Index type privacy information retrieval method and system for variable-length data retrieval

Abstract

The invention relates to an index type privacy information retrieval method and system for variable-length data retrieval, and the method comprises the steps: carrying out the coding preprocessing of a database through a server, and forming a three-dimensional matrix; the client side calculates a column index and a row index in a database according to the query index; generating a column query ciphertext and a row query ciphertext according to the column index and the row index, and sending the column query ciphertext and the row query ciphertext to a server; the server expands the column query ciphertext, and multiplies and adds the expanded column query ciphertext and the three-dimensional matrix to obtain a first ciphertext array; multiplying and adding the row query ciphertext and the first ciphertext array to obtain a second ciphertext array; and performing rotation fusion on the second ciphertext array to obtain a single ciphertext result, and sending the single ciphertext result to the client to realize privacy information retrieval. Zero-skipping coding and folding retrieval are introduced, force is exerted from two dimensions of data layout and retrieval organization, variable-length entries are compatible, and expenditure is remarkably reduced.

Description

Technical Field

[0001] This invention relates to an index-based privacy information retrieval method and system for variable-length data retrieval, belonging to the field of privacy information retrieval technology. Background Technology

[0002] The goal of privacy-preserving information retrieval technology is to enable clients to retrieve desired entries from databases in outsourced or semi-trusted environments without revealing their access intent. With the accelerated flow of cloud computing and data elements, the demand for "confidential and usable" retrieval has significantly increased in scenarios such as healthcare, finance, government affairs, and the industrial internet. Traditional security measures, such as transmission encryption and access control, while protecting the link and coarse-grained access permissions, are insufficient to prevent lateral inferences by the server or underlying system regarding access patterns, popular entries, and query time distribution, thus statistically revealing user intent. Privacy-preserving information retrieval technology migrates retrieval computation to the encrypted domain, allowing the server to perform fixed-profile computations and responses only on the encrypted data, fundamentally reducing the attack surface.

[0003] Index PIRs aim to return the k-th record by index, and they mainly fall into two categories. The first is information-theoretic PIR, which requires multiple servers and coding redundancy to achieve information-theoretic level privacy guarantees. Its disadvantage is high deployment cost and complex coordination in single-server and wide area network environments. The second is computational PIR, which is based on the difficulty assumption of modern cryptography. A representative implementation is a single-server PIR based on homomorphic encryption. Homomorphic schemes on rings such as BFV provide primitives such as batch processing (parallel computation of multiple plaintext slots), ciphertext rotation, component-wise multiplication of ciphertext and plaintext, multiplication of ciphertext and plaintext, as well as relined and key switching. These primitives enable retrieval operators such as column gating, component-wise multiplication and addition, rotation and folding to be implemented in a fixed computational form in the ciphertext field, thereby achieving an engineering-usable balance between communication, computation, and security.

[0004] SealPIR is a representative FHE-PIR protocol, and its key engineering ideas are "query expansion" and "packing rotation". The client only needs to transmit a small amount of hot ciphertext. The server uses expansion primitives to generate multiple "one-hot" selection vectors in the ciphertext field, and then performs component-wise multiplication and addition with the column-packed data. Through rotation-summation, the non-zero values ​​scattered in different slots are folded into the first slot to form a decryptable answer ciphertext. The problem is that the length of entries in real databases is often not uniform. In order to align, traditional implementations will fill all entries to a uniform maximum length. As a result, the server has to perform multiplication, addition and rotation on a large number of "zero-padding" entries during the homomorphic computation stage, resulting in significant computational redundancy. At the same time, the response end needs to return multiple ciphertexts proportional to the number of fragments, increasing the communication cost. In latency-sensitive or throughput-limited scenarios, this redundancy becomes a bottleneck. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides an index-based privacy information retrieval method and system for variable-length data retrieval. Addressing the issue of varying entry lengths in real-world databases, it offers protocol-level modifications at both the encoding and retrieval levels. The encoding layer employs zero-skip encoding, aggregating high-order zeros caused by padding into a determinable zero vector. The retrieval layer utilizes folded retrieval, folding the query space into a two-dimensional form and seamlessly integrating it with query expansion primitives, ultimately fusing multiple fragments of the answer into a single encrypted text for return. The entire process maintains the equiformable contour of the interaction, remaining unchanged with query indexes and preserving existing semantic security. This invention introduces zero-skip encoding and folded retrieval, addressing both data layout and retrieval organization dimensions, accommodating variable-length entries and significantly reducing overhead.

[0006] Terminology Explanation: 1. Privacy Information Retrieval (PIR): This is a secure multi-party computation technique that refers to a privacy protection technique where users hide keywords or identity information in their search criteria, and the data service provider returns matching results but cannot identify the specific query object.

[0007] 2. Homomorphic Encryption Scheme (BFV): BFV can encrypt a vector of dimension N into ciphertext and participate in the computation. Each element in the vector is a plaintext slot. Each value has an upper limit, meaning that each value in the vector must be less than T (which is a prime number, usually 65537, meaning each value is at most 16 bits).

