Method, device, storage medium and program product for retrievable privacy information

Abstract

The application discloses a kind of private information retrieval method, equipment, storage medium and program product of supervision, it is related to cryptography and privacy computing technical field.The method comprises: by data holder, public verifiable cryptography commitment is completed in system initialization phase to database version, and database version commitment is recorded to evidence chain by supervision committee, and threshold signature system is established;By supervision committee, the compliance audit is carried out to external authorization certificate and authorization message provided by inquirer, threshold signature is generated when audit passes, and authorization event is recorded to evidence chain;By inquirer, authorization query package is assembled based on threshold signature and is submitted to data holder;In the case where data holder is verified to threshold signature and authorization query package and confirms that authorization is legal and is consistent with database version commitment binding, response ciphertext is generated.The application realizes the authorization decision and after-the-fact accountability of encrypted query, reduces the trust assumption to single-point approval subject.

Description

Technical Field

[0001] This invention relates to the fields of cryptography and privacy computing, specifically to a regulatory privacy information retrieval method, device, storage medium, and program product. Background Technology

[0002] Existing Privacy Information Retrieval (PIR) schemes, especially keyword PIR based on homomorphic encryption and constant repetition encoding, can hide query keywords and access patterns in a single server and single round of communication, theoretically meeting strong privacy requirements. However, in real-world law enforcement and high-compliance scenarios, simply achieving "secret data retrieval" is insufficient, mainly due to the following issues.

[0003] (1) Lack of regulatory capacity.

[0004] The goal of traditional PIR is to hide accessed content as thoroughly as possible, which inherently contradicts the regulators' need to track "who is looking at what".

[0005] (2) The authorization process is strongly coupled with the query content.

[0006] In traditional practice, approval agencies typically need to directly view the plaintext of queries to determine whether to grant approval from a business compliance perspective. This model is acceptable in many prosecutorial operations under the assumption that the approval agency is completely trustworthy. However, when approval agencies face internal abuse risks, lack a unified root of trust in cross-agency collaboration, or wish to minimize trust in a single point of contact at the technical level, the design of "authorization must rely on plaintext visibility" creates tension with the PIR's goal of "performing searches without revealing the intent of the query." Existing solutions generally lack a universal mechanism for compliant authorization and auditing of encrypted queries while reducing trust in a single approval entity. This invention does not exclude the authorization model of approval agencies viewing plaintext queries, but rather provides a technical mechanism that allows for authorization, evidence preservation, and accountability for encrypted queries without relying on a single, completely trustworthy approval entity.

[0007] (3) The results lack verifiability and accountability.

[0008] Traditional PIRs mostly only guarantee "protocol correctness," but do not provide verifiable chains of evidence for the following questions: Did the server use the correct version of the database? Are the returned results complete, without omissions or tampering? When the results are questioned, how can we determine whether it is a misjudgment by the querying party or malicious behavior by the data holder, with minimal disclosure?

[0009] (4) The regulatory function is too costly or is strongly coupled with the database size.

[0010] Some works attempt to introduce mechanisms such as zero-knowledge proofs outside of PIR to prove correctness and compliance, but this often leads to computational and communication overhead growing linearly or superlinearly with the database size, making it difficult to deploy in an engineering manner.

[0011] Therefore, a new technical solution is needed: without compromising the privacy features of the PIR kernel, a regulatory capability of "compliant authorization + full-chain traceability + on-demand arbitration" is introduced, enabling the system to simultaneously answer: Is query privacy protected? Has each query been legally authorized? Does the returned result truly come from a specific version of the database? In case of a dispute, can accountability be accurately traced based on cryptographic evidence? Summary of the Invention

[0012] This invention addresses the problems of existing PIR schemes, such as lack of oversight capabilities, strong coupling between the authorization process and query content, lack of verifiable and accountable results, and excessively high cost of oversight functions or strong coupling with database size. It provides an oversightable privacy information retrieval method, device, storage medium, and program product, which realizes authorization decision-making and post-event accountability for encrypted queries, reduces the trust assumptions of single-point approval entities, and is compatible with high-compliance business scenarios such as the procuratorate.

[0013] The present invention is achieved through the following technical solution.

[0014] Firstly, a method for retrieval of privacy information that can be regulated is provided, the method comprising:

[0015] During the system initialization phase, the data holder makes a publicly verifiable cryptographic commitment to the database version and records the database version commitment to the evidence storage chain. The supervisory committee establishes a threshold signature system based on the distributed key generation protocol.

[0016] The supervisory committee conducts a compliance review of the external authorization credentials and authorization messages provided by the querying party. When the review is passed, a threshold signature is generated through the threshold signature system and the authorization event is recorded in the evidence storage chain. The querying party assembles an authorization query package based on the threshold signature returned by the supervisory committee and submits it to the data holder, so that the data holder can verify the threshold signature and the authorization query package.

[0017] If the data holder verifies the threshold signature and the authorized query package and confirms that the authorization is legal and consistent with the database version commitment, the privacy information retrieval PIR kernel is invoked to perform a privacy retrieval, generate a response ciphertext, record the response events related to the query ciphertext and response ciphertext to the evidence storage chain, and support the querying party to verify and decrypt the response based on the response event records.

[0018] In some preferred schemes, the data holder makes a publicly verifiable cryptographic commitment to the database version during the system initialization phase and records the database version commitment to the evidence storage chain. The oversight committee establishes a threshold signature system based on a distributed key generation protocol, including:

[0019] During the system initialization phase, the data holder independently completes a publicly verifiable cryptographic commitment to the database version and records the database version commitment to the evidence storage chain for subsequent authorization review, retrieval execution and dispute arbitration.

[0020] The supervisory committee conducts a compliance review of the external authorization credentials and authorization messages provided by the querying party. If the review is passed, the threshold signature system is used to generate a threshold signature for the authorization message, and information related to the authorization event is recorded in the evidence storage chain.

[0021] The querying party constructs an authorization query package based on the threshold signature and submits it to the data holder, enabling the data holder to verify the threshold signature and the authorization context.

[0022] When the data holder verifies the threshold signature and the authorized query package, confirms the authorization as legitimate, and the database version commitment is consistent with the context binding, the data holder calls the privacy information retrieval PIR kernel to perform a privacy retrieval, generates a response ciphertext, and records the response events related to the query ciphertext and the response ciphertext to the evidence storage chain.

[0023] The querying party verifies the locally calculated query ciphertext hash and response ciphertext hash based on the response event recorded on the evidence storage chain, and decrypts the response ciphertext to obtain the plaintext retrieval result if the verification is successful.

