Privacy protection multi-hop constraint shortest distance query method on encrypted graph

Abstract

The invention discloses a privacy protection multi-hop constraint shortest distance query method on an encrypted graph, which is applied to a system comprising a graph data owner, a cloud server, a computing service provider and at least one user. The method comprises a secret key generation process, a graph encryption process, a user authorization process, a query token generation process, a multi-hop constraint shortest distance query process and a user decryption process. The method is suitable for scenes such as mobile equipment where lightweight users complete graph data query by means of cloud computing resources, and can be widely applied to path planning and data association analysis in the fields of communication networks, social networks, road networks, bioinformatics, logistics and the like.

Description

Technical Field

[0001] This invention relates to the field of graph data privacy protection and query technology, and in particular to a privacy-preserving multi-hop constraint shortest distance query method on encrypted graphs. Background Technology

[0002] With the rapid development of mobile computing, graph data, as a core data model for describing complex entity relationships, has been widely used in many fields such as communication networks, social networks, and road networks. For example, in mobile communication networks, user subgraph features can be extracted from graph data to achieve network event supervision and classification and abnormal device identification; in social networks, dynamic relational networks can be constructed with nodes representing users and edges representing interaction relationships, and graph mining algorithms can be combined to achieve multi-dimensional practical value; in road networks, roads can be modeled as attribute graphs to help traffic estimation systems accurately analyze traffic conditions.

[0003] Shortest distance query is a fundamental operation in graph computation, while constrained shortest distance query, as a special type, requires calculating the shortest distance between two vertices while simultaneously filtering paths that meet constraints such as cost and time, thus having a wider range of applications. For example, data transmission in communication networks needs to meet constraints such as bandwidth, latency, and packet loss rate, while route planning in the logistics field needs to meet constraints such as travel time, cost budget, and traffic rules.

[0004] However, as graph data continues to grow in scale, lightweight users' mobile devices are limited by storage and computing power, making it difficult to directly handle graph data query needs. Outsourcing graph data to cloud servers has become an ideal solution, but this approach carries the risk of privacy leaks. Existing privacy protection solutions have significant shortcomings: most solutions only support shortest distance queries with 2-hop constraints, which cannot meet the multi-hop query requirements of scenarios such as protein-protein interaction network analysis in bioinformatics and multi-hop data transmission in large-scale communication networks; a few solutions that support arbitrary-hop queries (such as AHCSD) require pre-calculating and encrypting the shortest distance between any two vertices with any number of hops. When the graph is large, graph owners with limited resources cannot afford the computational costs, making it unsuitable for lightweight users.

[0005] Therefore, designing a method suitable for lightweight users and supporting shortest distance queries with arbitrary jump constraints on encrypted graphs has become an urgent technical problem to be solved. Summary of the Invention

[0006] To address the issue that existing privacy-preserving graph query schemes cannot simultaneously meet the needs of multi-hop queries and adaptability to lightweight users, this invention provides a privacy-preserving multi-hop constrained shortest distance query system on encrypted graphs. While ensuring the security of privacy information such as graph topology and query data, it enables multi-hop constrained shortest distance queries for lightweight users, while improving the efficiency of graph encryption and query stages.

[0007] The method is applied to a system comprising a graph data owner, a cloud server, a computing service provider, and at least one user. The cloud server, user, and graph data owner communicate with each other in pairs. The computing service provider communicates with the cloud server and the graph data owner. The method includes the following six steps:

[0008] Key generation process: The graph data owner uses the threshold Paillier encryption system to generate the keys and public-private key pairs required by all parties, and splits the private key to distribute to the cloud server and computing service provider;

[0009] Graph encryption process: The graph data owner constructs the adjacency matrix of the graph, sets different numerical ranges for matrix elements with and without edges to distinguish between real and false paths; generates a one-dimensional array to store all vertices and encrypts it to obtain vertex vectors; then randomly generates a key matrix, calculates the encryption matrix and ensures that the matrix components meet specific size requirements; finally, sends the vertex vectors, encryption matrix and public key to the cloud server, and sends the key matrix and public key to the computing service provider.

[0010] User authorization process: The user sends an authorization request to the graph data owner; after the graph data owner approves the request, an authorization certificate containing authorization information and its signature is generated and sent to the cloud server via a secure channel. At the same time, the authorization certificate and the pseudo-random function key are sent to the user.