[0008] The technical solution of the present invention is as follows: The first aspect of this invention provides an index-based privacy information retrieval method for variable-length data retrieval, comprising: Step 1: The server performs encoding preprocessing on the database to form a three-dimensional matrix; Step 2: The client calculates the column index and row index in the database based on the query index; Step 3: Generate column query ciphertext and row query ciphertext based on the column index and row index, and send them to the server; Step 4: The server expands the column query ciphertext and performs multiplication and addition calculations on the expanded column query ciphertext and the three-dimensional matrix to obtain the first ciphertext array; Step 5: Perform a multiplication and addition operation on the row query ciphertext and the first ciphertext array to obtain the second ciphertext array; Step 6: Rotate and merge the second ciphertext array to obtain a single ciphertext result, and send the single ciphertext result to the client to realize privacy information retrieval.

[0009] According to a preferred embodiment of the present invention, the server performs encoding preprocessing on the database to form a three-dimensional matrix; including: The database contains n records. Calculate the bit width of each record and sort the records in ascending order of bit width. Also, denote the maximum bit width of a record in the database as l. Let the number of plaintext vector slots be N, that is, group the sorted records into groups of N records each, and obtain Group; Let the plaintext modulus be T, and divide each record into α segments. ; Construct a plaintext vector of length N. , ; in, Let be the value corresponding to the k-th segment of the s-th record in the g-th group; The plaintext vector is encoded using BFV's plaintext encoding function, as shown below: ; in, This represents a plaintext polynomial, and `encode` is a BFV encoding operation. Define a row h and a column w such that h × w = β; Construct a three-dimensional matrix M[j][i][k] to store the plaintext polynomials of each group; where j represents the row index, j=[0,h-1]; i represents the column index, i=[0,w-1]; and k represents the slice index, k=[0,α-1]. In the three-dimensional matrix M[j][i][k], position (j, i) corresponds to a record in a certain group, and each position k corresponds to the plaintext polynomial of α slices; Further optimization, setting , w = h × N.

[0010] According to a preferred embodiment of the present invention, the client calculates the column index and row index in the database based on the query index; including: Suppose the index of the record that the client wants to query is idx, and the idx-th record belongs to the group_idx-th group, where group_idx = idx / N; Calculate the row and column indexes to be queried, as shown below: r_idx = group_idx / w; c_idx = group_idx %w; Where r_idx represents the row index to be queried, and c_idx represents the column index to be queried.

[0011] According to a preferred embodiment of the present invention, generating column query ciphertext and row query ciphertext based on column index and row index, and sending them to the server; includes: Construct a one-hot plaintext vector x_t of length N. In the one-hot plaintext vector x_t, the value at position t=c_idx%N is 1, and the value at other positions is 0. Encrypt a plaintext vector x_t using the encryption function, as shown below: X[c_idx / N]=Enc(x_t); Where X[c_idx / N] represents the value at the c_idx / Nth position of the column query ciphertext, Enc represents the encryption function of BFV, and the other positions of the column query ciphertext are filled with Enc(0), i.e., the encrypted zero vector, to obtain the column query ciphertext X[w / N], and the length of the column query ciphertext is w / N; Construct a one-hot plaintext vector x_oft of length N. In the one-hot plaintext vector x_oft, the value at position oft=idx%N is 1, and the value at other positions is 0. Encrypt a plaintext vector x_oft by calling the encryption function, as shown below: Y[r_idx] = Enc(x_oft); Where Y[r_idx] represents the value at the r_idx position of the row query ciphertext, and the other positions of the row query ciphertext are filled with Enc(0), i.e., the encrypted zero vector, to obtain the row query ciphertext Y[h], and the length of the row query ciphertext is h; The client sends the column query ciphertext X[w / N] and the row query ciphertext Y[h] to the server.

[0012] According to a preferred embodiment of the present invention, the server expands the column query ciphertext and performs multiplication and addition calculations on the expanded column query ciphertext and a three-dimensional matrix to obtain a first ciphertext array; including: The column query ciphertext X[w / N] is expanded using the Expand function to obtain X'[w]. Construct the first ciphertext array T[j][k] and initialize it as an encrypted all-zero vector; Iterate through the i columns of the three-dimensional matrix M[j][i][k]. If all values ​​in M[j][i][k] are 0, skip the step. Otherwise, perform a multiplication calculation and add it to the corresponding first ciphertext array T[j][k], as shown below: ; ; in, This represents the result of a multiplication calculation. Query the ciphertext for the expanded i-th column; Finally, the first ciphertext array T[j][k] is obtained.

[0013] According to a preferred embodiment of the present invention, the row query ciphertext is multiplied and added to the first ciphertext array to obtain the second ciphertext array; including: Construct a second ciphertext array T'[k] and initialize it as an encrypted vector of all zeros; The first ciphertext array T[j][k] is traversed through j rows. Each row of T[j][k] is multiplied by the ciphertext Y[h] retrieved from the row, and the result is accumulated into T'[k], as shown below: ; ; in, This is the result of multiplying the first ciphertext array with the row query ciphertext. The ciphertext for the query of row j; Finally, the second ciphertext array T'[k] is obtained.

