0004] To achieve the above objectives, on the one hand, the present invention provides a multi-data hidden query method, the method comprising: S1, the data party constructs a first correlation matrix H and a correlation value Δ; the query party constructs a second correlation matrix H′ and a difference matrix T, satisfying H′=T·Δ+H; S2, the query party performs blinding obfuscation on the query index vector h(x) of the query index set to obtain a blinded obfuscated index vector c, and sends the blinded obfuscated index vector c to the data party; S3, the query party calculates a first key vector based on the second correlation matrix H′ and the blinded obfuscated index vector c; S4, the query party constructs a bucket identifier set based on the query index set and a secure hash function, and sends the bucket identifier set to the data party; S5, the data party... S6. The data provider calculates the noise vector based on the first correlation matrix H and the blinded obfuscation index vector c. S7. The data provider calculates the second key vector and ciphertext for all data indices based on the noise vector, correlation value Δ, and bucket identifier set. The data provider randomly selects an index label to perform a salted hash index on the second key vector, obtaining the second key index. The data provider sends the second key index, the corresponding ciphertext, and the index label to the query provider. S8. The query provider performs a salted hash index on the first key vector based on the index label, obtaining the first key index. The query provider retrieves the target ciphertext corresponding to the first key index based on the first key index and the second key index. The query provider decrypts the target ciphertext based on the first key vector to obtain the query result.

[0005] Optionally, the difference matrix T is obtained by the following method: the querying party randomly selects a matrix B with diagonal elements of 1 and the remaining elements of random 0 or 1, and concatenates matrix B and zero matrix B0 to generate a concatenated matrix M, wherein matrix B is an invertible matrix; the querying party randomly selects a permutation matrix Π, and obfuscates the concatenated matrix M according to the permutation matrix Π to obtain the difference matrix T.

[0006] Optionally, the querying party constructs the second correlation matrix H′ by: the querying party and the data party collaboratively invoke an unintentional transmission protocol, using the data party's first correlation matrix H and correlation value Δ, and the querying party's difference matrix T as inputs to the protocol, so that the querying party receives the second correlation matrix H′ output by the protocol.

[0007] Optionally, S2 includes: the querying party generating a query index vector h(x) from the query index set using a secure hash function; the querying party blinding the query index vector h(x) using the inverse matrix of matrix B to obtain a blinded index vector; the querying party selecting a random vector and concatenating the blinded index vector and the random vector to generate a concatenated vector; the querying party obfuscating the concatenated vector using a permutation matrix Π to obtain a blinded obfuscated index vector c, and sending the blinded obfuscated index vector to the data party.

[0008] Optionally, step S4 includes: the querying party sequentially using each query index in the query index set as the current query index; the querying party randomly selects the current salt value, and generates the current hash value by using a secure hash function with the current query index and the current salt value; performing a congruential mapping based on a decreasing modulus set on the current hash value to obtain the current bucket number; combining the current salt value and the current bucket number to obtain the current bucket identifier; and summarizing the current bucket identifiers obtained according to each query index to obtain a bucket identifier set.

[0009] Optionally, the data party calculates the second key vector of all data indexes based on the noise vector, the association value Δ, and the bucket identifier set. The ciphertext includes: S61, the data party establishes two empty buckets: a processed data bucket and a data bucket to be processed; all data indexes of the data party are placed into the data bucket to be processed; S62, each bucket identifier in the bucket identifier set is used as the current bucket identifier in turn; S63, all data indexes in the data bucket to be processed are traversed; data indexes that meet the matching conditions of the current bucket identifier are taken out from the data bucket to be processed and placed into the processed data bucket, based on the noise vector. S64. Calculate the elements of the second key vector and the elements of the ciphertext for the corresponding elements and associated values ​​of the data index; S65. Repeat S66 until the data index that satisfies the matching conditions of all bucket identifiers is taken out from the data bucket to be processed and put into the processed data bucket; S66. Calculate the elements of the second key vector and the elements of the ciphertext for all the remaining data indexes in the data bucket to be processed based on the noise vector and associated values; S67. Obtain the second key vector by setting the elements of the second key vector of all data indexes; obtain the ciphertext by setting the elements of the ciphertext of all data indexes.