[0011] Query token generation process: For shortest distance query requests with multi-hop constraints including hop count limit, source vertex, target vertex, cost constraint threshold, and time constraint threshold, the user first calculates the encrypted identifiers of the source vertex and target vertex using a pseudo-random function key, then encrypts the cost constraint threshold and time constraint threshold using the threshold Paillier encryption algorithm to obtain ciphertext, and finally combines the hop count limit, encrypted identifier, cost constraint threshold, and time constraint threshold ciphertext to generate a query token and send it to the cloud server, providing privacy-protected identifiers and constraints for the query request;

[0012] The multi-hop constrained shortest distance query process consists of two stages: offline pre-computation and online query response. In the offline stage, the computing service provider encrypts the key matrix and sends it to the cloud server. The cloud server encrypts the key matrix and calculates the encrypted form of the original adjacency matrix. Then, it recursively calculates the multi-hop matrix power matrix in collaboration with the computing service provider, using additive homomorphism for iterative calculation and calling the secure minimum value protocol to process the distance ciphertext. In the online stage, the cloud server first verifies the user's authorization certificate. After successful verification, it extracts the elements of the pre-computed matrix and, in collaboration with the computing service provider, calls the secure shared comparison protocol to determine the constraint satisfaction. For elements that satisfy the constraints, the ciphertext is refreshed and stored. Finally, the secure shared minimum value protocol is called to calculate the tuple containing the random number and the encrypted shortest distance and returns it to the user, thus achieving privacy-preserving computation of the multi-hop constrained shortest distance.

[0013] User decryption process: The user decrypts the received encrypted shortest distance tuple using their own private key; then, the noise effect is eliminated by rounding to obtain the candidate multi-hop constraint shortest distance; finally, based on the relationship between the candidate distance and the preset threshold, it is determined whether there is a multi-hop path between the source vertex and the target vertex that satisfies the constraint. If so, the candidate distance is the final multi-hop constraint shortest distance, thus completing the decryption and validity determination of the query result.

[0014] The beneficial effects of this invention are as follows:

[0015] 1. Supports multi-hop queries, breaking through existing technical limitations: This invention adds virtual edge protection graph topology information and combines blind detection mechanism to realize multi-hop constraint shortest distance calculation, breaking through the limitation of existing solutions that only support 2-hop queries. It can meet the multi-hop query needs of scenarios such as bioinformatics and large-scale communication networks, and has a wider range of applications.

[0016] 2. Adaptable to lightweight users, reducing computation and storage costs: The graph encryption stage uses key matrix encryption instead of traditional encryption algorithms, avoiding a large number of modular exponentiation operations, significantly reducing the computational overhead for lightweight users (such as mobile devices), and adapting to user scenarios with limited resources; at the same time, the matrix exponentiation is pre-calculated and reused in the offline stage, and only the pre-calculated results need to be extracted in the online stage to perform constraint judgment and minimum value calculation, which speeds up the query efficiency of cloud servers.

[0017] 3. Strong privacy protection, meeting CQA2 security: Threshold Paillier encryption protects private information such as graph topology, distance, cost, and time. Combined with protocols such as secure sharing comparison and secure minimum value, it ensures that cloud servers and computing service providers cannot obtain additional private data. By constructing a simulator to rigorously prove that the scheme meets CQA2 security, it can resist adaptive selection query attacks and has stronger privacy protection capabilities.

[0018] 4. High efficiency and strong practicality: Experimental results show that the efficiency of the graph encryption stage of this invention is 178 times higher than that of the most advanced existing schemes; in the 2-hop query scenario, when the number of edges is 400, the query efficiency is improved by 8.625 times; multi-hop queries (such as 4-hop queries) only increase the time consumption by a few milliseconds compared to 2-hop queries, and the decryption stage takes only 0.06ms, which is far lower than the 0.29ms of the existing schemes. The overall efficiency is high and it has practical application value.

[0019] This invention is applicable to scenarios where lightweight users, such as mobile devices, use cloud computing resources to complete graph data queries. It can be widely applied to path planning and data association analysis in fields such as communication networks, social networks, road networks, bioinformatics, and logistics. Attached Figure Description

[0020] Figure 1 is a model diagram of the system used in this invention.