[0014] According to a preferred embodiment of the present invention, the second ciphertext array is rotated and fused to obtain a single ciphertext result, and the single ciphertext result is sent to the client to realize privacy information retrieval; including: Construct the ciphertext Ans for the answer and initialize it as an encrypted vector of all zeros; Perform a rotation, or cyclic shift, on the second ciphertext array T'[k]: R k =Rotate(T'[k],k); Among them, R k Rotate(T'[k], k) represents the rotated ciphertext, which means shifting the non-zero elements in the second ciphertext array T'[k] to the right or left k times; Add the rotated ciphertext to the answer ciphertext: Ans←Ans+R k ; Finally, the ciphertext answer Ans, which is a single ciphertext result, is obtained and sent to the client. The client receives the encrypted answer Ans, obtains the plaintext vector including the target record, and completes the retrieval of privacy information.

[0015] A computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps of an index-based privacy information retrieval method for variable-length data retrieval.

[0016] A computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the steps of an index-based privacy information retrieval method for variable-length data retrieval are disclosed.

[0017] A second aspect of the present invention provides an index-based privacy information retrieval system for variable-length data retrieval, comprising: The preprocessing module is configured to: enable the server to perform encoding preprocessing on the database to form a three-dimensional matrix; The query index calculation module is configured to: the client calculates the column index and row index in the database based on the query index; The query ciphertext generation module is configured to generate column query ciphertext and row query ciphertext based on column index and row index, and then send them to the server. The first ciphertext array generation module is configured as follows: the server expands the column query ciphertext and performs multiplication and addition calculations on the expanded column query ciphertext and the three-dimensional matrix to obtain the first ciphertext array; The second ciphertext array generation module is configured to perform multiplication and addition calculations between the row query ciphertext and the first ciphertext array to obtain the second ciphertext array; The single-ciphertext result generation module is configured to rotate and merge the second ciphertext array to obtain a single-ciphertext result, and send the single-ciphertext result to the client to realize privacy information retrieval.

[0018] The beneficial effects of this invention are as follows: 1. Reduced computational cost: Skip zero vectors and remove useless multiplication, addition and rotation for zero-filling.

[0019] 2. Reduced communication costs: Folded retrieval combined with rotation fusion enables single-ciphertext return.

[0020] 3. Security remains unchanged: Skipping tables only rely on the static data layout on the server side and are unrelated to the query index; the number and format of queries and responses are fixed, maintaining indistinguishability.

[0021] 4. User-friendly implementation: The protocol reuses BFV's readily available operators and key toolchains, resulting in low deployment costs; encoding and folding only change the data layout and scheduling, without affecting the cryptographic semantics. Attached Figure Description

[0022] Figure 1 A schematic diagram illustrating the SealPIR protocol's packaging and query extensions; Figure 2 This is a schematic diagram of the zero-skip encoding of the present invention; Figure 3 This is a schematic diagram of the folded retrieval method of the present invention. Detailed Implementation

[0023] The present invention will be further described below with reference to the embodiments and accompanying drawings, but is not limited thereto.

[0024] Example 1 An index-based privacy information retrieval method for variable-length data retrieval, such as Figure 2-3As shown, it includes: Step 1: The server performs encoding preprocessing on the database to form a three-dimensional matrix; Step 2: The client calculates the column index and row index in the database based on the query index; Step 3: Generate column query ciphertext and row query ciphertext based on the column index and row index, and send them to the server; Step 4: The server expands the column query ciphertext and performs multiplication and addition calculations on the expanded column query ciphertext and the three-dimensional matrix to obtain the first ciphertext array; Step 5: Perform a multiplication and addition operation on the row query ciphertext and the first ciphertext array to obtain the second ciphertext array; Step 6: Rotate and merge the second ciphertext array to obtain a single ciphertext result, and send the single ciphertext result to the client to realize privacy information retrieval.

