A DID-based authorized private information retrieval method

Abstract

The application belongs to the technical field of privacy protection, and provides a DID-based authorized private information retrieval method, which comprises the following steps: a receiver and a possessor register to generate a DID and a DID document and upload them to a blockchain; the possessor encrypts a file through a symmetric key to obtain ciphertext and uploads the ciphertext to a database server; the receiver sends file information to the possessor; the possessor signs file attribute information of the corresponding file to obtain a signature value, encapsulates the signature value and the DID of the possessor into a verifiable credential, and sends the verifiable credential to the receiver; the receiver analyzes the verifiable credential to obtain the signature value, and then performs an OSBE protocol on the signature value among the receiver, the database server and the possessor; the receiver obtains the symmetric key, the database server sends the ciphertext to the receiver, and the receiver decrypts the ciphertext through the symmetric key to obtain the file. The application not only meets the query privacy requirement, but also provides a data retrieval scheme in which access control and data subject authorization mechanism are unified.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of privacy protection, and provides a DID-based authorized private information retrieval method. BACKGROUND

[0002] In the current wave of digitization sweeping the world, user privacy protection has become one of the core demands in the field of information interaction. When users use information retrieval services to carry out various activities, whether it is to query medical records, trace financial transactions, or other application scenarios, the retrieval behavior itself usually contains sensitive attributes. During the process of sending a query request to the server, the specific content of the retrieval may be captured by the server, thereby causing the risk of sensitive information leakage. Especially in highly sensitive fields such as medical diagnosis and asset allocation, the retrieval behavior is likely to become a mapping carrier of user identity characteristics, and once the information is leaked, it will have a serious impact on the user.

[0003] To protect user query privacy, a private information retrieval (PIR) protocol has emerged. In actual application, systems using this protocol often need to combine different levels of access control and data subject authorization mechanisms. However, the traditional access control mode relies on query content, and the server implements access control by determining whether the user has the right to query the record. This approach directly conflicts with the query content privacy property emphasized by the PIR protocol, and cannot effectively protect user privacy. At the same time, in a distributed environment, multiple participants must obtain data subject authorization when sharing data, which makes identity management extremely complex. If the server collects user identity information to promote the identity management process, it will also cause new risks of identity privacy leakage.

[0004] Although the database server using the private information retrieval protocol can better protect the user's query privacy, in reality, the database server always needs to adapt to different levels of access control and efficient identity management mechanisms. Currently, in the practice of realizing multi-party data sharing in a distributed environment by using a private information retrieval protocol, there are still many problems to be solved. On the one hand, the traditional access control mechanism cannot be organically integrated with the private information retrieval protocol, and the existing solution based on zero-knowledge proof has the disadvantage of excessive computational overhead, which seriously affects the system efficiency; on the other hand, the data subject authorization requirement in a distributed environment causes great difficulties in identity management, and the server collecting user identity information undoubtedly lays the foundation for identity privacy leakage. SUMMARY

[0005] To solve the above technical problems, the application provides a DID-based authorized private information retrieval method, which can not only meet the query privacy requirements of the PIR protocol, but also provide an organic and unified data retrieval solution for access control and data subject authorization mechanisms.

[0006] The technical scheme of the present application comprises:

[0007] The receiver and the owner register to generate a DID and a DID document through a DID server, and then upload the DID and the DID document to a blockchain.

[0008] The owner encrypts the file through a symmetric key to obtain ciphertext and uploads the ciphertext to a database server.

[0009] The receiver sends file information to be retrieved to the owner, the owner signs file attribute information of the corresponding file as a public message to obtain a signature value, then encapsulates the signature value and the DID of the owner into a verifiable credential, and sends the verifiable credential to the receiver.

[0010] The receiver verifies the identity of the owner and the legality of the verifiable credential through a DID server, and after verification, the receiver parses the verifiable credential to obtain the signature value.

[0011] The database server verifies the identity of the receiver through a DID server, and after verification, performs an OSBE protocol on the signature value among the receiver, the database server and the owner, and the receiver obtains a symmetric key.

[0012] The database server sends the ciphertext to the receiver, and the receiver decrypts the ciphertext through the symmetric key to obtain the file.

[0013] Further, the method for performing the OSBE protocol is:

[0014] The receiver calculates X from the signature value, and then sends X to the database server. The database server calculates Z and Ks from X, and then sends Ks to the owner. The owner calculates C from Ks, and then sends C to the database server. The database server sends Z and C to the receiver. The receiver calculates ks from Z and a key derivation function, and then decrypts C from ks to obtain the final symmetric key. X, Z, Ks, ks and C are all process parameters.