[0021] Figure 2 is a flowchart of the present invention. Detailed Implementation

[0022] The system structure used in this invention will be described below: Figure 1 As shown, the system model has four entities: Graph Data Owner (GO), Cloud Server (CS), Compute Service Provider (CSP), and User (QU). A detailed description of each entity is as follows:

[0023] 1) Graph Data Owner (GO): Owns a private graph G=(V,E). Due to limitations in data storage costs and computing resources, GO wishes to outsource graph G to a cloud server CS, which will provide storage services and support subsequent graph query calculations. Here, V is the set of vertices, and E is the set of edges.

[0024] 2) Cloud Server (CS): Cloud servers provide powerful computing and storage capabilities, and can store outsourced data and respond to query requests.

[0025] 3) Computing Service Provider (CSP): A cloud server with powerful computing capabilities. The computing service provider works with the cloud server to complete the query calculation.

[0026] 4) User (QU): First, obtain query permissions from the data owner GO, and then submit a query request to the cloud server to obtain the query results of the outsourced graph data.

[0027] Table 1 lists the commonly used symbols in this invention and their descriptions for easy reading.

[0028] Table 1: Symbols and their meanings

[0029] The privacy-preserving multi-hop constraint shortest distance query system on encrypted graphs of the present invention is applied to a system that includes four types of entities: graph data owner (GO), cloud server (CS), computing service provider (CSP), and user (QU). The cloud server, user, and graph data owner are connected to each other in pairs, and the computing service provider is connected to the cloud server and graph data owner in pairs. Figure 1 It illustrates the interaction relationships and data flow of four types of entities: Graph Data Owner (GO), Cloud Server (CS), Computing Service Provider (CSP), and User (QU).

[0030] like Figure 2 As shown, this invention specifically includes a key generation process, a graph encryption process, a user authorization process, a query token generation process, a multi-hop constraint shortest distance query process, and a user decryption process. It mainly includes the following steps:

[0031] I. Key Generation Process S1.1: The graph data owner (GO) inputs the security parameter τ1 and generates a pseudo-random function (PRF) key K; executes the key generation algorithm KeyGen of the threshold Paillier cryptosystem to generate a public key pk and a private key sk; publishes the public key pk, and calls the key splitting algorithm KeyS to split the private key sk into partial private keys. and They are distributed to cloud servers (CS) and computing service providers (CSP), respectively.

[0032] S1.2: QU inputs the security parameter τ2 and generates its own public-private key pair using the KeyGen algorithm. , ), public key Public, private key reserve.

[0033] II. Graph Encryption Process S2.1: The graph data owner (GO) constructs an adjacency matrix A for the graph G=(V,E), where V is the set of vertices and E is the set of edges. Vertices and There exists an edge between A and A, let the elements of A be... =( , , ,in For distance, For cost, For time, and , , ( (For the threshold Paillier cryptosystem public key parameter); if no edge exists, let , , To distinguish false paths, virtual edges are added to prevent the leakage of graph topology information. During the query process, a blind discrimination mechanism can be used to calculate the shortest distance with multi-hop constraints without knowing any topology information, overcoming the limitation of existing schemes that can only calculate the shortest distance with two-hop constraints.

[0034] S2.2: Generate a one-dimensional array V = (v1, ..., vn) storing all vertices in the graph, and use a pseudo-random function F and a key K for each vertex. Encryption yields vertex vector H. .

[0035] S2.3: Randomly generate a key matrix B, calculate the encryption matrix Pn ×n = An ×n + Bn ×n, and ensure that each component p of P... ij > Send the vertex vector H and the encryption matrix Pn × n to the cloud server (CS), and send the key matrix Bn × n to the computing service provider (CSP).

[0036] III. User Authorization Process S3.1: The user (QU) sends an authorization request (ID) to the graph data owner (GO). U (, Time, Number), where ID U This represents user identity information, Time represents the query time range, and Number represents the maximum number of queries.

[0037] S3.2: If the graph data owner agrees to the authorization, generate an authorization certificate CER. U = <cer=(GO, ID U (Time, Number), sig(cer, sk)> transmit CER through a secure channel U Send to the cloud server (CS), and simultaneously send CER U The pseudo-random function key K is sent to the user (QU).

[0038] IV. Query Token Generation Process User (QU) requests shortest distance query for multi-hop constraints. (k is the upper limit of the number of hops, s1 is the source vertex, s2 is the target vertex, θ1 is the cost constraint threshold, θ2 is the time constraint threshold, and 0 < θ1, θ2 < ... ), perform the following operations:

[0039] S4.1: Use the pseudo-random function key K to calculate the encrypted identifiers Hs1 = F(K, s1) and Hs2 = F(K, s2) corresponding to the source vertex s1 and the target vertex s2.