[0010] On the other hand, the present invention provides a multi-data concealment query system, which includes: a matrix construction unit, used by the data party to construct a first correlation matrix H and a correlation value Δ; the query party to construct a second correlation matrix H′ and a difference matrix T, satisfying H′=T·Δ+H; a blinding obfuscation unit, used by the query party to blind obfuscate the query index vector h(x) of the query index set to obtain a blind obfuscated index vector c, and send the blind obfuscated index vector c to the data party; a first calculation unit, used by the query party to calculate a first key vector based on the second correlation matrix H′ and the blind obfuscated index vector c; a bucket identifier construction unit, used by the query party to construct a bucket identifier set based on the query index set and a secure hash function, and send the bucket identifier set to the data party; a second The calculation unit is used by the data party to calculate a noise vector based on the first correlation matrix H and the blinded obfuscation index vector c; the encryption unit is used by the data party to calculate a second key vector and ciphertext for all data indexes based on the noise vector, correlation value Δ, and bucket identifier set; the data party randomly selects an index label to perform a salted hash index on the second key vector to obtain a second key index; the data party sends the second key index, the corresponding ciphertext, and the index label to the query party; the decryption unit is used by the query party to perform a salted hash index on the first key vector based on the index label to obtain a first key index; the query party retrieves the target ciphertext corresponding to the first key index based on the first key index and the second key index; the query party decrypts the target ciphertext based on the first key vector to obtain the query result.

[0011] Optionally, the difference matrix T is obtained by the following method: the querying party randomly selects a matrix B with diagonal elements of 1 and the remaining elements of random 0 or 1, and concatenates matrix B and zero matrix B0 to generate a concatenated matrix M, wherein matrix B is an invertible matrix; the querying party randomly selects a permutation matrix Π, and obfuscates the concatenated matrix M according to the permutation matrix Π to obtain the difference matrix T.

[0012] Optionally, the querying party constructs the second correlation matrix H′ by: the querying party and the data party collaboratively invoke an unintentional transmission protocol, using the data party's first correlation matrix H and correlation value Δ, and the querying party's difference matrix T as inputs to the protocol, so that the querying party receives the second correlation matrix H′ output by the protocol.

[0013] Optionally, the blinding and obfuscation unit includes: a generation subunit, used by the querying party to generate a query index vector h(x) from the query index set according to a secure hash function; a blinding subunit, used by the querying party to blind the query index vector h(x) according to the inverse matrix of matrix B, to obtain a blinded index vector; a splicing subunit, used by the querying party to select a random vector and splice the blinded index vector and the random vector to generate a spliced ​​vector; and an obfuscation subunit, used by the querying party to obfuscate the spliced ​​vector according to the permutation matrix Π to obtain a blinded and obfuscated index vector c, and send the blinded and obfuscated index vector to the data party.

[0014] The beneficial effects of this invention are:

[0015] This invention provides a multi-data hidden query method and system. The method utilizes an association matrix, index obfuscation, and blinding techniques. It also separates sensitive information from the query index set based on the association matrix to construct a blinded and obfuscated index vector. This ensures that the data provider cannot know the query index set, and attackers cannot deduce sensitive information from intermediate data. Dynamic bucketing technology enables batch processing of data to achieve advantages such as load balancing and flexible scaling, reducing communication and computational overhead while minimizing the risk of sensitive information exposure. This supports efficient querying in large-scale data scenarios. The association matrix supports parallel queries across multiple indexes, making it suitable for various data query scenarios. Attached Figure Description

[0016] Figure 1 This is a flowchart of a multi-data hidden query method provided in an embodiment of the present invention;

[0017] Figure 2 This is a flowchart of the process of blinding and obfuscating the query index vector provided in an embodiment of the present invention;

[0018] Figure 3 This is a schematic diagram of the structure of a multi-data hidden query system provided in an embodiment of the present invention;

[0019] Figure 4 This is a schematic diagram of the structure of the blinding obfuscation unit provided in an embodiment of the present invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0021] Figure 1 This is a flowchart of a multi-data hidden query method provided by an embodiment of the present invention, such as... Figure 1 As shown, the method includes:

[0022] S1. The data side constructs the first correlation matrix H and the correlation value Δ; the query side constructs the second correlation matrix H′ and the difference matrix T, satisfying H′=T·Δ+H;

[0023] In an optional implementation, the following is included before S1: common parameter initialization;

[0024] To ensure encryption security and correctness verification during the covert query process, the following set of common parameters must be selected during system initialization: pp = {q, p, vID}

[0025] ①Safe large prime number q

[0026] Definition: q is a sufficiently large prime number used to define the fundamental field for cryptographic computation.

[0027] Domain: All element operations are performed within a finite field. The above is carried out, where:

[0028]

[0029] ② Large prime number p

[0030] Definition: p is another large prime number, but smaller in volume than q, i.e., p << q.

[0031] Domain: Element-wise operations are performed over a smaller finite field. In, where:

[0032]

[0033] ③ Verification ID (vID)

[0034] Definition: vID is a validation identifier used for result verification, randomly selected from a set.

[0035] Domain: vID∈F q-p That is, it is selected from the difference region {0,1,2,…,qp-1}.

[0036] Among the system's common parameters, q provides a robust encryption foundation; p represents the range of values ​​for the information the querying party wants to retrieve; and vID verifies the correctness of the decryption.