[0024] In some preferred embodiments, the oversight committee conducts a compliance review of the external authorization credentials and authorization messages provided by the querying party. Upon successful review, a threshold signature is generated using the threshold signature system, and the authorization event is recorded in the evidence storage chain. The querying party assembles an authorization query package based on the threshold signature returned by the oversight committee and submits it to the data holder, enabling the data holder to verify the threshold signature and the authorization query package, including:

[0025] The querying party generates an authorization message based on the target database version number and the root hash in the database version commitment, targeting the query keywords. This authorization message, along with external authorization credentials, is submitted to the oversight committee. The authorization message includes: a query ciphertext commitment and root hash for identifying subsequent query ciphertext, and at least one or more of the following: a policy identifier, a querying party identifier, a current timestamp, a random number, a validity period, and a circuit shape description parameter. The oversight committee performs a compliance check on the authorization message based on the external authorization credentials, the policy identifier, the querying party identifier, and the circuit shape description parameter. If the compliance check passes, at least a predetermined number of committee members partially sign the authorization message using their respective private key shares and synthesize it into a full threshold signature.

[0026] The hash of the authorization message, the full threshold signature, and context information such as the current timestamp are recorded in the evidence storage chain in the form of an authorization event, and the full threshold signature is sent to the querying party;

[0027] The querying party assembles the query ciphertext, the authorization message, and the full threshold signature into an authorized query package and sends it to the data holder.

[0028] The data holder verifies the full threshold signature and verifies the legality of the authorization context and its consistency with the current database version commitment based on the validity period, root hash, and policy identifier in the authorization message.

[0029] In some preferred embodiments, when the data holder verifies the threshold signature and the authorized query package and confirms the authorization is legitimate and consistent with the database version commitment, the Privacy Information Retrieval (PIR) kernel is invoked to perform a privacy retrieval, generating a ciphertext response. Response events related to the ciphertext query and response are recorded in the evidence storage chain, and the querying party is supported in verifying and decrypting the response based on the recorded response events, including:

[0030] The data holder invokes the PIR kernel based on the query ciphertext in the authorized query package to perform privacy information retrieval on the database corresponding to the target database version, generates a response ciphertext, calculates the query ciphertext hash and the response ciphertext hash, packages the database version number, root hash, query ciphertext hash, response ciphertext hash and current timestamp into a response event transaction and submits it to the evidence storage chain to obtain the response event transaction identifier.

[0031] Send the ciphertext of the response, the hash of the ciphertext of the response, and the transaction identifier of the response event to the querying party;

[0032] The querying party reads the corresponding response event record from the evidence storage chain based on the response event transaction identifier, compares and verifies the locally calculated query ciphertext hash and response ciphertext hash with the query ciphertext hash and response ciphertext hash in the response event record, and decrypts the response ciphertext to obtain the plaintext retrieval result if the verification is successful.

[0033] In some preferred embodiments, the method further includes: triggering on-demand arbitration when the querying party has doubts about the authenticity of the query results, or when the oversight committee conducts random checks on completed retrieval sessions, or when the data holder reports an execution anomaly, wherein the on-demand arbitration is conducted by the oversight committee reviewing the authorization and execution process under the principle of minimum disclosure, verifying membership based on the target database version snapshot, and giving a determination of responsibility.

[0034] In some preferred embodiments, the oversight committee reviews the authorization and execution process under the principle of minimum disclosure, verifies membership based on the target database version snapshot, and determines liability, including:

[0035] The supervisory committee collects evidence related to the current retrieval session based on the dispute triggering event, and obtains the corresponding database version commitment, authorization event record and response event record from the evidence storage chain to perform basic consistency verification;

[0036] After the basic consistency verification is passed, the supervisory committee will determine whether the responsibility lies with the querying party based on whether the querying party provides session decryption materials and whether the decryption materials pass verification.

[0037] When the decryption materials provided by the querying party are verified, the supervisory committee, based on the target database version snapshot and membership certificates related to the disputed records, examines the data holder's actions and confirms the data holder's or querying party's responsibilities.

[0038] The supervisory committee shall form a decision and corresponding penalty or corrective measures through a threshold arbitration mechanism, and submit a summary of the decision to the evidence storage chain in the form of a decision record for subsequent accountability and auditing.

[0039] Secondly, a regulatory privacy information retrieval device is provided, the device comprising:

[0040] The encoding and commitment initialization module is used for: the data holder to complete a publicly verifiable cryptographic commitment to the database version during the system initialization phase and record the database version commitment to the evidence storage chain; and the supervisory committee to establish a threshold signature system based on the distributed key generation protocol.

[0041] The query and joint authorization module is used for: the supervisory committee to conduct compliance review of the external authorization credentials and authorization messages provided by the querying party; when the review is passed, a threshold signature is generated through the threshold signature system and the authorization event is recorded in the evidence storage chain; the querying party assembles an authorization query package based on the threshold signature returned by the supervisory committee and submits it to the data holder, so that the data holder can verify the threshold signature and the authorization query package;

[0042] The kernel execution and response commitment module is used to: when the data holder verifies the threshold signature and the authorized query package and confirms that the authorization is legal and consistent with the database version commitment, call the privacy information retrieval PIR kernel to perform privacy retrieval, generate response ciphertext, record response events related to the query ciphertext and response ciphertext to the evidence storage chain, and support the querying party to verify and decrypt the response based on the response event records;

[0043] The arbitration and liability determination module is used to: trigger on-demand arbitration when the querying party has doubts about the authenticity of the query results, when the supervisory committee conducts random inspections, or when the data holder reports anomalies; review the authorization and execution process under the principle of minimum disclosure; verify membership based on the target database version snapshot; give a liability determination based on the version commitment, authorization event, and response event records in the evidence storage chain; and record the decision summary to the evidence storage chain.

[0044] Thirdly, a regulatory privacy information retrieval device is provided, the device comprising:

[0045] At least one processor;

[0046] At least one memory coupled to the at least one processor and storing instructions for execution by the at least one processor, the instructions implementing the method described in any of the above when executed by the at least one processor.

[0047] Fourthly, a computer-readable storage medium is provided, the computer-readable storage medium storing a computer program, which, when executed by a computer, is used to perform the method described in any of the above embodiments.

[0048] Fifthly, a computer program product is provided, the computer program product including instructions, which, when executed by a computer, cause the computer to perform the methods described above.

[0049] Compared with existing technologies, this invention has the following advantages and beneficial effects: it achieves regulatory compliance without compromising PIR privacy, implements a commitment-based authorization mechanism, provides a fully verifiable chain of cryptographic evidence, supports on-demand minimum disclosure arbitration and precise accountability, and decouples regulatory overhead from database size, making it suitable for large-scale deployment. Attached Figure Description

[0050] To more clearly illustrate the technical solutions of the exemplary embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly described below. It should be understood that the following drawings only show some embodiments of the present invention and should not be considered as limiting the scope. For those skilled in the art, other related drawings can be obtained from these drawings without creative effort.