[0025] Example 2 The difference between the index-based privacy information retrieval method for variable-length data retrieval described in Example 1 and the method described in Example 1 is as follows: The server performs encoding preprocessing on the database to form a three-dimensional matrix; including: The database contains n records. Calculate the bit width of each record and sort the records in ascending order of bit width. Also, denote the maximum bit width of a record in the database as l (the record with a maximum of l bits). For example, denote the r-th record as the integer val_r, where r = (0, 1, ..., n-1). Calculate the number of bits required to represent it in binary, i.e., the bit width w. r For example, the binary representation of 5 is 101, and the bit width is w. r (3) Let the number of plaintext vector slots be N (usually a power of two). This means the sorted records are grouped into sets of N records each (e.g., group 0 contains the first N records, group 1 contains the next N records, and so on). This yields... Group; Let the plaintext modulus be T (a set parameter), and divide each record into α segments (bit segments). (Each BFV plaintext slot does not store a "single bit", but an integer from 0 to T-1. That is to say, one slot can actually represent Each bit, for example, a 60-bit integer is divided into several blocks, each block being approximately 15 bits. This allows each block to be stored in an integer within the range [0, T-1]. For the g-th group (containing N records), the s-th record has the value val_{g, s} (s=0,1,...,N-1) and a bit width of w. g,s ; Construct a plaintext vector of length N. , ; in, The value corresponding to the k-th segment of the s-th record in the g-th group (encoded as an integer in the range [0, T-1]); if the bit width of a record is w g,s If it's not strong enough to reach this level k, then it's 0 at this position, meaning that many 0s will naturally form at higher levels. The plaintext vector is encoded using BFV's plaintext encoding function, as shown below: ; in, This represents a plaintext polynomial, and `encode` is a BFV encoding operation (used to pack plaintext vectors into a polynomial, supporting batch processing (SIMD strategy), implemented through BatchEncoder); it can also be understood as "this group of BFV plaintext vectors recorded on the k-th slice", so for each group, α plaintext vectors of length N will be obtained; Define a row h and a column w such that h × w = β; normally, to minimize h + w, basically... However, due to the different ways rows and columns are processed in the future (column query ciphertext will be expanded using the Expand function; to accommodate this, we choose to make w larger); Construct a three-dimensional matrix M[j][i][k] to store the plaintext polynomials of each group; where j represents the row index, j=[0,h-1]; i represents the column index, i=[0,w-1]; and k represents the slice index, k=[0,α-1]. In the three-dimensional matrix M[j][i][k], position (j, i) corresponds to a record in a certain group, and each position k corresponds to the plaintext polynomial of α slices (e.g., the 0th group is placed at the position corresponding to j=0, i=0, and the first group is placed at the position corresponding to j=0, i=1). set up , w = h × N.

[0026] The client calculates the column indexes and row indexes in the database based on the query index; including: Suppose the index of the record that the client wants to query is idx, and the idx-th record belongs to the group_idx-th group, where group_idx = idx / N (rounded down); The row and column indexes are calculated as follows: r_idx = group_idx / w; c_idx = group_idx %w; Here, r_idx represents the row index (row index j), and c_idx represents the column index (column index i). The data that the client wants to access is actually in the r_idx row and c_idx column of the server's M[w][h][k] matrix.

[0027] Generate column query ciphertext and row query ciphertext based on column index and row index, and send them to the server; including: Construct a one-hot plaintext vector x_t of length N. In the one-hot plaintext vector x_t, the value at position t = c_idx%N (the remainder of idx divided by N) is 1, and the value at other positions is 0. Encrypt a plaintext vector x_t using the encryption function, as shown below: X[c_idx / N]=Enc(x_t); Where X[c_idx / N] represents the value at the c_idx / Nth position of the column query ciphertext, Enc represents the encryption function of BFV (the API provided by BFV), and the other positions of the column query ciphertext are filled with Enc(0), i.e., the encrypted zero vector, to obtain the column query ciphertext X[w / N], where there are a total of w / N column query ciphertexts; Construct a one-hot plaintext vector x_oft of length N. In the one-hot plaintext vector x_oft, the value at position oft=idx%N is 1, and the value at other positions is 0. Encrypt a plaintext vector x_oft by calling the encryption function, as shown below: Y[r_idx] = Enc(x_oft); Where Y[r_idx] represents the value at the r_idx position of the row query ciphertext, and the other positions of the row query ciphertext are filled with Enc(0), i.e., the encrypted zero vector, to obtain the row query ciphertext Y[h], where there are h rows query ciphertexts in total; The client sends the column query ciphertext X[w / N] and the row query ciphertext Y[h] to the server.

[0028] The server expands the column query ciphertext and performs multiplication and addition calculations on the expanded column query ciphertext and a three-dimensional matrix to obtain the first ciphertext array; including: The column query ciphertext X[w / N] is expanded using the Expand function to obtain X'[w] (the Expand function proposed by SealPIR, for column i within the query target range, the corresponding X'[i] is an encrypted vector of all 1s [1,1,...,1], for other columns, X'[i] is an encrypted vector of all 0s). Construct the first ciphertext array T[j][k] (k=0...α-1, j=0...h-1), and initialize it with Enc(0) as an encrypted all-zero vector; Iterate through the three-dimensional matrix M[j][i][k] along column i (i=0...w-1). If all values ​​in M[j][i][k] are 0, skip the step. Otherwise, perform a multiplication calculation and add it to the corresponding first ciphertext array T[j][k], as shown below: ; ; in, This represents the result of a multiplication calculation. Query the ciphertext for the expanded i-th column; Finally, the first ciphertext array T[j][k] is obtained (representing the "row-by-row aggregation result" that has been accumulated for the target column at the k-th slice layer).