[0037] In an optional implementation, the difference matrix T is obtained by the following method:

[0038] The querying party randomly selects a matrix B with diagonal elements of 1 and the remaining elements of random 0 or 1, and concatenates matrix B with the zero matrix B0 to generate a concatenated matrix M, wherein matrix B is an invertible matrix;

[0039] The querying party randomly selects a permutation matrix Π, and then obfuscates the spliced ​​matrix M based on the permutation matrix Π to obtain the difference matrix T.

[0040] Specifically, the query party R in the domain A random g×g dimension matrix is ​​generated above. Among them, the following conditions must be met:

[0041] When i = j, b ij =1, meaning the main diagonal elements are fixed at 1; when i≠j, b ij It is a random value of 0 or 1.

[0042] Then determine whether matrix B is in the field. The matrix B is invertible. The method includes: calculating the determinant det(B) of matrix B; if det(B) ≠ 0 (mod q), then B is invertible. If the matrix is ​​invertible (mod q), it means taking the remainder after dividing by q. If it is not invertible (i.e., the determinant is 0 modulo q), then matrix B is regenerated until the invertibility requirement is met.

[0043] For example, the query party R generates a matrix B in the following form, and this matrix B is in the domain Upward reversible:

[0044]

[0045] Then, the query party R constructs a concatenated matrix M of dimension g×2g, defined as: concatenating matrix B with the zero matrix B0 of the same dimension in the column direction, in the form: M=[B|B0];

[0046] For example, concatenating matrices

[0047] The querying party randomly selects a permutation matrix Π with dimensions of 2g×2g, such that each row and each column has only one element that is 1, and the rest are 0;

[0048] Based on the permutation matrix Π, the columns of the splicing matrix M are obfuscated to obtain a difference matrix T with dimensions of 2g×2g: that is, calculate T=M×Π.

[0049] In an optional implementation, the querying party constructs the second correlation matrix H′ by:

[0050] The querying party and the data party collaboratively invoke the unintentional transmission protocol, using the data party's first correlation matrix H and correlation value Δ, and the querying party's difference matrix T as inputs to the protocol, so that the querying party receives the protocol output second correlation matrix H′.

[0051] Specifically, the data party P randomly selects a first correlation matrix H and a correlation value Δ∈F. q The first correlation matrix H is a matrix of dimension g×2g, specifically:

[0052] Among them, h ab For elements of H.

[0053] The querying party R and the data party P collaboratively invoke the "unintentional transmission" protocol.

[0054] Protocol input: Elements and correlation values ​​of the first correlation matrix H of data party P: h ab and Δ;

[0055] The elements t of the difference matrix T of the query party R ab , where (a∈g, b∈2g)

[0056] Protocol output: The querying party R obtains the corresponding element h′. ab =h ab +t ab ·Δ(mod q); mod q means taking the remainder after dividing by q.

[0057] The elements t of the difference matrix T ab When = 1, h′ ab =h ab +Δ(mod q);

[0058] The elements t of the difference matrix T ab When = 0, h′ ab =h ab ;

[0059] After iterating through all positions (a,b)∈[g]×[2g], the query party R finally obtains the second correlation matrix H' of dimension g×2g, which is in the form of:

[0060] h′ ab The elements are H′.

[0061] The querying party holds the difference matrix T, knows only partial information about the first correlation matrix H, and is unaware of the correlation value Δ. The data party holds the first correlation matrix H and the correlation value Δ, but because the data party is unaware of the difference matrix T, it cannot deduce the construction of the second correlation matrix H′.

[0062] For each new batch of query requests (querying data from g target indexes), the query party R and the data party P complete the hidden query according to the following steps:

[0063] S2. The querying party performs blinding and obfuscation on the query index vector h(x) of the query index set to obtain a blinded and obfuscated index vector c, and sends the blinded and obfuscated index vector c to the data party;

[0064] In one optional implementation, Figure 2 This is a flowchart of the process of blinding and obfuscating the query index vector provided in an embodiment of the present invention; such as Figure 2 As shown, S2 includes:

[0065] S21. The querying party generates a query index vector h(x) from the query index set using a secure hash function;

[0066] The query is based on the query index set X:{x1,x2,…,x g}, for each query index x i Applying the secure hash function h(·), the query index vector h(x) is generated in the form:

[0067] h(x)=(h(x1),h(x2)…,h(x g )) T

[0068] The hash function h(·) satisfies the requirements of irreversibility and uniformity, thus avoiding the leakage of the original index; the query index vector h(x) is a g-dimensional column vector.

[0069] S22. The querying party blinds the query index vector h(x) based on the inverse matrix of matrix B, and obtains the blinded index vector c1.

[0070] Using the inverse matrix B -1 The query index vector h(x) is transformed to obtain the blinded index vector c1. The specific calculation formula is as follows:

[0071] c1 = B -1 ×h(x)(mod q)

[0072] All matrix operations are performed in a finite field. The above is performed; c1 is the blinded index vector, which is a g-dimensional column vector.