[0051] Figure 1 This is a flowchart of a supervised privacy information retrieval method according to an embodiment of the present invention.

[0052] Figure 2 This is a schematic diagram illustrating the interaction of four types of participants according to an embodiment of the present invention.

[0053] Figure 3 This is a structural block diagram of a regulatory privacy information retrieval device according to an embodiment of the present invention.

[0054] Figure 4 This is a schematic diagram of the structure of a regulatory privacy information retrieval device according to an embodiment of the present invention. Detailed Implementation

[0055] To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the embodiments and accompanying drawings. The illustrative embodiments and descriptions of the present invention are only used to explain the present invention and are not intended to limit the present invention.

[0056] To address the shortcomings of existing Privacy Information Retrieval (PIR) schemes, such as a lack of oversight capabilities, strong coupling between the authorization process and query content, lack of verifiable and accountable results, and excessively high regulatory costs or strong coupling with database size, this invention provides an oversightable privacy retrieval scheme for achieving compliant authorization and auditable access in privacy information retrieval scenarios. Unlike the traditional regulatory model of "authorization after a single trusted approval agency views the query plaintext," this invention introduces mechanisms such as multi-party oversight committees, threshold authorization, and on-chain evidence storage. Without requiring any single entity to know the query plaintext (in some high-compliance scenarios, it is acceptable for approval agencies to view the query plaintext; however, in scenarios requiring multi-party collaboration, cross-agency supervision, or reduced single-point trust, existing schemes lack a technical mechanism to complete authorization and auditing without relying on plaintext visibility), it supports authorization decisions and post-event accountability for encrypted queries. This reduces the trust assumptions of a single point of approval entity and is compatible with high-compliance business scenarios such as prosecution.

[0057] The technical solution of this invention adopts a regulatory privacy information retrieval framework of "three-layer structure + four types of participants + four-stage life cycle".

[0058] (1) Three-layer structure.

[0059] Kernel Layer: Encapsulates existing PIR protocols, performs keyword matching, Boolean queries, and result aggregation in the ciphertext field, and presents a fixed circuit and shape-based response to the outside world, ensuring the hiding of query semantics and access patterns. Any homomorphic encryption scheme that meets a preset security level can be used at the kernel layer. In one embodiment, the kernel layer uses the BFV (Brakerski-Fan-Vercauteren) homomorphic encryption scheme to implement CwPIR (Constant Weight Privacy Information Retrieval), supporting single-round, single-server keyword queries. In another embodiment, the kernel layer uses a PIR scheme that supports Boolean expressions to implement combined queries of multiple keywords and logical operations (AND, OR, NOT). The specific implementation of the kernel can be replaced with other PIR schemes that have single-round communication and fixed circuit characteristics. The regulatory framework of this invention does not depend on a specific PIR kernel or specific cryptographic parameters. The BFV parameters can be selected as N=2^13~2^15, and the total bit width of the module chain Bq≈200 bits to meet an 80~128 bit security level; specific configuration can be based on the recommended parameters of the external PIR kernel.

[0060] Oversight layer: The oversight committee uses mechanisms such as BLS (Boneh-Lynn-Shacham) threshold signature to jointly authorize queries, conduct compliance reviews, and arbitrate disputes. The oversight object is the cryptographic commitment of the query and the result, rather than the plaintext content, thus achieving blind authorization and minimal disclosure arbitration.

[0061] Audit layer: Any blockchain or transparent log system that supports tamper-proof logs can be used to achieve tamper-proof evidence storage of key events such as database version commitments, authorization events, response commitments, and arbitration conclusions, forming a time-ordered chain of evidence.

[0062] (2) Four types of participants.

[0063] The querying party (Client, denoted as) ): Legitimate data retrieval initiators, such as evidence collectors or law enforcement agencies, are responsible for constructing privacy queries, generating query commitments, requesting authorization, and verifying and decrypting responses.

[0064] Data Holder (hereinafter referred to as) ): Entities that maintain structured databases and provide PIR computing services, such as operators and internet platforms, are responsible for generating database version commitments, verifying authorizations, executing PIR kernels, and committing to the response results.

[0065] Supervision Committee (referred to as A supervisory committee is a multi-party entity composed of multiple regulatory agencies or functional departments, employing a (t,n) threshold trust model. It is responsible for distributed key generation, query compliance review, threshold authorization, and dispute arbitration, where t represents the threshold and n represents the total number of participants. In one embodiment, the supervisory committee consists of multiple supervisory nodes used to control the authorization of query requests from the querying party. Query requests may include the query plaintext and its encrypted form, or only the encrypted representation and proof generated based on the query plaintext. In another embodiment, the supervisory committee only receives the encrypted form of the query request or the proof based on the ciphertext. Each supervisory node does not need to obtain the complete query plaintext during the authorization process, and threshold signatures / multi-party computations ensure that no single supervisory node can independently recover the query plaintext, thereby preventing the authorization process from becoming a single point of leakage of query intent.

[0066] Ledger (notation) ): Consortium blockchains or other transparent logging systems are used to anchor database version commitments, authorization summaries, response commitments, and arbitration conclusions, providing globally consistent, tamper-proof timestamps and publicly verifiable evidence storage services.

[0067] (3) Four-stage life cycle.

[0068] The entire scheme can be executed in the following four stages: (1) Stage 1: Encoding and commitment initialization (offline); (2) Stage 2: Query and joint authorization (online); (3) Stage 3: Kernel execution and response commitment (online); (4) Stage 4: Dispute arbitration and liability determination (on demand).

[0069] Based on the above architecture, on the one hand, the present invention provides a regulatory method for retrieving privacy information. Figure 1 This is a flowchart illustrating a supervised privacy information retrieval method according to an embodiment of the present invention. (Reference) Figure 1 The method includes steps S10 to S30.

[0070] Figure 2 This is a schematic diagram illustrating the interaction of four types of participants according to an embodiment of the present invention. The following references... Figure 1 and Figure 2 The method for retrieval of privacy information under regulatory control according to the present invention will be described in detail.