[0015] Further, before DID registration, the owner and the receiver generate a key pair for the owner to generate algorithm public parameters , a Schnorr key pair and a symmetric encryption key .

[0016] Further, before the DID and the DID document are uploaded to the blockchain, the DID document is signed through a private key of the DID.

[0017] Further, the method for obtaining the signature value is: selecting a random number k, and then calculating e and s to obtain the signature value , the formula is:

[0018] ,

[0019] ,

[0020] ,

[0021] Wherein M represents file attribute information.

[0022] Further, the signature value and the DID of the owner are encapsulated and signed by the private key of to obtain a verifiable credential.

[0023] Further, the ciphertext is transmitted between the receiver and the database server through the PIR protocol.

[0024] The technical scheme provided by the embodiment of the application has the following advantages compared with the prior art:

[0025] The receiver and the owner register to generate a DID and a DID document through a DID server, and then upload the DID and the DID document to a blockchain, the owner encrypts a file through a symmetric key to obtain ciphertext and uploads the ciphertext to a database server, the receiver sends file information to be searched to the owner, the owner signs a symmetric key corresponding to the file as a public message to obtain a signature value, then encapsulates the signature value, the file information and the DID of the owner into a verifiable credential, and sends the verifiable credential to the receiver, the receiver verifies the identity of the owner and the legality of the verifiable credential through the DID server, after verification, the receiver parses the verifiable credential to obtain the signature value, the database server verifies the identity of the receiver through the DID server, after verification, the OSBE protocol is executed on the signature value among the receiver, the database server and the owner, the receiver obtains the symmetric key, the database server sends the ciphertext to the receiver, and the receiver decrypts the ciphertext through the symmetric key to obtain the file. Compared with the prior art, the application can not only meet the query privacy demand of the PIR protocol, but also provide an organic unified data retrieval scheme of access control and data subject authorization mechanism.

[0026] Other advantages, objects, and features of the application will be partly embodied by the following description, and partly understood by those skilled in the art through research and practice of the application. BRIEF DESCRIPTION OF DRAWINGS

[0027] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed in the embodiments or prior art description. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained from these drawings without creative labor.

[0028] Figure 1 The overall flowchart of one embodiment of the present application.

[0029] Figure 2 The OSBE protocol flowchart for one embodiment of the present application.

[0030] Figure 3 The authorization stage calculation overhead comparison chart for one embodiment of the present application. DETAILED DESCRIPTION

[0031] The specific embodiments of the present application will be described in detail below with reference to the drawings, but it should be understood that the protection scope of the present application is not limited by the specific embodiments.

[0032] In the description of the present application, it should be understood that the terms "center", "longitudinal", "transverse", "length", "width", "thickness", "upper", "lower", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", "axial", "radial", "circumferential" and the like indicate the orientation or positional relationship based on the orientation or positional relationship shown in the drawings, and are only for the convenience of describing the technical solutions of the present application and simplifying the description, and do not indicate or imply that the devices or elements referred to must have a particular orientation, be constructed and operated in a particular orientation, and therefore cannot be understood as a limitation of the present application.

[0033] Glossary:

[0034] 1. Oblivious electronic envelope (OSBE)

[0035] The signature-based oblivious electronic envelope OSBE protocol is usually applied in the field of anonymous communication, and its system parameters depend on the selection of different signature schemes, such as Schnorr-OSBE scheme, BLISS-OSBE, etc. The OSBE model is composed of a sender S and receivers R1 and R2, R1 has a signature Sigu of the CA public message u, and R2 does not. OSBE allows authorized receiver R1 to correctly access data, while sender S does not know whether receiver R1 has access rights.

[0036] OSBE system parameter definition: signature scheme Sig and its corresponding key pair (pk, sk), message to be signed u, signature value Sigu of u, message to be transmitted. Where Sigu is only disclosed to R1, p is only disclosed to S.

[0037] After the system parameters are established, the OSBE scheme includes the following two stages:

[0038] a) Interactive stage: the sender S, without knowing the identity information of R1 and R2, optionally selects an R as the receiver, and executes the interactive protocol.

[0039] b) Open the envelope: after the information interaction is completed, if R is R1, it can correctly obtain the message because it has the signature Sigu of CA, and if R is R2, it cannot correctly obtain the message.

[0040] 2. Decentralized identifier (DID)

[0041] DID is a globally unique string that represents a DID subject, with the characteristics of uniqueness, resolvability, and verifiability. Compared with the traditional centralized identity management mode, DID does not need to rely on third-party institutions, and realizes the decentralized management of user identity information. Each DID identifier corresponds to a DID document, which is publicly stored in the blockchain.