[0073] S23. The querying party selects a random vector and concatenates the blinded index vector and the random vector to generate a concatenated vector;

[0074] Query party R selects a random vector c2 is a g-dimensional row vector; the query method R generates it by transposing the blinded index vector c1. Then it is concatenated with the random vector c2 to form a 1×2g long vector, i.e., the concatenated vector.

[0075] The introduction of the random vector c2 further enhances the obfuscation effect, making it impossible to deduce the actual index content even if some information is leaked.

[0076] S24. The querying party obfuscates the spliced ​​vector according to the permutation matrix Π to obtain the blinded obfuscated index vector c, and sends the blinded obfuscated index vector c to the data party.

[0077] Perform column permutations based on the generated permutation matrix Π, and calculate the blinded obfuscation index vector. After being shuffled by the permutation matrix Π, the original structure becomes unrecognizable by the data party P.

[0078] S3. The querying party calculates the first key vector based on the second correlation matrix H′ and the blinded obfuscation index vector c;

[0079] The query party R calculates the first key vector based on the transpose of the second correlation matrix H' and the blinded obfuscation index vector c, specifically as follows:

[0080] s1=(s11,…,s1 g ) T =H′×c T (mod q)

[0081] H′ is the second correlation matrix, which is a matrix of dimension g×2g; c T It is a 2g×1 dimension vector; the product result s1 is the first key vector of g×1 dimension, which is used for data decryption later.

[0082] S4. The querying party constructs a bucket identifier set based on the query index set and the secure hash function, and sends the bucket identifier set to the data party;

[0083] In an optional implementation, S4 includes:

[0084] The querying party sequentially uses each query index in the query index set as the current query index;

[0085] The querying party randomly selects the current salt value and generates the current hash value by using a secure hash function with the current query index and the current salt value.

[0086] Perform a congruential mapping based on a decreasing modulus set on the current hash value to obtain the current bucket number;

[0087] The current barrel identifier is obtained by combining the current salt value and the current barrel number;

[0088] The bucket identifier set is obtained by summing the current bucket identifiers obtained for each query index.

[0089] Specifically, the query index set X:{x1,x2,…,x g}, construct the bucket identifier set using the secure hash function h(·):

[0090] ① Generate the first bucket number:

[0091] The query party R randomly selects a salt value r1∈F q This satisfies the following conditions:

[0092] For all j ≠ 1, we have: h(x1|r1) ≠ h(x j |r1)(mod g), mod g means: take the remainder after dividing by g.

[0093] That is, after the first index x1 is hashed by salt perturbation, the modulo of g is taken, and the resulting value is unique across all remaining indices.

[0094] Calculate and record the number of the first bucket:

[0095] R1 = h(x1|r1) (mod g)

[0096] Here, x1|r1 represents the concatenation of index x1 and salt value r1 (such as concatenation or binary concatenation), and mod g means taking the modulo g of a certain value, that is, taking the remainder after dividing by g.

[0097] ② Generate the second bucket number:

[0098] The query party R randomly selects a salt value r2∈F q This satisfies the following conditions:

[0099] For all j ≠ 1, 2, we have: h(x²|r²) ≠ h(x j |r2)(mod g-1)

[0100] That is, even after removing the first index, the hash value of index x2 modulo g-1 is still guaranteed to be unique.

[0101] Calculate and record the number of the second bucket:

[0102] R² = h(x²|r²) (mod g⁻¹)

[0103] ③ Generate the third bucket number:

[0104] The query party R randomly selects a salt value r3∈F q This satisfies the following conditions:

[0105] For all j ≠ 1, 2, 3, we have: h(x3|r3) ≠ h(x j |r3)(mod g-2)

[0106] Calculate and record the number of the third bucket:

[0107] R3 = h(x3|r3) (mod g-2)

[0108] ④ And so on, until the (g-1)th index.

[0109] Query party R randomly selects salt value r g-1 ∈F q This satisfies the following conditions:

[0110] For all j ≠ 1, 2, 3, ..., g-1, we have: h(x g-1 |r g-1 )≠h(x j |r g-1 (mod 2) Calculate and record the number of the (g-1)th bucket:

[0111] R g-1 =h(x g-1 |r g-1 (mod 2)

[0112] Organize the salt value and bucket number corresponding to each of the above indices into a binary tuple:

[0113] ({r1,R1},{r2,R2},…,{r g-1 ,R g-1})

[0114] Let hr be the set of bucket identifiers: hr = ({r1, R1}, {r2, R2}, ..., {r g-1 ,R g-1})

[0115] The query party R sends the bucket identifier set hr to the data party P; the data party P performs subsequent data bucketing and encryption operations based on the received bucket identifier set.

[0116] In this application, a random salt value is introduced to ensure that even if the data provider observes the bucket number, it cannot deduce the specific query index. The modulus space is gradually reduced (from g to 2) to ensure that hash results at different stages avoid collisions as much as possible.