[0071] In S10, the data holder completes a publicly verifiable cryptographic commitment to the database version during the system initialization phase and records the database version commitment to the evidence storage chain. The supervisory committee establishes a threshold signature system based on a distributed key generation protocol. Specifically, S10 includes: First, the data holder independently completes a publicly verifiable cryptographic commitment to the database version during the system initialization phase and records the database version commitment to the evidence storage chain for subsequent authorization review, retrieval execution, and dispute arbitration. Then, the supervisory committee conducts a compliance review of the external authorization credentials and authorization messages provided by the querying party. If the review is successful, a threshold signature is generated for the authorization message using the threshold signature system, and information related to the authorization event is recorded to the evidence storage chain. Finally, the querying party constructs an authorization query package based on the threshold signature and submits it to the data holder, enabling... The data holder can verify the threshold signature and authorization context. Then, after the data holder verifies the threshold signature and authorized query package, confirms the authorization is legitimate, and ensures that the database version commitment and other context bindings are consistent, the data holder calls the Privacy Information Retrieval (PIR) kernel to perform a privacy retrieval, generates a ciphertext response, and records the response events related to the query ciphertext and response ciphertext to the evidence storage chain. Finally, the querying party verifies the locally calculated query ciphertext hash and response ciphertext hash based on the response events recorded on the evidence storage chain, and decrypts the response ciphertext to obtain the plaintext retrieval result if the verification is successful.

[0072] In some embodiments, the data holder generates a database version commitment and records it on the blockchain, where an oversight committee verifies the consistency of the database version commitment. In other embodiments, the database version commitment is generated independently by the data holder, and a snapshot of the commitment is securely sent to the oversight committee, which verifies it only during the dispute arbitration phase. In still other embodiments, the database version commitment is generated independently by the data holder and uploaded to the blockchain, with the oversight committee verifying it only during the dispute arbitration phase.

[0073] For example, S10 is implemented by the following S11 to S13.

[0074] In S11, the data holder generates a database version number, a key hash sequence, a leaf hash, and a root hash based on a database snapshot and sends them to the oversight committee (i.e., the database encoding is generated with Merkle commitments). S11 can be implemented, for example, through the following steps.

[0075] S111: The data holder extracts a logically consistent database snapshot from the business system. :

[0076] ;

[0077] in, As keywords, For the corresponding load, N is the number of snapshots, and i is the snapshot number. This is the version number.

[0078] S112: Calculate a hash identifier for each key in the database snapshot. :

[0079] ;

[0080] And, according to Sorting by lexicographical order yields the key hash sequence. , This represents a hash function.

[0081] S113: Perform constant repetition encoding and payload commitment for each hash sequence record, including: calling the constant repetition encoding function. Obtain a binary vector of fixed length and fixed Hamming weights. ; Computational load commitment ; Concatenate and calculate leaf hashes :

[0082] ;

[0083] in, Represents a leaf node. Indicates homomorphic encryption; This indicates a string concatenation operation.

[0084] S114: with As leaves, construct a binary Merkle tree to obtain the root hash. This serves as a global commitment for the database version.

[0085] In S12, the oversight committee verifies the key hash sequence and the root hash and records a snapshot of the verified result (i.e., snapshot delivery and oversight verification). S12 can be implemented, for example, through the following steps.

[0086] S121: The data holder sends the database version number to the oversight committee. Key hash sequence Leaf list and root hash .

[0087] S122: Oversight Committee Inspection Is it strictly monotonic (to ensure key uniqueness), and reconstruct the Merkle tree locally to verify the calculated root and... Check for consistency. Once verification is successful, record the snapshot as the regulatory version snapshot. .

[0088] In S13, the oversight committee records the database version number, root hash, and timestamp on the evidence storage chain. Using a distributed key generation protocol, a threshold signature system is established to obtain the committee's public key and each member's private key share (i.e., version commitment chain anchoring and threshold signature initialization). For example, S13 can be implemented through the following steps.

[0089] S131: The oversight committee accesses the evidence storage link to... Submit to the blockchain and obtain a transaction identifier. This serves as the unified reference for this version. Represents a timestamp.

[0090] S132: The oversight committee establishes a distributed key generation protocol. Threshold signature system, obtaining the committee's public key and the private key share of each committee member , Indicates the first Each committee member's share of private keys.

[0091] Merkle tree hash algorithms can be SHA (Secure Hash Algorithm)-256, SHA3-256, etc., with an output length of 32 bytes.

[0092] The threshold signature parameter can be selected as a 256-bit bilinear group to ensure that it matches the homomorphic encryption security level.

[0093] In this invention, a Merkle tree is used to implement database version commitment. Alternatively, vector commitment, multi-hash structures, etc., can also be used. The evidence storage chain can be a consortium blockchain, a public blockchain, or other audit log systems or hardware security log modules with tamper-proof characteristics, as long as they can provide non-repudiable and verifiable version and behavior records. In one embodiment, a consortium blockchain system based on the Byzantine Fault Tolerance algorithm (such as PBFT (Practical Byzantine Fault Tolerance) consensus) is used, jointly maintained by oversight committee members and other institutions. In another embodiment, transparent log technologies such as certificate transparency logs and verifiable logs (such as hash tree logs in the style of Consistency + RFC 6962) can be used, as long as they meet the requirements of immutability and public verifiability.

[0094] The threshold signature used by the oversight committee can be BLS threshold signature, RSA (Rivest-Shamir-Adelman public-key cryptography algorithm) threshold signature, or ECDSA (elliptic curve digital signature algorithm) threshold signature. It can also use the multi-party computation (MPC) protocol to generate joint authorization credentials; multi-signature, threshold access control lists, etc., are also acceptable. BLS threshold signature based on bilinear pairing is recommended because of its short signature length, ease of aggregation, and suitability for on-chain evidence storage. Schnorr threshold signature, threshold ECDSA, etc., can also be used, as long as they satisfy the requirement of unforgeable existence under adaptive selected message attacks.

[0095] S10 provides a unified version baseline and authorization basis for all subsequent online queries. The overhead of this stage increases linearly with the number of records N, but it can be completed offline before the version is released and amortized over a large number of queries.

[0096] In S20, the oversight committee reviews the external authorization credentials and authorization message provided by the querying party for compliance. Upon successful review, a threshold signature is generated using the threshold signature system, and the authorization event is recorded on the evidence storage chain. The querying party assembles an authorization query package based on the threshold signature returned by the oversight committee and submits it to the data holder, enabling the data holder to verify the threshold signature and authorization query package (i.e., query and joint authorization). Specifically, S20 includes: First, the querying party generates an authorization message for the query keyword based on the target database version number and the root hash in the database version commitment, and submits the authorization message and external authorization credentials to the oversight committee. The authorization message includes: a query ciphertext commitment for identifying subsequent query ciphertext, a root hash, and at least one or more of the following: a policy identifier, a querying party identifier, a current timestamp, a random number, a validity period, and a circuit shape description parameter. The oversight committee performs a compliance check on the authorization message based on the external authorization credentials, the policy identifier, the querying party identifier, and the circuit shape description parameter. If the compliance check passes, at least a predetermined number of committee members use their respective private key shares to partially sign the authorization message and synthesize it into a full threshold signature. The hash of the authorization message, the full threshold signature, and context information such as the current timestamp are recorded in the evidence storage chain in the form of an authorization event, and the full threshold signature is sent to the querying party. The querying party assembles the query ciphertext, the authorization message, and the full threshold signature into an authorization query package and sends it to the data holder. The data holder verifies the full threshold signature and verifies the legality of the authorization context and its consistency with the current database version commitment based on the validity period, root hash, and policy identifier in the authorization message.