[0040] S4.2: The cost constraint threshold θ1 and time constraint threshold θ2 are encrypted using the threshold Paillier encryption algorithm to obtain ciphertext Θ1 = [θ1], Θ2 = [θ2].

[0041] S4.4: Combine to generate query token Qs1 , s2 = (k, hs1 , hs2, Θ1, Θ2 ), and send it to the cloud server (CS).

[0042] V. Shortest Distance Query Process with Multi-Hop Constraints (k-CSD)

[0043] This process is divided into an offline phase and an online phase, as detailed below: Offline phase (pre-computation) S5.11: The Computational Service Provider (CSP) uses the public key pk to encrypt the key matrix B, obtaining... It is sent to the cloud server (CS).

[0044] S5.12: The cloud server (CS) uses the public key pk to encrypt the encryption matrix P, obtaining... Through calculation = The encrypted form of the original adjacency matrix A is obtained. .

[0045] S5.13: Cloud servers (CS) and compute service providers (CSPs) collaborate to calculate matrix power matrices recursively. (here (The power of the matrix representing the k-th jump) is: for any elements in ,have = ( , ,in Representing the distance ciphertext, cost ciphertext, and time ciphertext respectively, the Paillier encryption algorithm is used to iteratively calculate the following logic:

[0046]

[0047]

[0048] The results of each iteration are stored in array P. After each iteration, the Secure Minimum (SMin) protocol is invoked to calculate the minimum distance to the ciphertext. Store the tuple corresponding to the minimum distance as a new tuple. This is used for subsequent construction of the target matrix. .

[0049] As mentioned earlier, the SSMin protocol introduces noise. However, the Paillier encryption algorithm does not support multiplicative homomorphism, so the noise cannot be eliminated in the ciphertext state. Therefore, when calculating the minimum value, the SMin protocol is used instead of the SSMin protocol.

[0050] The calculation results in this stage provide a data foundation for online queries. If the graph data remains unchanged, this data can be reused, which can significantly reduce the computational load in the online stage and improve the overall query efficiency and response performance of the system.

[0051] Online phase (responding to user queries) S5.21: Cloud Server (CS) Authenticator User (QU) Authorization Certificate (CER) U If the verification passes, proceed according to the query token Qs1 , s2 hs1 and hs2 in the pre-computed matrix Extract the corresponding element from [A]ᵏ. .

[0052] S5.22: For each element The cloud server (CS) and the compute service provider (CSP) collaboratively invoke the Secure Shared Comparison (SSC) protocol to determine whether cost constraints and time constraints are met.

[0053] Execute formula , to obtain (ω 11 ,ω 12 ) where CS obtains ω 11 CSP obtains ω 12 ; ,

[0054] Execute formula ( ), to obtain (ω 21 ,ω 22 ), where CS obtains ω 21 CSP obtains ω 22 ; ,

[0055] If ω 11 ⊕ ω 12 =0 and ω 21 ⊕ω 22 =0 indicates that the element satisfies the cost and time constraints.

[0056] To ensure accurate constraint value determination while protecting privacy, we employed a blind filtering method. Specifically, CS obtains... , Then, first initialize an index table of size 4. Randomly select parameters , , ( ), and encrypt them separately to obtain , , Then, populate the index table according to the following conditions. :

[0057] R 2 (ω11 || ~ω21 ) R 2 (ω11 ||ω21 ) R 2 (~ω11 ||ω21 ) R The parameter meaning of 2 (~ω11 || ~ω21) is explained as follows: ω11 || ~ω21 means concatenating ω11 and ~ω21 to generate a new bit string, which is then used as the input of F2(). 2 (ω11 || ~ω21 ) represents the position of index F2 (~ω11 ||ω21 ) in index table R2. Similarly, the meanings of the other parameters can be obtained. Among them, "~" represents the inversion operation, which sends index table R2 and hash function F2() to CSP.

[0058] Therefore R 2 (ω11 ||ω21 ) 、R 2 (~ω11 ||ω21 ) 、R 2 (ω11 || ~ω21 ), R 2 (~ω11 || ~ω21 ) represent the positions in index table R2 with indices F2 (ω11 ||ω21 ) , F2 (~ω11 ||ω21 ) , F2 (ω11 ||~ω21 ) , F2 (~ω11 || ~ω21 ) , respectively.