[0042] The DID identifier is composed of three parts, as follows:

[0043]

[0044] Among them, did represents the logo of DID identifier, dobse represents the DID method, which is used to specify the parsing and management method of DID, and exampleIdString represents the globally unique specific identification string. Compared with the traditional identity management mode, the decentralized identity management implemented by DID has the following advantages:

[0045] a) Privacy protection: in the decentralized identity management, users can control the personal information they share, only need to share the necessary personal information, and the rest can be kept secret, so as to protect the privacy of users.

[0046] b) Portable identity authentication: the decentralized identity management eliminates the cumbersome multi-factor authentication protocol, realizes passwordless authentication, and enables users to more conveniently carry out digital services.

[0047] c) Data sharing: DID identity information can be associated with data to realize the sharing of data between multiple participants in a decentralized environment through authorization.

[0048] ​In the description of the embodiments of the application, the meaning of "a plurality of" refers to two or more, unless otherwise specified.

[0049] In the description of the embodiments of the application, the parameter configuration is as shown in Table 1:

[0050] Table 1: System parameter table

[0051]

[0052] The application provides a DID-based authorized private information retrieval method, comprising:

[0053] Step one, the receiver and the owner register to generate DID and DID document through the DID server, and then upload the DID and DID document to the blockchain.

[0054] Specifically, before DID registration, : generate a DID document signature verification required key pair for the data owner algorithm public parameters and Schnorr key pair , symmetric encryption key .

[0055] The principle of SM2 key pair generation is shown in Table 2:

[0056] Table 2: SM2 key pair generation

[0057]

[0058] The principle of Schnorr public parameter and key pair generation is shown in Table 3:

[0059] Table 3: Schnorr public parameter and key pair generation

[0060]

[0061] In the embodiments provided by the application, : the owner and the receiver generate their corresponding DID and DID document through the DID server by providing personal identity information and their own public key, and sign the DID document with their own private key, and then the DID server calls the smart contract to store it to the blockchain. That is, the DID and DID document are uploaded to the blockchain before the private key of the signs the DID document. The specific DID registration method is shown in Table 4:

[0062] Table 4: DID registration

[0063]

[0064] Step two, the owner encrypts the file W by symmetric key to get ciphertext C and uploads it to the database server, as shown in Table 5.

[0065] Table 5: File upload

[0066]

[0067] Step three, the receiver sends the file attribute information to be retrieved to the owner, and the owner signs the file attribute information of the corresponding file as a public message to get a signature value, then encapsulates the signature value and the DID of the owner into a verifiable credential and sends it to the receiver.

[0068] Specifically: : The data receiver sends the file attribute information Attrs to the data owner and requests to obtain the authorization of the corresponding file, and the data owner signs the file attribute information to get the corresponding signature value , and encapsulates it and the DID of the owner into a verifiable credential (i.e. VC) as an authorization certificate and sends it to the file receiver.

[0069] The specific process is shown in Table 6:

[0070] Table 6: Obtain authorization

[0071]

[0072] Step four, the receiver verifies the identity of the owner and the legality of the verifiable credential through the DID server, and after verification, the receiver parses the verifiable credential to get the signature value.

[0073] Specifically, the file receiver sends the verifiable credential VC to the database server, and after receiving the verifiable credential VC, the database server verifies the signature legality of the verifiable credential VC and the identity of the data owner through the DID server. After identity verification, the receiver parses the signature value .

[0074] Step five, the database server verifies the identity of the receiver through the DID server, and after verification, the OSBE protocol is executed between the receiver, the database server and the owner on the signature value, and the receiver obtains the symmetric key.

[0075] Specifically, the receiver calculates X from the signature value, then sends X to the database server, the database server calculates Z and Ks from X, then sends Ks to the owner, the owner calculates C from Ks, then sends C to the database server, the database server sends Z and C to the receiver, the receiver calculates ks from Z and the key derivation function, and decrypts C to obtain the final symmetric key by using ks, wherein X, Z, Ks, ks and C are all process parameters, as shown in the formula (1). Figure 2

[0076] The specific algorithm is shown in Table 7.

[0077] Table 7: OSBE authorization interaction algorithm

[0078]

[0079] Step six, the database server sends the ciphertext to the receiver, and the receiver decrypts the ciphertext by using the symmetric key to obtain the file.

[0080] Specifically, the PIR protocol is executed between the data receiver and the database server, and the receiver finally obtains the ciphertext as shown in Table 8.

[0081] Table 8: Data retrieval phase

[0082]

[0083] Specifically, the receiver decrypts the ciphertext by using the symmetric key to obtain the file as shown in Table 9.