[0117] S5. The data provider calculates the noise vector based on the first correlation matrix H and the blinded confusion index vector c.

[0118] In an optional implementation, the transpose of the first correlation matrix H of the data side P and the blinding confusion index vector c is used to calculate the noise vector e. i Specifically:

[0119] Noise vector e = (e1,…,e g ) T =H×c T (mod q)

[0120] S6. The data provider calculates the second key vector and ciphertext of the entire data index based on the noise vector e, the correlation value Δ, and the bucket identifier set hr. The data provider randomly selects an index label to perform a salted hash index on the second key vector to obtain the second key index. The data provider sends the second key index, the corresponding ciphertext, and the index label to the query provider.

[0121] In an optional implementation, the data provider calculates a second key vector for the entire data index based on the noise vector, the association value Δ, and the bucket identifier set. The ciphertext includes:

[0122] S61. The data provider creates two empty buckets: a processed data bucket and a pending data bucket; all data indexes from the data provider are placed into the pending data bucket.

[0123] S62. Sequentially use each bucket identifier in the bucket identifier set as the current bucket identifier;

[0124] S63. Traverse all data indices in the data bucket to be processed; take out the data index that meets the matching condition of the current bucket identifier from the data bucket to be processed and put it into the processed data bucket; calculate the elements of the second key vector and the elements of the ciphertext of the data index according to the corresponding elements of the noise vector and the associated values.

[0125] S64. Repeat S63 until the data index that meets the matching conditions of all bucket identifiers is taken out from the data bucket to be processed and put into the data bucket that has been processed.

[0126] S65. Calculate the elements of the second key vector and the elements of the ciphertext for all remaining data indices in the data bucket to be processed, based on the noise vector and the association value.

[0127] S66. The set of elements of the second key vector with all data indexes is obtained as the second key vector; the set of elements of the ciphertext with all data indexes is obtained as the ciphertext.

[0128] Specifically,

[0129] (1) Data input: Data provider P holds the entire data set:

[0130] {(y1,m1),(y2,m2),...,(y N ,m N )};where, y i This represents the index of the i-th data item; m i This represents the original value corresponding to the i-th data item.

[0131] Auxiliary input: Data provider P receives a set of bucket identifiers from query provider R:

[0132] hr=({r1,R1},{r2,R2},…,{r g-1 ,R g-1})

[0133] Other inputs: associated values noise vector

[0134] (2) Create initial buckets: processed data bucket bin1 and unprocessed data bucket bin2.

[0135] Initially, all indices {y1, y2, ..., y} are set. N}{y1,y2,...,y N Place it into bucket bin2.

[0136] (3) Bucketing and encryption process:

[0137] Data provider P performs data bucketing, key generation, and data encryption according to a multi-round batch processing rule, as follows:

[0138] ① First round of bucket division (modulus g)

[0139] Iterate through each index y in bucket bin2 i Calculate h(y) i |r1); if h(y) is satisfied: i If |r1)≡R1(mod g), then perform the following operation:

[0140] Calculate the elements of the second key vector: s2 i =h(y i )·Δ+e1mod q

[0141] Calculate the elements of the ciphertext:

[0142] Where ⊕ represents the bitwise XOR operation; (m i |vID) indicates that the data value m i After concatenating with the verification identifier vID, further processing is performed.

[0143] Will conform to h(y) i The index y of |r1)≡R1(mod g) i Place the processed data into the bin1 bucket; other unmatched indexes are kept in the bin2 bucket to be processed.

[0144] ② Second round of bucket division (modulus g-1)

[0145] Iterate through the remaining indices yi in the current bucket bin2 and calculate h(y). i |r2); if h(y) is satisfied: i If |r2)≡R2(mod g-1), then perform the following operation:

[0146] Calculate the elements of the second key vector: s2 i =h(y i )·Δ+e2mod q

[0147] Calculate the elements of the ciphertext:

[0148] Will conform to h(y) i The index y of |r2)≡R2(mod g-1) i The processed data is moved from the unprocessed data bucket bin2 to the processed data bucket bin1.

[0149] ③ Third round of bucket division (modulus g-2)

[0150] Iterate through the remaining index y in the current bucket bin2 i Calculate h(y) i |r3); if h(y) is satisfied: i If |r3)≡R3(mod g-2), then perform the following operation:

[0151] Calculate the elements of the second key vector: s2 i =h(y i )·Δ+e3mod q

[0152] Calculate the elements of the ciphertext:

[0153] Will conform to h(y) i The index y of |r3)≡R3(mod g-2) i The processed data is moved from the unprocessed data bucket bin2 to the processed data bucket bin1.