[0059] S5.23: The computing service provider (CSP) determines the value of its bit ω based on its own bit value. 12 ,ω 22 Calculate index F2 (ω12 ||ω22), and retrieve the element from index table R2. ( This represents the value retrieved from index table R2 (a new symbol is used here to distinguish it from the symbol used when filling the index table above), which is then refreshed using the ciphertext refresh algorithm (CR). Send it to the cloud server (CS), and the CS will... Store in array D[i], .

[0060] S5.24: The cloud server (CS) and the compute service provider (CSP) invoke the Secure Shared Minimum Protocol (SSMin) to perform minimum value calculation on array D, obtaining the tuple ( ), and use the user's public key Encrypt it to obtain ( The encrypted tuple is returned to the user (QU). The relationship satisfies ⌊ / = ,in =γ, =[γ·d min +γ ρ ], The shortest distance to satisfy the constraints. γ is greater than γ ρ Random numbers.

[0061] VI. User Decryption Process

[0062] S6.1: The user (QU) uses their own private key right( Decryption yields ( During the decryption process, the Chinese Remainder Theorem can be used to accelerate the process and reduce computational overhead.

[0063] S6.2: Calculate dmin =⌊ / ".because =γ ·dmin + γρ , And γ >> γρ, therefore ⌊ / "⇔ ⌊(γ · dmin + γρ ) / γ"⇔ .

[0064] S6.3: Determine if the shortest distance for multi-hop constraints exists: If d min > , indicating that there is no k-hop path satisfying the constraint between the source vertex s1 and the target vertex s2; otherwise, d min is the k-hop constrained shortest distance between the source vertex s1 and the target vertex s2.

[0065] The following describes the specific implementation methods of the Secure Sharing Comparison Protocol (SSC), Secure Sharing Minimum Protocol (SSMin), and Secure Minimum Protocol (SMin) involved in step 5.

[0066] 1. Secure Sharing Comparison Protocol (SSC)

[0067] This protocol is a prior art. The protocol realizes the determination of the size relationship between two numbers in the ciphertext state through the interaction between CS and CSP.

[0068] Input: The cloud server (CS) holds a partial private key sk1 and ciphertexts [x], [y], and the computing service provider (CSP) holds a partial private key sk2, and 0 < x, y <

[0069] The cloud server (CS) performs the following steps:

[0070] Calculate and construct [x1] = [x]2 [1] = [2x + 1], [y1] = [y]2 = [2y], and randomly select , ( ), and a bit a, a ∈ {0, 1};

[0071] If a = 1, calculate [z] = [x1]r1[y1]N-r1; otherwise, calculate [z] = [x1]N-r1 [y1]r1

[0072] Use the partial private key sk1 to decrypt [z] to obtain z1, and send z1 and [z] to the CSP.

[0073] The computing service provider (CSP) performs the following steps:

[0074] Use sk2 and z1 to fully decrypt [z] to obtain z2;

[0075] If z2 < N / 2, set b = 1; otherwise, set b = 0.

[0076] Output: CS obtains a, and CSP obtains b; if x ≤ y, then a ⊕ b = 0; if x > y, then a ⊕ b = 1.

[0077] 2. Secure Sharing Minimum Protocol (SSMin)

[0078] Input: A cloud server (CS) holds a partial private key sk1 and a ciphertext set D = {[d1], ..., [d...}. n The computing service provider (CSP) holds a portion of the private key sk2.

[0079] Cloud server (CS) execution:

[0080] Randomly copy α ciphertexts from D to obtain the extended set { , ··· , , ; It is a random number;

[0081] Randomly select γ, γ1, ..., γα+n (γ ≫ γi), and encrypt γi using the graph owner's public key pk to obtain [γi].

[0082] For each i∈[1,α+n], compute [d ] = ([d ])γ · [γi], using partial private key sk1 to pair [d Partial decryption yielded... ;

[0083] Will , Send to CSP.

[0084] Computing Service Provider (CSP) execution:

[0085] Using part of the private key sk2 pair , Complete decryption, obtain Store it in array G[i];

[0086] The Findmin() function is called to calculate the minimum value of G[i]: d ρ =Findmin(G[i]);

[0087] make γ, d ρ .

[0088] Output: CS obtained CSP obtained That is, output ( ).

[0089] Safety Minimum Protocol (SMin)

[0090] Input: A cloud server (CS) holds a partial private key sk1 and a ciphertext set D={[d1], ..., [dn]}, and a computing service provider (CSP) holds a partial private key sk2.