[0097] For example, S20 is implemented through S21 to S24.

[0098] S21: The querying party generates an authorization message based on the target database version and the root hash in the database version commitment, targeting the query keywords, and submits the authorization message along with external authorization credentials to the oversight committee (the querying party constructs the privacy query and authorization message). The authorization message includes: query ciphertext commitment, root hash, policy identifier, querying party identity identifier, current timestamp, random number, validity period, and circuit shape description parameters. For example, S21 can be implemented through the following steps.

[0099] S211: The querying party selects the target database version According to S10 As a reference for queries.

[0100] S212: For query keywords Calculate hash Obtained through constant repetition encoding .

[0101] S213: Use a homomorphic encryption scheme (such as BFV) to... Encryption, obtaining the query ciphertext .

[0102] S214: Generate a Query Ciphertext Commitment Get the current timestamp Nonce and validity period , This indicates the preset validity period (time increment). The commitment expires after this time. This indicates a commitment to query encrypted messages.

[0103] S215: Generate circuit shape description parameters based on the queried circuit structure (number of keywords, Boolean expression shape, etc.). .

[0104] S216: Will ;

[0105] in, Indicates the strategy identifier used. The message represents the identity of the querying party and is packaged into an authorization message using a fixed encoding function. and external authorization credentials Submit it to the oversight committee together.

[0106] S22: The oversight committee conducts a compliance check on the external authorization credentials, policy identifier, queryer identity identifier, and circuit shape description parameters. After the compliance check is passed, the committee members, based on at least a preset number of members, use their respective private key shares to partially sign the authorization message and further synthesize it into a full threshold signature. The committee also records the hash of the authorization message, the full threshold signature, and the current timestamp on the evidence storage chain and sends the full threshold signature to the queryer (oversight committee compliance review and threshold authorization). For example, S22 can be implemented through the following steps.

[0107] S221: Oversight Committee verifies external authorization credentials Verify the authenticity (e.g., signature, validity period, etc.) and check the strategy identifiers used. Identity of the inquirer Circuit shape description parameters Does it meet the internal access policy?

[0108] S222: After the compliance check is passed, at least Each committee member uses their respective private key share to access the message. Perform partial signature to obtain , Indicates partial signature. This represents a partial signature generation function in the BLS threshold signature scheme, and j represents the supervisory committee number.

[0109] S223: Use the aggregation algorithm to combine the partial signatures into a complete threshold signature. , This represents the aggregation algorithm for BLS threshold signatures. This refers to the set of committee members who participated in this signature.

[0110] S224: Will Submit to the evidence storage chain for anchoring and generate an authorization event record. .

[0111] S225: Full threshold signature Returned to the querying party.

[0112] S23: The querying party assembles the query ciphertext, authorization message, and full threshold signature into an authorized query package (the querying party assembles the authorized query package and submits it to the data holder) and sends it to the data holder. Specifically, the querying party will... Authorization message With full threshold signature Assemble into an authorization query package :

[0113] .

[0114] Then, the authorized query package is sent to the data holder. .

[0115] S24: The data holder verifies the query ciphertext, the full threshold signature, the validity period in the authorization message, and the root hash (the data holder verifies the federated authorization and context binding). For example, S24 can be implemented through the following steps.

[0116] S241: Data holder uses verify Ensure that authorizations are jointly issued by at least a threshold number of committee members. This represents the BLS signature verification function.

[0117] S242: Check the authorization message Check if it has not expired to prevent re-playing.

[0118] S3243: Inspection Is it equal to the current service version root? To prevent the authorization from being misused for other database versions, Indicates authorization message The Merkle root version recorded in the file represents the specific data version for which the authorization is applied.

[0119] S244: Verification Is it related to the authorized message? To ensure consistency with the records and prevent the replacement of encrypted queries after authorization, Indicates querying ciphertext The calculated hash value is the ciphertext promise for the query.

[0120] S245: After all the above checks pass, the authorization is deemed legal and the context binding is consistent, and the PIR kernel is executed in S30.

[0121] Through S20, an integrated authorization and threshold control of "query ciphertext + context" is achieved: any query that has not been signed by a majority of committee members, a query with an inconsistent version, an expired authorization, or a query whose ciphertext has been replaced will be rejected.

[0122] In S30, once the data holder has verified the threshold signature and authorized query package and confirmed that the authorization is legitimate and consistent with the database version commitment, the privacy information retrieval PIR kernel is invoked to perform a privacy retrieval, generate a response ciphertext, record the response events related to the query ciphertext and response ciphertext to the evidence storage chain, and support the querying party to verify and decrypt the response based on the response event records.

[0123] Specifically, S30 includes: First, the data holder, based on the query ciphertext in the authorized query package, calls the PIR kernel to perform privacy information retrieval on the database corresponding to the target database version, generates a response ciphertext, and calculates the query ciphertext hash and the response ciphertext hash. Information such as the database version number, root hash, query ciphertext hash, response ciphertext hash, and current timestamp are packaged into a response event transaction and submitted to the evidence storage chain to obtain a response event transaction identifier. Then, the response ciphertext, response ciphertext hash, and response event transaction identifier are sent to the querying party. Finally, the querying party, based on the response event transaction identifier, reads the corresponding response event record from the evidence storage chain, compares and verifies the locally calculated query ciphertext hash and response ciphertext hash with the query ciphertext hash and response ciphertext hash in the response event record, and decrypts the response ciphertext to obtain the plaintext retrieval result if the verification is successful.

[0124] For example, S30 is implemented through S31 and S32.

[0125] In S31, the data holder executes the PIR kernel and generates a response ciphertext, and records the query ciphertext hash, response ciphertext hash, root hash, and current timestamp on the evidence storage chain to obtain the response event transaction identifier. The data holder then sends the response ciphertext, response ciphertext hash, and response event transaction identifier to the querying party (the data holder executes the PIR kernel and generates a response commitment). For example, S31 can be implemented through the following steps.

[0126] S311: Provided that S20 verification is passed, the data holder invokes the encapsulated PIR kernel:

[0127] ;

[0128] Thus, a ciphertext response commitment is obtained. , This represents the evaluation function of the PIR kernel, used to perform privacy queries. The version is indicated as The database or collection of data is the data source for this query.

[0129] S312: Calculate the hash of the response commitment :

[0130] .

[0131] S313: Call the evidence storage link port, Anchored as response event metadata to obtain transaction identifier .