[0029] The second ciphertext array is obtained by multiplying and adding the ciphertext of the row query with the first ciphertext array; it includes: Construct a second ciphertext array T'[k] (k=0...α-1) and initialize it with an encrypted all-zero vector using Enc(0); Iterate through the first ciphertext array T[j][k] for j rows (j=0...h-1), multiply each row of T[j][k] by the ciphertext Y[h] query, and add the result to T'[k], as shown below: ; ; in, This is the result of multiplying the first ciphertext array with the row query ciphertext. Query the ciphertext for the j-th row; since only the r_idx row in Y[j] has a one-hot ciphertext that "represents a real 1", and all other rows are Enc(0), then: only the target row j = r_idx will make an actual contribution to T'[k]; the contributions of all other rows are 0. Finally, the second ciphertext array T'[k] is obtained.

[0030] The second ciphertext array is rotated and merged to obtain a single ciphertext result, which is then sent to the client to achieve privacy information retrieval; including: Construct the ciphertext Ans for the answer and initialize it with Enc(0) as an encrypted all-zero vector; Perform a rotation, or cyclic shift, on the second ciphertext array T'[k]: R k =Rotate(T'[k],k); Among them, R kRepresents the rotated ciphertext. Rotate(T'[k], k) indicates a cyclic shift operation, which shifts the non-zero elements in the second ciphertext array T'[k] to the right (or left) k times. Add the rotated ciphertext to the answer ciphertext: Ans←Ans+R k ; The final answer ciphertext Ans, i.e., the single ciphertext result, is sent to the client; its decrypted plaintext vector carries "all the information of the target record (from all slices)" in only one slot, and the other slots are 0; The client receives the encrypted answer Ans, decrypts it using its private key, and obtains the plaintext vector containing the target record, thus completing the retrieval of private information.

[0031] The core idea of ​​SealPIR is as follows: Figure 1 As shown, the database is organized into multiple plaintext vectors using a "column packing" method, with the number of slots in each vector equal to the packing capacity. The client only needs to send a small amount of hotspot ciphertext. The server uses query expansion primitives to expand the hotspot vectors into multiple "one-hot" selection vectors in the ciphertext field. Then, it performs component-wise multiplication and summation on each column vector. Finally, through multiple rounds of rotation and summation, the non-zero slots are folded into the zeroth slot to form the decryptable answer ciphertext.

[0032] This invention introduces zero-skip encoding and folded retrieval without changing the main framework of SealPIR (column packing and query expansion), working together from two dimensions: data layout and retrieval organization, to accommodate variable-length entries and significantly reduce overhead.

[0033] System participants and interfaces: The client is responsible for generating keys, generating query ciphertext, and receiving and decrypting responses; the server is responsible for storing the encoded database, performing query expansion, component-wise multiplication and addition, rotation-summing, and scheduling based on skip tables.

[0034] The main interfaces are as follows: Parameter negotiation: Both parties agree on security parameters, number of plaintext slots, plaintext modulus, folding dimension, and fragment width.

[0035] Key distribution: The client generates public keys, evaluation keys, rotation keys, etc., and provides them to the server as needed.

[0036] Database encoding: The server performs a one-time encoding on the original database using zero-skip encoding, and outputs a set of column-oriented plaintext vectors and a skip table.

[0037] Query generation: The client generates two sets of one-hot encrypted text based on the index, using column queries and row queries.

[0038] Server computation: The server performs an expansion on the column query, multiplies and adds the column vector component by component, then filters the rows with a row query, performs a rotation-summation on different segments, and outputs a single-ciphertext reply.

[0039] Decryption and Recovery: The client decrypts the single ciphertext and recovers the original record in fragment order.

[0040] Pseudocode explanation: (1) Query generation Input: Query index idx; system parameters h, w, N.

[0041] step: a. Calculate the slot offset to obtain the slot position of the index in a plaintext vector; b. Calculate the column block and row block to obtain the column index and row index; c. Initialize two sets of ciphertext arrays, setting all elements to an encrypted vector of all zeros; d. Enter the encrypted one-hot vector in the corresponding position of the column lookup array and select the correct slot; e. Enter the encrypted one-hot vector in the corresponding position of the row query array, and select the correct row; Output: Two sets of query ciphertext.

[0042] (2) Server computing Input: Two sets of query ciphertext; a set of column-oriented plaintext vectors; a skip table; system key material.

[0043] step: a. Perform an expansion on the column query to obtain multiple one-hot select vectors; b. Traverse column by column. If a column is marked as a zero vector in a certain segment, skip the calculation directly. c. Perform component-wise multiplication on the positions that have not been skipped, multiplying them with the plaintext vector of the current column; d. Sum the product results within the column; e. Use row queries to filter the cumulative results within a column; f. Perform rotation and summation on the results of different segments, and gradually fold the non-zero segments into a unified slot; Output: Single-ciphertext answer.

[0044] (3) Decryption and recovery The client decrypts the single ciphertext, assembles the resulting fragment values ​​in a predetermined order, and restores the target record.