[0154] ④ The (g-1)th round of bucket division (modulo 2)

[0155] Iterate through the remaining index y in the current bucket bin2 i Calculate h(y) i |r g-1 If the following condition is met: h(y) i |r g-1 )≡R g-1 If (mod2), then perform the following operations:

[0156] Calculate the elements of the second key vector: s2 i =h(y i )·Δ+e g-1 mod q

[0157] Calculate the elements of the ciphertext:

[0158] Will conform to h(y) i The index y of |r3)≡R3(mod g-2) i The processed data is moved from the unprocessed data bucket bin2 to the processed data bucket bin1.

[0159] ⑤ The g-th round of bucket division (modulo 2)

[0160] For all indexes y that ultimately remain in bucket bin2 i Execute directly:

[0161] Calculate the elements of the second key vector: s2 i =h(y i )·Δ+e g mod q

[0162] Calculate the elements of the ciphertext:

[0163] No further hash matching is needed; the entire process is complete.

[0164] (4) Encrypted output:

[0165] After completing the traversal, the data party P obtains the second key vector: s2 = (s21, s22, ..., s2) N )

[0166] Ciphertext vector: cip = (cip1, cip2, ..., cip N );

[0167] Data P randomly selects an index label rand∈F q For each s2 i∈N Calculate the salted hash index to obtain the second key index: h(s2) i |rand) 1×N;

[0168] Data provider P sends the following data to query provider R:

[0169] {(h(s21|rand),cip1),(h(s22|rand),cip2),…,(h(s2 N |rand),cip N )}

[0170] Each data entry contains an encrypted index and a corresponding ciphertext value. An index tag (rand) is also sent for subsequent decryption and matching by the querying party.

[0171] S7. The querying party performs a salted hash index on the first key vector based on the index label to obtain the first key index; the querying party retrieves the target ciphertext corresponding to the first key index based on the first key index and the second key index; the querying party decrypts the target ciphertext based on the first key vector to obtain the query result.

[0172] In one optional implementation, the querying party R holds a first key vector:

[0173] s1 = 9s11,s12,…,s1 g )

[0174] Where s1 i For each query index x i .

[0175] The query party R uses the random index label rand previously sent by the data party P to perform a query on each s1. i∈g Perform salted hash calculation to obtain the first key index: h(s1) i |rand) i∈g

[0176] The query party R calculates each h(s1) i∈g `|rand)` retrieves the corresponding ciphertext `cip`. j That is, if the querying party calculates the current h(s1)... i |rand) and a certain h(s2) sent by the data provider j If |rand) are equal, then according to the correspondence (h(s2) j |rand),cip j ), retrieve the cip j As the corresponding x i The encrypted text.

[0177] For each query index x i∈g The querying party R performs the following decryption operation:

[0178]

[0179] The results obtained It consists of two parts: the first part is the query result data. The latter part is the verification identifier vID.

[0180] Furthermore, after obtaining the query results, the querying party R... Extract the end Bits (i.e., enough bits to hold p elements). Check if the extracted last bit is equal to the preset checksum vID: if the extracted checksum is equal to the preset vID, the decryption is considered correct, and the query result is returned. If the verification fails (i.e., the last digit does not match the vID), then decryption fails, and the corresponding query result is set to zero.

[0181] This verification mechanism effectively prevents erroneous decryption caused by index mismatch or data tampering.

[0182] Figure 3 This is a schematic diagram of the structure of a multi-data hidden query system provided in an embodiment of the present invention, such as... Figure 3 As shown, the system includes:

[0183] Matrix construction unit 201 is used by the data side to construct the first correlation matrix H and the correlation value Δ; and by the query side to construct the second correlation matrix H′ and the difference matrix T, satisfying H′=T·Δ+H;

[0184] In an optional implementation, the difference matrix T is obtained by the following method:

[0185] The querying party randomly selects a matrix B with diagonal elements of 1 and the remaining elements of random 0 or 1, and concatenates matrix B with the zero matrix B0 to generate a concatenated matrix M, wherein matrix B is an invertible matrix;

[0186] The querying party randomly selects a permutation matrix Π, and then obfuscates the spliced ​​matrix M based on the permutation matrix Π to obtain the difference matrix T.

[0187] In an optional implementation, the querying party constructs the second correlation matrix H′ by:

[0188] The querying party and the data party collaboratively invoke the unintentional transmission protocol, using the data party's first correlation matrix H and correlation value Δ, and the querying party's difference matrix T as inputs to the protocol, so that the querying party receives the protocol output second correlation matrix H′.

[0189] The blinding and obfuscation unit 202 is used by the query party to blind and obfuscate the query index vector h(x) of the query index set to obtain a blind and obfuscated index vector c, and send the blind and obfuscated index vector c to the data party;

[0190] In one optional implementation, Figure 4 This is a schematic diagram of the structure of the blinding obfuscation unit provided in an embodiment of the present invention; as shown below. Figure 4 As shown, the blinding obfuscation unit 202 includes:

[0191] Generating subunit 2021 is used by the querying party to generate a query index vector h(x) from the query index set according to a secure hash function;

[0192] The blinding subunit 2022 is used by the query party to blind the query index vector h(x) based on the inverse matrix of matrix B, so as to obtain the blinded index vector.