[0132] S314: The data holder returns a triplet to the querying party. This serves as the response to the query.

[0133] In S32, the querying party, based on the record of the response event transaction identifier read from the evidence storage chain, verifies the locally calculated query ciphertext hash and response commitment hash, and decrypts the response commitment to obtain the plaintext result if the verification passes (the querying party verifies the consistency of the response commitment and decrypts the result). For example, S32 can be implemented through the following steps.

[0134] S321: The querying party reads the identifier from the evidence storage chain. The record obtains on-chain evidence. The fields, etc., represent the on-chain evidence storage. .

[0135] S322: Check locally calculated Is it equal to and locally computed Is it equal to and This confirms that the encrypted response has indeed been committed on-chain by the data holder in the context of the correct version.

[0136] S323: Provided the commitments are consistent, the querying party uses its own decryption key pair. Decrypt to obtain the plaintext result. .

[0137] S324: The querying party may perform simple consistency checks based on business logic (such as comparing with other channels, checking the range of results, etc.). If obvious anomalies are found, the party may choose to proceed to S40 dispute arbitration.

[0138] The S30 commitment verification relies only on fixed-length hashes and on-chain records, thus decoupling communication and computational overhead from database size.

[0139] In some embodiments, privacy retrieval techniques can be, for example, indexed PIR, PIR based on different homomorphic encryption schemes, searchable symmetric encryption, or ORAM (Oblivious Random Access Machine) based queries. The key is to be able to perform retrieval operations on the database without revealing the query intent or target record.

[0140] In S40, on-demand arbitration is triggered when the querying party has doubts about the authenticity of the query results, the oversight committee conducts random checks on completed retrieval sessions, or the data holder reports execution anomalies. In on-demand arbitration, the oversight committee reviews the authorization and execution process under the principle of minimum disclosure, verifies membership based on the target database version snapshot, and gives a determination of responsibility. Specifically, S40 includes: First, the oversight committee collects evidence related to the current retrieval session based on the dispute triggering event, and obtains the corresponding database version commitment, authorization event record, and response event record from the evidence storage chain for basic consistency verification; then, after the basic consistency verification is passed, the oversight committee confirms whether the responsibility lies with the querying party based on whether the querying party provides session decryption materials and whether the decryption materials pass verification; then, when the decryption materials provided by the querying party pass verification, the oversight committee examines the data holder's actions based on the target database version snapshot and membership proof related to the dispute record, and confirms the responsibility of the data holder or the querying party; finally, the oversight committee internally forms an arbitration result and corresponding penalties or corrective measures through a threshold arbitration mechanism, and submits the decision summary to the evidence storage chain in the form of a decision record for subsequent accountability and auditing.

[0141] Specifically, S40 is implemented through S41 to S42. In S41, the oversight committee performs basic verification (evidence collection and basic consistency check) based on the relevant evidence collected from the dispute-triggered event and the recorded data obtained from the evidence storage chain. For example, S41 can be implemented through the following steps.

[0142] S411: The oversight committee collects relevant evidence based on the dispute-triggered event. Relevant evidence includes: authorized query packages. ciphertext response commitment Database version On-chain authorization records On-chain response records wait.

[0143] S412: Obtained from the evidence storage chain Metadata, etc., are independently verified:

[0144] This indicates that the authorization is valid;

[0145] This indicates that the ciphertext query is consistent with the authorization binding;

[0146] This indicates that the ciphertext of the response is consistent with the on-chain commitment;

[0147] On-chain The version root is the same as the one saved in the oversight committee's snapshot, indicating that the same database version is being used.

[0148] If any of the above steps fail, the corresponding party can be directly determined to have a problem (such as submitting forged evidence or inconsistent versions), and a conclusion on responsibility can be drawn accordingly.

[0149] In S42, after the basic verification is passed, the oversight committee determines whether the responsibility lies with the querying party based on whether the querying party provides decryption materials for the session or whether the decryption materials have passed verification; or, based on the verification results of the decryption materials, determines whether the responsibility lies with the data holder or the querying party (minimum disclosure decryption and membership verification). For example, S42 can be implemented through the following steps.

[0150] S421: Provided the basic verification passes, the oversight committee requests the decryption materials (such as a one-time session key or ciphertext tag) from the querying party for decryption within the oversight-controlled environment. and .

[0151] S422: If the inquiring party refuses to provide or the decrypted materials provided cannot be verified, it can be considered that the inquiring party is uncooperative or suspected of forgery during the dispute process, and the inquiring party's responsibility can be directly determined.

[0152] S423: After successful decryption, the oversight committee obtains the encoded vector. Plain text of the result The calculation results are promised. Construct leaf hash :

[0153] ;

[0154] S424: Snapshot from the Regulatory Side Leaf hash of middle-derived form Merkle's proof and verification: , express Merkle's proof.

[0155] If membership verification fails, it means that the data holder returned results that were not in the promised snapshot (e.g., using an expired database or tampering with the results), and the data holder's responsibility can be determined. If verification succeeds but the dispute is initiated by the querying party, it means that the results are consistent with the promised database, the querying party's appeal is unfounded, and the querying party's responsibility can be determined.

[0156] In S43, the supervisory committee internally forms a ruling and corresponding penalties or corrective measures through a threshold arbitration mechanism, and records a summary of the ruling on the blockchain as a ruling record (ruling formation and on-chain recording). S43 can be implemented, for example, through the following steps.

[0157] S431: The oversight committee internally uses a threshold arbitration mechanism (such as threshold signatures for the ruling) to reach a final ruling. And determine the corresponding penalties or corrective measures. .

[0158] S432: Summary of the ruling Anchored to the evidence storage chain, generating adjudication records. , This indicates the final ruling, representing the oversight committee's final determination on the query operation, data integrity, or compliance.

[0159] S433: Implement appropriate corrective measures and, where necessary, provide feedback on the ruling to the relevant entities (such as courts, disciplinary inspection departments, etc.).

[0160] The default leak only shows the parameters describing the circuit shape. Along with macro-level metadata such as authorization frequency, the risk of statistical leakage can be further reduced by normalizing query shape, filling small-scale queries, or using differential privacy processing of logs. Dispute arbitration only decrypts a single session when necessary, and can be completed in a Trusted Execution Environment (TEE) or isolated environment. Decrypted materials and cached data are promptly destroyed after arbitration.

[0161] Through S40, this invention achieves "openable privacy protection": plaintext queries and results are not exposed in the normal query path. In case of a dispute, a highly trusted supervisor reconstructs the execution process with minimal necessary disclosure and provides a verifiable liability determination based on Merkle snapshots and on-chain records. The objects disclosed during arbitration can be partial ciphertext, plaintext fragments, complete / partial commitment paths, or zero-knowledge proofs, etc. The specific disclosure strategy can be adjusted in granularity and order according to business needs, as long as the principle of "minimizing additional disclosure while ensuring the adjudicability of disputes" is met.