[0091] Cloud server (CS) execution:

[0092] Initialize [d] min ] = [d1];

[0093] For i=2 to n: To work with CSP to execute the SSC protocol, input ([d i ], [d min ], sk1, sk2), to obtain (ω1,ω2);

[0094] Initialize an index table R of size 2. 1 Randomly select a string str, let R 1 (str||ω1 ) ←[di],R 1 (str||ω1 ⊕1)← [dmin]; str is a randomly selected string. This represents the bit value obtained by CS after executing the SSC protocol, str|| This means combining the string and The concatenation results in a new string, which is then used as the input to the hash function F1(). Indicates to Perform an XOR operation with 1.

[0095] R 1 The hash function F1() and str are sent to the CSP.

[0096] Computing Service Provider (CSP) execution:

[0097] Calculate Index = F1(str||ω2) from R. 1 Extract [d] in] = ;

[0098] Refresh [d] using the CR algorithm [in] retrieves [dmin] and sends it to CS.

[0099] Output: The cloud server (CS) holds the final [dmin] = min{[d1], ..., [dn]}.

[0100] The basic protocols of SSMin and SMin enable cloud servers to calculate the shortest distance for multi-hop constraints without knowing any privacy information during the offline phase, and to provide a fast response to queries from users during the online phase.

Claims

1. A method for privacy preserving multi-hop constrained shortest distance query on encrypted graph, characterized in that, The application is applied to a system comprising a graph data owner, a cloud server, a computing service provider and at least one user, the cloud server, the user and the graph data owner are communicatively connected in pairs, and the computing service provider is communicatively connected with the cloud server and the graph data owner, and the method comprises the following six processes: A key generation process: the graph data owner generates the required keys of each party and a public-private key pair by using a threshold Paillier encryption system, and distributes the private key to the cloud server and the computing service provider; A graph encryption process: the graph data owner constructs an adjacency matrix of the graph, sets different numerical ranges for the matrix elements with existing edges and non-existing edges to distinguish real paths and false paths; A vertex vector is generated by generating a one-dimensional array storing all vertices and encrypting the one-dimensional array to obtain the vertex vector; then a key matrix is randomly generated, an encrypted matrix is calculated and it is ensured that the matrix components meet the specific size requirement; finally, the vertex vector, the encrypted matrix and the public key are sent to the cloud server, and the key matrix and the public key are sent to the computing service provider; A user authorization process: the user sends an authorization request to the graph data owner; After the graph data owner approves the authorization request, an authorization certificate containing authorization information and a signature of the authorization information is generated, the authorization certificate is sent to the cloud server through a secure channel, and the authorization certificate and a pseudo-random function key are sent to the user; A query token generation process: for a multi-hop constraint shortest distance query request containing a hop upper limit, a source vertex, a target vertex, a cost constraint threshold and a time constraint threshold, the user first calculates the encrypted identification of the source vertex and the target vertex by using the pseudo-random function key, then encrypts the cost constraint threshold and the time constraint threshold by using a threshold Paillier encryption algorithm to obtain ciphertext, and finally combines the hop upper limit, the encrypted identification and the cost constraint threshold and the time constraint threshold ciphertext to generate a query token and send it to the cloud server, thereby providing identification and constraint conditions for the query request. A multi-hop constraint shortest distance query process: the process is divided into an offline precalculation stage and an online query response stage, in the offline stage, the computing service provider encrypts the key matrix and sends it to the cloud server, the cloud server encrypts the encrypted matrix to obtain the encrypted form of the original adjacency matrix, and then cooperates with the computing service provider to recursively calculate the multi-hop matrix power, iteratively calculates by using the additive homomorphism and calls the secure minimum value protocol to process the distance ciphertext; In the online stage, the cloud server first verifies the user authorization certificate, extracts the precalculated matrix elements after verification, cooperates with the computing service provider to call the secure shared comparison protocol to judge whether the constraints are met, executes ciphertext refreshing on the elements meeting the constraints and stores the elements, and finally calls the secure shared minimum value protocol to obtain a tuple containing a random number and an encrypted shortest distance and returns the tuple to the user, thereby realizing the privacy calculation of the multi-hop constraint shortest distance; A user decryption process: the user uses the private key of the user to decrypt the received encrypted shortest distance tuple; then the noise is eliminated by taking the integer operation to obtain a candidate multi-hop constraint shortest distance; finally, according to the size relationship between the candidate distance and the preset threshold, it is judged whether there is a multi-hop path meeting the constraints between the source vertex and the target vertex, if there is, the candidate distance is the final multi-hop constraint shortest distance, and the decryption and validity judgment of the query result are completed.