[0084] Table 9: Data recovery phase

[0085]

[0086] The application proposes an access control framework applied to a private information retrieval protocol, and experimentally evaluates the performance of the framework in a single-server PIR protocol, solves the identity management and privacy problem when multiple participants share data in a distributed environment by introducing DID, does not expose the identity privacy of users while sharing data, and solves the problem that the data subject authorization cannot be realized when multiple participants share data in the current PIR protocol, proposes an authorization algorithm combining DID and OSBE, and ensures that the file receiver has obtained the authorization of the data subject before private information retrieval.

[0087] (1) Simplify the identity management and enhance the privacy protection in the distributed data sharing scenario:

[0088] ​By combining decentralized identity (DID), user identity registration no longer relies on third parties, and identity information is distributed in the blockchain or peer-to-peer network, and users control identity data through private keys. Even if part of the node fails, the identity system can still run, avoiding the single-point vulnerability of centralized institutions. Return the control of identity to the user, while improving security, privacy and efficiency through encryption algorithms and distributed architecture. At the same time, anonymity is realized in the process of information retrieval, and attackers cannot link to the real identity of the user through the DID identifier.

[0089] The time overhead required in the key phase of user identity registration and verification is shown in Table 10:

[0090] Table 10: Time overhead of identity registration and verification phase

[0091]

[0092] (2) The performance of the private information retrieval authorization phase is improved:

[0093] In the file authorization phase, the Dobse scheme is compared with the ASKPIR scheme. Due to the difference in the PIR scheme used, only the calculation overhead of the file authorization phase under different message entries is concerned, and a simulation experiment is performed, as shown in Table 11, the number of messages is 200, 400, 600, 800, 1000, 1200, and the calculation time of each scheme is recorded, in (ms). From the experimental results, it can be seen that the authorization algorithm is superior to the ASKPIR scheme in terms of calculation overhead. Figure 3

[0094] It should be noted that in this paper, the term "includes", "contains" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. Without more limitations, the element defined by the statement "includes a" does not exclude the presence of another identical element in the process, method, article or device including the element.

[0095] Although the embodiments of the present application have been disclosed as above, they are not limited to the applications listed in the specification and embodiments. It can be fully applied to various fields suitable for the present application. Additional modifications can be easily implemented by those skilled in the art. Therefore, the present application is not limited to specific details and examples shown and described herein, without departing from the general concept defined by the claims and their equivalent scope.​

Claims

1. A method for retrieving authorized private information based on DID, characterized in that, include: The recipient and owner register with the DID server to generate a DID and a DID document, and then upload the DID and the DID document to the blockchain; The owner encrypts the file using a symmetric key to obtain ciphertext and uploads it to the database server; The recipient sends the file information to be retrieved to the owner. The owner signs the file attribute information of the corresponding file as a public message to obtain a signature value. Then, the signature value and the owner's DID are encapsulated into a verifiable credential and sent to the recipient. The recipient verifies the owner's identity and the legitimacy of the verifiable credentials through the DID server. After successful verification, the recipient parses the verifiable credentials to obtain the signature value. The database server verifies the recipient's identity through the DID server. After successful verification, the OSBE protocol is executed on the signature value between the recipient, the database server, and the owner, and the recipient obtains the symmetric key. The database server sends the ciphertext to the recipient, who then decrypts the ciphertext using a symmetric key to obtain the file. The method for executing the OSBE protocol is as follows: The receiver calculates X from the signature value and then sends X to the database server; After the database server calculates Z and Ks using X, it sends Ks to the owner. The owner calculates C using Ks and then sends C to the database server; The database server then sends Z and C to the recipient; The receiver calculates ks based on Z and the key derivation function, and then decrypts C using ks to obtain the final symmetric key; X, Z, Ks, ks, and C are all process parameters.

2. The authorized private information retrieval method based on DID as described in claim 1, characterized in that, Before DID registration, the owner and recipient generate the necessary signature verification documents for the DID. key pair Generate for the owner Algorithm common parameters Schnorr key pair and symmetric encryption key .

3. The authorized private information retrieval method based on DID as described in claim 2, characterized in that, Before DID and DID documents are uploaded to the blockchain, through... The private key is used to sign the DID document.

4. The authorized private information retrieval method based on DID as described in claim 3, characterized in that, The method to obtain the signature value is as follows: Choose a random number k, then calculate e and s to obtain the signature value. The formula is: ， ， ， Where M represents file attribute information. This is a hash function.

5. The authorized private information retrieval method based on DID as described in claim 3, characterized in that, After encapsulating the signature value and the owner's DID, it is passed through... The private key is used to sign, resulting in a verifiable credential.

6. The authorized private information retrieval method based on DID as described in claim 1, characterized in that, The receiver and the database server transmit encrypted data via the PIR protocol.

Images