[0162] Compared with the prior art, the present invention has the following beneficial effects.

[0163] (1) Achieve regulatory compliance without compromising PIR privacy.

[0164] By treating PIR as the core of privacy retrieval and constructing a "supervisory shell" based on commitments and threshold signatures, regulators only access the encrypted commitments and digests, not the plaintext content. This technically avoids the contradiction that traditional monitoring compromises privacy. This invention, through PIR-based encrypted query representation, threshold authorization by a supervisory committee, and on-chain evidence storage mechanisms, enables the authorization and auditing of privacy retrieval operations without exposing the complete plaintext query to any single participant. This reduces the trust requirements of a single point of approval and enhances the system's resistance to abuse and accountability.

[0165] (2) Implement a commitment-based authorization mechanism.

[0166] The supervisory committee oversees the authorization of consumption. Threshold signing is performed based on query commitment, database version, and access policy, rather than plaintext query content, achieving "decoupling of approval process and query semantics." This satisfies compliance requirements while protecting the information of the investigated party. In scenarios where the approval agency is considered completely trustworthy, the framework of this invention can also support the authorizing party's use with plaintext visible, while preserving on-chain records and minimum disclosure arbitration capabilities, providing a unified technical foundation for practical deployments under different trust models.

[0167] (3) Provide a fully verifiable chain of cryptographic evidence.

[0168] From the database version root, authorization digest, response commitment to arbitration award, everything is anchored to the evidence storage chain. Any subsequent denial or attempt to tamper with the record by any party will contradict the evidence on the chain, achieving end-to-end non-repudiation and strong auditing capabilities.

[0169] (4) Support minimum disclosure arbitration and precise accountability triggered on demand.

[0170] Only in the event of verification failure or random sampling will the oversight committee decrypt a single query session in a controlled environment, use a self-sustaining snapshot to complete Merkle membership verification, accurately identify whether the queryer is falsifying data or the data holder is acting maliciously, thereby achieving a refined division of responsibilities.

[0171] (5) Regulatory overhead is almost decoupled from database size, making it suitable for large-scale deployment.

[0172] The online query path involves only a small number of hash operations, BLS signature verification, and on-chain anchoring, and the communication overhead is basically unrelated to the number of database records; Merkle snapshots are only stored locally on the supervisory side and used for arbitration, and are not transmitted with each query, which is conducive to practical implementation in large database scenarios.

[0173] (6) The architecture is loosely coupled and has good forward compatibility.

[0174] The regulatory framework is decoupled from the PIR kernel through a constant repetition coding interface, which can be combined with existing solutions such as CwPIR, or integrated with other PIR protocols, and has good scalability and engineering reuse value.

[0175] On the other hand, the present invention provides a regulatory privacy information retrieval device. Figure 3 This is a structural block diagram of a manageable privacy information retrieval device according to an embodiment of the present invention. (Reference) Figure 3 The device includes: an encoding and commitment initialization module, a query and federated authorization module, and a kernel execution and response commitment module.

[0176] The encoding and commitment initialization module is used for: the data holder to complete a publicly verifiable cryptographic commitment to the database version during the system initialization phase and record the database version commitment to the evidence storage chain; and the supervisory committee to establish a threshold signature system based on the distributed key generation protocol.

[0177] The query and joint authorization module is used for: the oversight committee to conduct compliance review of the external authorization credentials and authorization messages provided by the querying party; when the review is passed, a threshold signature is generated through the threshold signature system and the authorization event is recorded to the evidence storage chain; the querying party assembles an authorization query package based on the threshold signature returned by the oversight committee and submits it to the data holder, so that the data holder can verify the threshold signature and the authorization query package.

[0178] The kernel execution and response commitment module is used to: when the data holder verifies the threshold signature and authorized query package and confirms that the authorization is legal and consistent with the database version commitment, call the privacy information retrieval PIR kernel to perform privacy retrieval, generate response ciphertext, record response events related to the query ciphertext and response ciphertext to the evidence storage chain, and support the querying party to verify and decrypt the response based on the response event records.

[0179] In some embodiments, the device further includes an arbitration and liability determination module, configured to: trigger on-demand arbitration when the querying party has doubts about the authenticity of the query results, when the supervisory committee conducts random inspections, or when the data holder reports an anomaly; review the authorization and execution process under the principle of minimum disclosure; verify membership based on the target database version snapshot; give a liability determination based on the version commitment, authorization event, and response event records in the evidence storage chain; and record a summary of the decision to the evidence storage chain.

[0180] Further details regarding this regulated privacy information retrieval device can be found in the description of regulated privacy information retrieval methods above, and will not be repeated here.

[0181] In implementing the functions of the integrated modules described above in hardware, this embodiment of the invention provides a structure for a regulatory privacy information retrieval device as described in the above embodiments. Figure 4 This is a schematic diagram of the structure of a manageable privacy information retrieval device according to an embodiment of the present invention. (Reference) Figure 4 The regulated privacy information retrieval device includes: at least one processor; and at least one memory. The at least one memory is coupled to the at least one processor and stores instructions for execution by the at least one processor, which, when executed by the at least one processor, implement the method described above.

[0182] A processor can be a set of logic blocks, modules, and circuits that implement or execute the various exemplary logic blocks, modules, and circuits described in connection with embodiments of the present invention. The processor can be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute the various exemplary logic blocks, modules, and circuits described in connection with embodiments of the present invention. A processor can also be a combination that implements computational functions, such as a combination of one or more microprocessors, a combination of a digital signal processor and a microprocessor, etc.

[0183] The memory may be read-only memory (ROM) or other types of static storage devices that can store static information and instructions, random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, electrically erasable programmable read-only memory (EEPROM), disk storage media or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer, but is not limited thereto.

[0184] In one implementation, the memory can exist independently of the processor. The memory can be connected to the processor via a bus and used to store instructions or program code. When the processor calls and executes the instructions or program code stored in the memory, it can implement the method provided in the embodiments of the present invention. In another implementation, the memory can also be integrated with the processor.

[0185] On the other hand, the present invention also provides a computer-readable storage medium (e.g., a non-transitory computer-readable storage medium) storing a computer program that, when run on a computer, causes the computer to perform the method as described in any of the above embodiments.