[0045] (4) Encoding process Input: raw database; parameters l, alpha, h, w.

[0046] step: a. Bucket the records according to their original length; b. Divide each record horizontally according to its segment width; c. Map the fragments to column-oriented plaintext vectors according to the principle of "high-order priority clustering"; d. Plaintext vectors marked with all zeros are skippable; output a skip list. e. Output the set of column-oriented plaintext vectors and the skip list.

[0047] Output: Encoded database and skip table.

[0048] Boundary and Exception Handling: (1) When the record length is much smaller than the maximum bit width, the zero vector ratio increases and the skipping benefit is greater; the number of rows can be appropriately increased to balance server memory and rotation number.

[0049] (2) When the record length is close to the maximum bit width, the zero vector ratio decreases; the plaintext modulus or segment width can be appropriately increased to reduce the number of segments.

[0050] (3) Batch processing of unpopular queries: Multiple independent queries can be merged into a batch task, reuse of extended and rotated keys, and amortize key switching costs.

[0051] (4) Failure and retry: If decryption fails, it is usually due to insufficient noise budget or parameter mismatch. You should roll back and increase the parameters or reduce the computation depth.

[0052] Complexity and communication volume: Query complexity: After folding, the query complexity is reduced from a linear relationship with the database size to a relationship with the square root, which is intuitively equivalent to breaking a "long-distance run" into two "half-marathons".

[0053] Response size: By rotating and summing multiple fragment answers into a single encrypted text, the response no longer grows linearly with the number of fragments.

[0054] Computational overhead: Zero-skip encoding removes most of the multiplication, addition, and rotation operations that padded with zeros from the server, making the actual computational load more consistent with the proportion of the data "payload".

[0055] Overall results: Under the same security level, end-to-end latency is reduced, the number of queries that can be served per unit time is increased, and the overall cost of communication and computing is reduced.

[0056] Security statement: Threat Models and Security Objectives: The threat model is a semi-honest adversary on a single server, where the server strictly adheres to the protocol but attempts to infer query indexes or database content from the interactions. Security objectives include three points: query privacy (not revealing access intent), data confidentiality (not revealing plaintext content), and computational indistinguishability (observable computational and communication patterns should not be related to the query).

[0057] Side channels related to engineering implementation (timing, buffering, energy consumption) are not within the cryptographic model, but need to be mitigated at the engineering level.

[0058] Semantic security implementation: The client's output query ciphertext satisfies semantic security; the server's operations on the ciphertext, such as expansion, component-wise multiplication and addition, and rotation, are all performed within the predetermined ciphertext structure and do not depend on the plaintext. As long as the parameter selection meets security requirements, an adversary cannot distinguish the query ciphertext from random homogeneous ciphertext without knowing the private key. The server only sees the fixed-form ciphertext and a fixed number of response ciphertexts.

[0059] Skip strategy and indistinguishability: The skip list is generated by the server during encoding based on static data layout and is independent of any subsequent single query. AnswerGen filters out zero vectors from the skip list before component-wise multiplication and addition. The occurrence and order of this step can be standardized in engineering implementation. For example, a unified traversal order, a unified upper bound on the number of iterations, and performing no-operations on skipped items ensure that the observed loop counts and API call trajectories do not carry query characteristics. In this way, queries from different indexes remain consistent or statistically indistinguishable across server-observable time characteristics, log entry counts, rotation and key switch counts, etc.

[0060] Leaking functions and isomorphic interactions: The protocol constrains the leak function to a constant form: the number and size of the ciphertext uploaded by the query are fixed; the number and size of the ciphertext returned by the server are also fixed. Folded retrieval merges multiple fragments into a single ciphertext through rotation and summation, avoiding changes in the response form due to varying fragment numbers. As long as the "isomorphic interaction" engineering standard is strictly followed during deployment, the query index will not map to externally observable differences.

[0061] Multiple rounds of inquiries and collusion: In multi-round query or batch processing scenarios, the client should use freshness randomness for each round of query to avoid cross-round correlations. Server caches (expanded cache, rotating cache) should not have query tags and should not record states that can be correlated across rounds. For batch processing tasks, multiple queries can be shuffled and sent together to dilute time-series related information. If necessary, processing time and memory usage should be padded to ensure that the resource curves of different queries are consistent.

[0062] Side-channel mitigation on the engineering side: (1) Constant timing: The number of operations and branch structure are fixed for key links; (2) Cache isolation: In a shared environment, resource isolation or page coloring should be used as much as possible to reduce cache observations; (3) Log format: Fix the log sampling rate and field, and do not expose fine-grained internal counts; (4) Key management: Rotation keys and evaluation keys are distributed and rotated as needed to avoid reverse inference; (5) Failure handling: Unify the number of retry intervals for failures to avoid different retry trajectories triggered by different queries.