[0193] The splicing subunit 2023 is used by the query party to select a random vector and splice the blinded index vector and the random vector to generate a spliced ​​vector;

[0194] The obfuscation subunit 2024 is used by the query party to obfuscate the spliced ​​vector according to the permutation matrix Π to obtain a blinded obfuscated index vector c, and then send the blinded obfuscated index vector to the data party.

[0195] The first calculation unit 203 is used by the querying party to calculate the first key vector based on the second correlation matrix H′ and the blinded confusion index vector c;

[0196] Bucket identifier construction unit 204 is used by the querying party to construct a bucket identifier set based on the query index set and the secure hash function, and send the bucket identifier set to the data party;

[0197] The second calculation unit 205 is used by the data side to calculate the noise vector based on the first correlation matrix H and the blinded confusion index vector c;

[0198] Encryption unit 206 is used by the data party to calculate the second key vector and ciphertext of the entire data index based on the noise vector, the correlation value Δ and the bucket identifier set; the data party randomly selects an index label to perform salted hash indexing on the second key vector to obtain the second key index; the data party sends the second key index, the corresponding ciphertext, and the index label to the query party;

[0199] The decryption unit 207 is used by the querying party to perform salted hash indexing on the first key vector according to the index label to obtain the first key index; the querying party retrieves the target ciphertext corresponding to the first key index according to the first key index and the second key index; and the querying party decrypts the target ciphertext according to the first key vector to obtain the query result.

[0200] The system of the present invention corresponds to the method described above, and specific embodiments of the system will not be repeated here.

[0201] The beneficial effects of this invention are:

[0202] This invention provides a multi-data hidden query method and system. The method utilizes an association matrix, index obfuscation, and blinding techniques. It also separates sensitive information from the query index set based on the association matrix to construct a blinded and obfuscated index vector. This ensures that the data provider cannot know the query index set, and attackers cannot deduce sensitive information from intermediate data. Dynamic bucketing technology enables batch processing of data to achieve advantages such as load balancing and flexible scaling, reducing communication and computational overhead while minimizing the risk of sensitive information exposure. This supports efficient querying in large-scale data scenarios. The association matrix supports parallel queries across multiple indexes, making it suitable for various data query scenarios.

[0203] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for multiple data concealment query, characterized in that, include: S1, the data party constructs a first correlation matrix H and a correlation value Δ; the inquiring party constructs a second correlation matrix H ′ and a difference matrix T, satisfying H ′ = T·Δ+H; S2. The querying party performs blinding and obfuscation on the query index vector h(x) of the query index set to obtain a blinded and obfuscated index vector c, and sends the blinded and obfuscated index vector c to the data party; S3, the inquiring party calculates the first key vector according to the second correlation matrix H and the blinded confusion index vector c. ′ and the blinded confusion index vector c to obtain the first key vector. S4. The querying party constructs a bucket identifier set based on the query index set and the secure hash function, and sends the bucket identifier set to the data party; S5. The data provider calculates the noise vector based on the first correlation matrix H and the blinded confusion index vector c. S6. The data provider calculates the second key vector and ciphertext of the entire data index based on the noise vector, the correlation value Δ, and the bucket identifier set; the data provider randomly selects an index label to perform a salted hash index on the second key vector to obtain the second key index; the data provider sends the second key index, the corresponding ciphertext, and the index label to the query provider. S7. The querying party performs a salted hash index on the first key vector based on the index label to obtain the first key index; the querying party retrieves the target ciphertext corresponding to the first key index based on the first key index and the second key index; the querying party decrypts the target ciphertext based on the first key vector to obtain the query result.

2. The method of claim 1, wherein, The difference matrix T is obtained through the following method: The querying party randomly selects a matrix B with diagonal elements of 1 and the remaining elements of random 0 or 1, and concatenates matrix B with the zero matrix B0 to generate a concatenated matrix M, wherein matrix B is an invertible matrix; The querying party randomly selects a permutation matrix Π, and then obfuscates the spliced ​​matrix M based on the permutation matrix Π to obtain the difference matrix T.

3. The method of claim 1, wherein, The query party constructs a second incidence matrix H ′ comprising: The querying party and the data party collaboratively invoke an unintentional transmission protocol, using the data party's first correlation matrix H and correlation value Δ, and the querying party's difference matrix T as inputs to the protocol, so that the querying party receives the protocol's output second correlation matrix H. ′ .