2. The method of claim 1, wherein, The key generation process specifically includes the following steps: S1.1: The graph data owner inputs a security parameter τ1, generates a pseudo-random function key K, executes a key generation algorithm KeyGen of a threshold Paillier cryptosystem to generate a public key pk and a private key sk, discloses the public key pk, calls a key splitting algorithm KeyS to split the private key sk into partial private keys sk1 and sk2, and distributes the partial private keys to the cloud server and the computing service provider respectively; S1.2: The user inputs a security parameter τ2, generates his own public-private key pair (PK2, SK2) through the KeyGen algorithm, and makes the public key PK2 public and keeps the private key SK2 secret. , ​​​ 3. The method of claim 2, wherein, The graph encryption process specifically includes the following steps: S2.1: The graph data owner constructs an adjacency matrix A for the graph G=(V,E), where V is the set of vertices, E is the set of edges, and so on. and There exists an edge between A and A, let the elements of A be... =( , , ,in For distance, For cost, For time, and , , If no edge exists, let , , To distinguish false paths; where N is the threshold Paillier encryption system public key parameter; 1≤i≤n; 1≤j≤n; n is the number of vertices; S2.2: Generate a one-dimensional array V = (v1, ···, vn) of all vertices in the storage graph, using a pseudo-random function F and a key K on each vertex v1= F(K, v1) to obtain a vertex vector ; where 1≤i≤n; S2.3: Randomly generate a key matrix B, calculate the encryption matrix Pn x n = An x n + Bn x n, ensure that each component p ᵢⱼ < / ᵢⱼ ; send the vertex vector H, the encryption matrix Pn x n to the cloud server, and send the key matrix Bn x n to the computing service provider.

4. The method of claim 3, wherein, The user authorization process specifically includes the following steps: S3.1: The user sends authorization request information (ID U , Time, Number) to the graph data owner, where ID U is user identity information, Time is a query time range, and Number is an upper limit of query times; S3.2: If the graph data owner agrees to authorize, generate the authorization certificate CER U = { cer = (GO, ID U , Time, Number), sig(cer, sk)}, send CER U to the cloud server through a secure channel, and send CER U and the pseudo-random function key K to the user.

5. The method of claim 1, wherein, In the query token generation process, it is assumed that k is the upper limit of the number of hops in the multi-hop constraint shortest distance query request, s1 is the source vertex, s2 is the target vertex, θ1 is the cost constraint threshold, θ2 is the time constraint threshold, and 0 < θ1, θ2 < 1 : S4.1: The user calculates encrypted identifiers Hs1=F(K,s1) and Hs2=F(K,s2) corresponding to the source vertex s1 and the target vertex s2 using the pseudo-random function key K; S4.2: The cost constraint threshold θ1 and the time constraint threshold θ2 are encrypted by a threshold Paillier encryption algorithm to obtain ciphertexts Θ1=[θ1] and Θ2=[θ2]; S4.3: Combine to generate query token Qs1 , s2= (k, hs1, hs2, Θ1, Θ2 ) and send to the cloud server.