[0063] Implementation Considerations and Optional Parameters: (1) Selection of folding dimensions Prioritize making the column dimensions close to the number of plaintext slots to fully leverage the parallelism of query expansion; adjusting the row dimensions is used to balance server memory, network communication, and rotation count. In scenarios with limited network bandwidth but sufficient server computing power, the column dimensions can be reduced and the row dimensions increased; conversely, the column dimensions can be appropriately increased.

[0064] (2) Plaintext module and number of fragments The number of fragments is related to the plaintext modulus and fragment width. Increasing the plaintext modulus can reduce the number of fragments, but it will increase noise and ciphertext size. In practice, a trade-off point should be chosen based on the target throughput and target latency to ensure that the cost of rotation and re-linearization is not too high.

[0065] (3) Zero vector determination and persistence Whether a vector is zero is determined directly during the encoding phase, without the need for runtime cryptographic checks. Skip tables can be persistently stored along with column vectors, and integrity checks and version numbers can be added before deployment to avoid data mismatches with tables.

[0066] (4) Engineering optimization Pre-generate rotation keys for commonly used rotations; reuse keys to switch paths during batch processing; establish a read-only cache layer for popular columns; perform SIMD parallelism on linear operations such as expansion and rotation; schedule computing resources according to batch size to avoid jitter.

[0067] (5) Rollback and grayscale When it is necessary to switch encoding strategies or parameters without affecting online services, dual-write and gray-scale replay can be used to maintain the query path and other forms during the coexistence of the old and new encodings. The old version can be recycled after stable indicators are observed.

[0068] Example 3 A computer device includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps of the index-based privacy information retrieval method for variable-length data retrieval described in Embodiment 1 or 2.

[0069] Example 4 A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the index-based privacy information retrieval method for variable-length data retrieval as described in Embodiment 1 or 2.

[0070] Example 5 A variable-length data retrieval index-based privacy information retrieval system includes: The preprocessing module is configured to: enable the server to perform encoding preprocessing on the database to form a three-dimensional matrix; The query index calculation module is configured to: the client calculates the column index and row index in the database based on the query index; The query ciphertext generation module is configured to generate column query ciphertext and row query ciphertext based on column index and row index, and then send them to the server. The first ciphertext array generation module is configured as follows: the server expands the column query ciphertext and performs multiplication and addition calculations on the expanded column query ciphertext and the three-dimensional matrix to obtain the first ciphertext array; The second ciphertext array generation module is configured to perform multiplication and addition calculations between the row query ciphertext and the first ciphertext array to obtain the second ciphertext array; The single-ciphertext result generation module is configured to rotate and merge the second ciphertext array to obtain a single-ciphertext result, and send the single-ciphertext result to the client to realize privacy information retrieval.

Claims

1. A method for retrieving index-based privacy information using variable-length data retrieval, characterized in that, include: Step 1: The server performs encoding preprocessing on the database to form a three-dimensional matrix; Step 2: The client calculates the column index and row index in the database based on the query index; Step 3: Generate column query ciphertext and row query ciphertext based on the column index and row index, and send them to the server; Step 4: The server expands the column query ciphertext and performs multiplication and addition calculations on the expanded column query ciphertext and the three-dimensional matrix to obtain the first ciphertext array; Step 5: Perform a multiplication and addition operation on the row query ciphertext and the first ciphertext array to obtain the second ciphertext array; Step 6: Rotate and merge the second ciphertext array to obtain a single ciphertext result, and send the single ciphertext result to the client to realize privacy information retrieval.

2. The index-based privacy information retrieval method for variable-length data retrieval according to claim 1, characterized in that, The server performs encoding preprocessing on the database to form a three-dimensional matrix; including: The database contains n records. Calculate the bit width of each record and sort the records in ascending order of bit width. Also, denote the maximum bit width of a record in the database as l. Let the number of plaintext vector slots be N, that is, group the sorted records into groups of N records each, and obtain Group; Let the plaintext modulus be T, and divide each record into α segments. ; Construct a plaintext vector of length N. , ; in, Let be the value corresponding to the k-th segment of the s-th record in the g-th group; The plaintext vector is encoded using BFV's plaintext encoding function, as shown below: ； in, This represents a plaintext polynomial, and `encode` is a BFV encoding operation. Define a row h and a column w such that h × w = β; Construct a three-dimensional matrix M[j][i][k] to store the plaintext polynomials of each group; where j represents the row index, j=[0,h-1]; i represents the column index, i=[0,w-1]; and k represents the slice index, k=[0,α-1]. In the three-dimensional matrix M[j][i][k], position (j, i) corresponds to a record in a certain group, and each position k corresponds to the plaintext polynomial of α slices; Further optimization, setting , w = h × N.

3. The index-based privacy information retrieval method for variable-length data retrieval according to claim 2, characterized in that, The client calculates the column indexes and row indexes in the database based on the query index; including: Suppose the index of the record that the client wants to query is idx, and the idx-th record belongs to the group_idx-th group, where group_idx = idx / N; Calculate the row and column indexes to be queried, as shown below: r_idx = group_idx / w; c_idx = group_idx %w; Where r_idx represents the row index to be queried, and c_idx represents the column index to be queried.