4. The method of claim 2, wherein, S2 includes: The querying party generates a query index vector h(x) from the query index set using a secure hash function; The querying party blinds the query index vector h(x) based on the inverse matrix of matrix B, thus obtaining the blinded index vector; The querying party selects a random vector and concatenates the blinded index vector and the random vector to generate a concatenated vector; The querying party obfuscates the spliced ​​vector according to the permutation matrix Π to obtain a blinded obfuscated index vector c, and sends the blinded obfuscated index vector to the data party.

5. The method of claim 1, wherein, S4 includes: The querying party sequentially uses each query index in the query index set as the current query index; The querying party randomly selects the current salt value and generates the current hash value by using a secure hash function with the current query index and the current salt value. Perform a congruential mapping based on a decreasing modulus set on the current hash value to obtain the current bucket number; The current barrel identifier is obtained by combining the current salt value and the current barrel number; The bucket identifier set is obtained by summing the current bucket identifiers obtained for each query index.

6. The method of claim 5, wherein, The data provider calculates the second key vector for the entire data index based on the noise vector, the correlation value Δ, and the bucket identifier set. The ciphertext includes: S61. The data provider creates two empty buckets: a processed data bucket and a pending data bucket; all data indexes from the data provider are placed into the pending data bucket. S62. Sequentially use each bucket identifier in the bucket identifier set as the current bucket identifier; S63. Traverse all data indices in the data bucket to be processed; take out the data index that meets the matching condition of the current bucket identifier from the data bucket to be processed and put it into the processed data bucket; calculate the elements of the second key vector and the elements of the ciphertext of the data index according to the corresponding elements of the noise vector and the associated values. S64. Repeat S63 until the data index that meets the matching conditions of all bucket identifiers is taken out from the data bucket to be processed and put into the data bucket that has been processed. S65. Calculate the elements of the second key vector and the elements of the ciphertext for all remaining data indices in the data bucket to be processed, based on the noise vector and the association value. S66. The set of elements of the second key vector with all data indexes is obtained as the second key vector; the set of elements of the ciphertext with all data indexes is obtained as the ciphertext.

7. A multi-data concealment query system, characterized in that, include: The matrix construction unit is used by the data side to construct the first correlation matrix H and the correlation value Δ; and by the query side to construct the second correlation matrix H. ′ The sum and difference matrix T, satisfying H ′ =T·Δ+H; The blinding and obfuscation unit is used by the query party to blind and obfuscate the query index vector h(x) of the query index set to obtain a blind and obfuscated index vector c, and send the blind and obfuscated index vector c to the data party; The first calculation unit is used by the querying party to calculate based on the second correlation matrix H. ′ The first key vector is obtained by calculating the blinded confusion index vector c; A bucket identifier construction unit is used by the querying party to construct a bucket identifier set based on the query index set and a secure hash function, and then send the bucket identifier set to the data party. The second calculation unit is used by the data side to calculate the noise vector based on the first correlation matrix H and the blinding confusion index vector c; The encryption unit is used by the data provider to calculate the second key vector and ciphertext of the entire data index based on the noise vector, the correlation value Δ, and the bucket identifier set; the data provider randomly selects an index label to perform a salted hash index on the second key vector to obtain the second key index; the data provider sends the second key index, the corresponding ciphertext, and the index label to the query provider. The decryption unit is used by the querying party to perform salted hash indexing on the first key vector based on the index label to obtain the first key index; the querying party retrieves the target ciphertext corresponding to the first key index based on the first key index and the second key index; and the querying party decrypts the target ciphertext based on the first key vector to obtain the query result.

8. The system according to claim 7, characterized in that, The difference matrix T is obtained through the following method: The querying party randomly selects a matrix B with diagonal elements of 1 and the remaining elements of random 0 or 1, and concatenates matrix B with the zero matrix B0 to generate a concatenated matrix M, wherein matrix B is an invertible matrix; The querying party randomly selects a permutation matrix Π, and then obfuscates the spliced ​​matrix M based on the permutation matrix Π to obtain the difference matrix T.

9. The system of claim 7, wherein, The query party constructs a second incidence matrix H ′ comprising: The querying party and the data party collaboratively invoke an unintentional transmission protocol, using the data party's first correlation matrix H and correlation value Δ, and the querying party's difference matrix T as inputs to the protocol, so that the querying party receives the protocol's output second correlation matrix H. ′ .

10. The system of claim 8, wherein, The blinding obfuscation unit includes: Generate sub-units, which are used by the querying party to generate a query index vector h(x) from the query index set according to a secure hash function; The blinding subunit is used by the query party to blind the query index vector h(x) based on the inverse matrix of matrix B, so as to obtain the blinded index vector. The splicing subunit is used by the query party to select a random vector and splice the blinded index vector and the random vector to generate a spliced ​​vector; The obfuscation subunit is used by the query party to obfuscate the spliced ​​vector according to the permutation matrix Π to obtain a blinded obfuscated index vector c, and then send the blinded obfuscated index vector to the data party.

Images