6. The method of claim 1, wherein, The multi-hop constraint shortest distance query process is divided into an offline phase and an online phase, and specifically includes the following steps: Offline phase: S5.11: The computing service provider encrypts the key matrix B using the public key pk and sends it to the cloud server; S5.12: The cloud server encrypts the encryption matrix P using the public key pk and obtains the encrypted form of the original adjacency matrix A through calculation; S5.13: The cloud server cooperates with the computing service provider to calculate the matrix power matrix through a recursive manner : For the element in the matrix , there is = ( , , where respectively represent the distance ciphertext, the cost ciphertext and the time ciphertext, the iterative calculation is performed by using the additive homomorphism of the Paillier encryption algorithm, the result of each round of iteration is stored in the array P, and after the iteration is completed, the secure minimum value protocol is called to perform the minimum value calculation on the distance ciphertext, and the element tuple corresponding to the minimum distance value is stored as a new element tuple for subsequent construction of the target matrix; Online phase: S5.21: The cloud server verifies the user's authorization certificate CER U If the verification is passed, the corresponding element is extracted from the pre-computed matrix , hs1 and hs2 in s2, to [A]ᵏ, the corresponding element is extracted; to [A]ᵏ, the corresponding element is extracted; S5.22: For each extracted element, the cloud server and the computing service provider jointly invoke the security sharing comparison protocol to determine whether the cost constraint and the time constraint are satisfied respectively: the execution formula is obtained (ω 11 ,ω 12 ), wherein the cloud server obtains ω 11 , and the computing service provider obtains ω 12 ; the execution formula is obtained (ω 21 ,ω 22 ), wherein the cloud server obtains ω 21 , and the computing service provider obtains ω 22 ; if ω 11 ⊕ω 12 =0 and ω 21 ⊕ω 22 =0, it indicates that the element satisfies the cost and time constraints; CS is obtained , after, first initialize an index table of size 4 , randomly selected parameters , , ( ), and encrypt it respectively, get 、 、 , then, according to the following conditions to fill the index table : ； R 2 (ω11 ||ω21 ), R 2 (~ω11 ||ω21 ), R 2 (ω11 || ~ω21 ), R 2 (~ω11 || ~ω21 ) respectively represent the positions of indexes F2 (ω11 ||ω21 ), F2 (~ω11 ||ω21 ), F2 (ω11 || ~ω21 ), F2 (~ω11 || ~ω21 ) in the index table R2. S5.23: The computing service provider calculates its own ω 12 , ω 22 The index F2 (ω12||ω22) is calculated, and the element is taken out from the index table R2, which is refreshed to by the ciphertext refreshing algorithm and sent to the cloud server. The cloud server stores in the array D[i]; i ; S5.24: The cloud server and the computing service provider invoke the secure shared minimum protocol to perform a minimum calculation on the array D to obtain the tuple ( ), and encrypt it using the user public key to obtain the encrypted tuple ( ), and return the encrypted tuple to the user, where =γ, =[γ·d min +γ ρ ], where d min is the multi-hop shortest distance satisfying the constraints, γ ρ is random noise, and γ is a random number larger than γ ρ .

7. The method of claim 6, wherein, The user decryption process specifically includes the following steps: S6.1: The user uses his own private key on ( ) decryption, obtaining ( ); S6.2: Compute dmin =⌊ / "; S6.3: judge whether the multi-hop constraint shortest distance exists: if d min , it indicates that there is no k-hop path satisfying the constraint between the source vertex s1 and the target vertex s2; otherwise, d min is the k-hop constraint shortest distance between the source vertex s1 and the target vertex s2.​ 8. The method of claim 6, wherein, The secure shared minimum value protocol specifically is: Input: Cloud server holds partial private key sk1 and ciphertext set D = {[d1], ···, [d n ]}, and the computation service provider holds partial private key sk2. The cloud server executes: Copy α ciphertexts randomly from D to get extended set , ···, , , is a random number; Randomly selects γ, γ1, ···, γa+n, wherein γ ≫ γi, encrypts γi using the public key pk to obtain [γi]; For each i∈[1,α+n], compute [d ] = ([d ])γ · [γi], partially decrypt [d ] using partial key sk1, resulting in ; Will , Send to the computing service provider; The computing service provider executes: using part of the private key sk2 on , completely decrypting, resulting in being stored in the array G[i]; Call the Findmin() function to calculate the minimum value of G[i]: d ρ = Findmin(G[i]); Let gamma, d ρ , Output: CS gets , CSP gets , i.e. output( ).

9. The method of claim 6, wherein, The secure minimum value protocol specifically is: input: the cloud server holds a partial private key sk1 and a ciphertext set D={[d1], ···, [dn]}, and the computing service provider holds a partial private key sk2; The cloud server executes: Initialize [d min ] = [d1] ; For i=2 to n: Performing SSC protocol with the computing service provider, input ([d i ], [d min ], sk1, sk2 ), get (ω1, ω2 ); Initialize index table R of size 2 1 , randomly select a string str, let R 1 (str||ω1 ) ← [di],R 1(str||ω1 ⊕1)← [dmin]; R 1 , the hash function F1(), str are sent to the computing service provider; The computing service provider executes: Compute Index = F1(str || ω2) from R 1 extract [d in] = ; by password refresh [d in] gets [dmin] and sends to cloud server; Output: the cloud server holds the final [dmin]=min{[d1], ···, [dn]}.

Images