4. The index-based privacy information retrieval method for variable-length data retrieval according to claim 3, characterized in that, Generate column query ciphertext and row query ciphertext based on column index and row index, and send them to the server; including: Construct a one-hot plaintext vector x_t of length N. In the one-hot plaintext vector x_t, the value at position t=c_idx%N is 1, and the value at other positions is 0. Encrypt a plaintext vector x_t using the encryption function, as shown below: X[c_idx / N]=Enc(x_t); Where X[c_idx / N] represents the value at the c_idx / Nth position of the column query ciphertext, Enc represents the encryption function of BFV, and the other positions of the column query ciphertext are filled with Enc(0), i.e., the encrypted zero vector, to obtain the column query ciphertext X[w / N], and the length of the column query ciphertext is w / N; Construct a one-hot plaintext vector x_oft of length N. In the one-hot plaintext vector x_oft, the value at position oft=idx%N is 1, and the value at other positions is 0. Encrypt a plaintext vector x_oft by calling the encryption function, as shown below: Y[r_idx] = Enc(x_oft); Where Y[r_idx] represents the value at the r_idx position of the row query ciphertext, and the other positions of the row query ciphertext are filled with Enc(0), i.e., the encrypted zero vector, to obtain the row query ciphertext Y[h], and the length of the row query ciphertext is h; The client sends the column query ciphertext X[w / N] and the row query ciphertext Y[h] to the server.

5. The index-based privacy information retrieval method for variable-length data retrieval according to claim 4, characterized in that, The server expands the column query ciphertext and performs multiplication and addition calculations on the expanded column query ciphertext and a three-dimensional matrix to obtain the first ciphertext array; including: The column query ciphertext X[w / N] is expanded using the Expand function to obtain X'[w]. Construct the first ciphertext array T[j][k] and initialize it as an encrypted all-zero vector; Iterate through the i columns of the three-dimensional matrix M[j][i][k]. If all values ​​in M[j][i][k] are 0, skip the step. Otherwise, perform a multiplication calculation and add it to the corresponding first ciphertext array T[j][k], as shown below: ； ； in, This represents the result of a multiplication calculation. Query the ciphertext for the expanded i-th column; Finally, the first ciphertext array T[j][k] is obtained.

6. The index-based privacy information retrieval method for variable-length data retrieval according to claim 5, characterized in that, The second ciphertext array is obtained by multiplying and adding the ciphertext of the row query with the first ciphertext array; it includes: Construct a second ciphertext array T'[k] and initialize it as an encrypted vector of all zeros; The first ciphertext array T[j][k] is traversed through j rows. Each row of T[j][k] is multiplied by the ciphertext Y[h] retrieved from the row, and the result is accumulated into T'[k], as shown below: ； ； in, This is the result of multiplying the first ciphertext array with the row query ciphertext. The ciphertext for the query of row j; Finally, the second ciphertext array T'[k] is obtained.

7. The index-based privacy information retrieval method for variable-length data retrieval according to claim 6, characterized in that, The second ciphertext array is rotated and merged to obtain a single ciphertext result, which is then sent to the client to achieve privacy information retrieval; including: Construct the ciphertext Ans for the answer and initialize it as an encrypted vector of all zeros; Perform a rotation, or cyclic shift, on the second ciphertext array T'[k]: R k =Rotate(T’[k],k); Among them, R k Rotate(T'[k], k) represents the rotated ciphertext, which means shifting the non-zero elements in the second ciphertext array T'[k] to the right or left k times; Add the rotated ciphertext to the answer ciphertext: Ans←Ans+R k ; Finally, the ciphertext answer Ans, which is a single ciphertext result, is obtained and sent to the client. The client receives the encrypted answer Ans, obtains the plaintext vector including the target record, and completes the retrieval of privacy information.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the index-based privacy information retrieval method for variable-length data retrieval as described in any one of claims 1-7.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the index-based privacy information retrieval method for variable-length data retrieval as described in any one of claims 1-7.

10. A variable-length data retrieval index-based privacy information retrieval system, characterized in that, include: The preprocessing module is configured to: enable the server to perform encoding preprocessing on the database to form a three-dimensional matrix; The query index calculation module is configured to: the client calculates the column index and row index in the database based on the query index; The query ciphertext generation module is configured to generate column query ciphertext and row query ciphertext based on column index and row index, and then send them to the server. The first ciphertext array generation module is configured as follows: the server expands the column query ciphertext and performs multiplication and addition calculations on the expanded column query ciphertext and the three-dimensional matrix to obtain the first ciphertext array; The second ciphertext array generation module is configured to perform multiplication and addition calculations between the row query ciphertext and the first ciphertext array to obtain the second ciphertext array; The single-ciphertext result generation module is configured to rotate and merge the second ciphertext array to obtain a single-ciphertext result, and send the single-ciphertext result to the client to realize privacy information retrieval.

Images