[0186] Exemplary examples show that the aforementioned computer-readable storage media may include, but are not limited to: magnetic storage devices (e.g., hard disks, floppy disks, or magnetic tapes), optical discs (e.g., compact disks (CDs), digital versatile disks (DVDs), etc.), smart cards, and flash memory devices (e.g., erasable programmable read-only memory (EPROMs), cards, sticks, or key drives, etc.). The various computer-readable storage media described in this invention may represent one or more devices and / or other machine-readable storage media for storing information. The term "machine-readable storage medium" may include, but is not limited to, wireless channels and various other media capable of storing, containing, and / or carrying instructions and / or data.

[0187] This invention provides a computer program that, when run on a computer, causes the computer to perform the method of any of the above embodiments.

[0188] This invention provides a computer program product containing instructions that, when run on a computer, cause the computer to perform the method of any of the above embodiments.

[0189] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for retrieval of privacy information that can be monitored, characterized in that, The method includes: During the system initialization phase, the data holder makes a publicly verifiable cryptographic commitment to the database version and records the database version commitment to the evidence storage chain. The supervisory committee establishes a threshold signature system based on the distributed key generation protocol. The supervisory committee conducts a compliance review of the external authorization credentials and authorization messages provided by the querying party. When the review is passed, a threshold signature is generated through the threshold signature system and the authorization event is recorded in the evidence storage chain. The querying party assembles an authorization query package based on the threshold signature returned by the supervisory committee and submits it to the data holder, so that the data holder can verify the threshold signature and the authorization query package. If the data holder verifies the threshold signature and the authorized query package and confirms that the authorization is legal and consistent with the database version commitment, the privacy information retrieval PIR kernel is invoked to perform a privacy retrieval, generate a response ciphertext, record the response events related to the query ciphertext and response ciphertext to the evidence storage chain, and support the querying party to verify and decrypt the response based on the response event records.

2. The method according to claim 1, characterized in that, During the system initialization phase, the data holder makes a publicly verifiable cryptographic commitment regarding the database version and records the database version commitment on the evidence storage chain. The oversight committee establishes a threshold signature system based on a distributed key generation protocol, including: During the system initialization phase, the data holder independently completes a publicly verifiable cryptographic commitment to the database version and records the database version commitment to the evidence storage chain for subsequent authorization review, retrieval execution and dispute arbitration. The supervisory committee conducts a compliance review of the external authorization credentials and authorization messages provided by the querying party. If the review is passed, the threshold signature system is used to generate a threshold signature for the authorization message, and information related to the authorization event is recorded in the evidence storage chain. The querying party constructs an authorization query package based on the threshold signature and submits it to the data holder, enabling the data holder to verify the threshold signature and the authorization context. If the data holder verifies the threshold signature and the authorized query package, confirms the authorization is legal and the database version commitment is consistent with the context binding, the data holder calls the privacy information retrieval PIR kernel to perform privacy retrieval, generates a response ciphertext, and records the response events related to the query ciphertext and response ciphertext to the evidence storage chain. The querying party verifies the locally calculated query ciphertext hash and response ciphertext hash based on the response event recorded on the evidence storage chain, and decrypts the response ciphertext to obtain the plaintext retrieval result if the verification is successful.

3. The method according to claim 2, characterized in that, The supervisory committee conducts compliance review of the external authorization credentials and authorization messages provided by the querying party. When the review is passed, a threshold signature is generated through the threshold signature system and the authorization event is recorded in the evidence storage chain. The querying party assembles an authorized query package based on the threshold signature returned by the oversight committee and submits it to the data holder, enabling the data holder to verify the threshold signature and the authorized query package, including: The querying party generates an authorization message for the query keywords based on the target database version number and the root hash in the database version commitment, and submits the authorization message and external authorization credentials to the oversight committee. The authorization message includes: a query ciphertext commitment and root hash for identifying subsequent query ciphertext, and at least one or more of the following: policy identifier, querying party identity identifier, current timestamp, random number, validity period, and circuit shape description parameters. The supervisory committee performs a compliance check on the authorization message based on the external authorization credential, the policy identifier, the queryer's identity identifier, and the circuit shape description parameters. If the compliance check passes, at least a preset number of committee members use their respective private key shares to partially sign the authorization message and synthesize it into a full threshold signature. The hash of the authorization message, the full threshold signature, and context information such as the current timestamp are recorded in the evidence storage chain in the form of an authorization event, and the full threshold signature is sent to the querying party; The querying party assembles the query ciphertext, the authorization message, and the full threshold signature into an authorized query package and sends it to the data holder. The data holder verifies the full threshold signature and verifies the legality of the authorization context and its consistency with the current database version commitment based on the validity period, root hash, and policy identifier in the authorization message.

4. The method according to any one of claims 1 to 3, characterized in that, If the data holder verifies the threshold signature and the authorized query package and confirms the authorization is legitimate and consistent with the database version commitment, the Privacy Information Retrieval (PIR) kernel is invoked to perform a privacy retrieval, generating a ciphertext response. Response events related to the ciphertext query and response are recorded in the evidence storage chain, and the querying party is supported in verifying and decrypting the response based on the recorded response events, including: The data holder invokes the PIR kernel based on the query ciphertext in the authorized query package to perform privacy information retrieval on the database corresponding to the target database version, generates a response ciphertext, calculates the query ciphertext hash and the response ciphertext hash, packages the database version number, root hash, query ciphertext hash, response ciphertext hash and current timestamp into a response event transaction and submits it to the evidence storage chain to obtain the response event transaction identifier. Send the ciphertext of the response, the hash of the ciphertext of the response, and the transaction identifier of the response event to the querying party; The querying party reads the corresponding response event record from the evidence storage chain based on the response event transaction identifier, compares and verifies the locally calculated query ciphertext hash and response ciphertext hash with the query ciphertext hash and response ciphertext hash in the response event record, and decrypts the response ciphertext to obtain the plaintext retrieval result if the verification is successful.

5. The method according to claim 4, characterized in that, The method further includes triggering on-demand arbitration when the querying party has doubts about the authenticity of the query results, or when the supervisory committee conducts random checks on completed retrieval sessions, or when the data holder reports an execution anomaly. The on-demand arbitration is conducted by the supervisory committee reviewing the authorization and execution process under the principle of minimum disclosure, verifying membership based on the target database version snapshot, and determining liability.

6. The method according to claim 5, characterized in that, The oversight committee, adhering to the principle of minimum disclosure, reviews the authorization and execution process, verifies membership based on the target database version snapshot, and determines liability, including: The supervisory committee collects evidence related to the current retrieval session based on the dispute triggering event, and obtains the corresponding database version commitment, authorization event record and response event record from the evidence storage chain to perform basic consistency verification; After the basic consistency verification is passed, the supervisory committee will determine whether the responsibility lies with the querying party based on whether the querying party provides session decryption materials and whether the decryption materials pass verification. When the decryption materials provided by the querying party are verified, the supervisory committee, based on the target database version snapshot and membership certificates related to the disputed records, examines the data holder's actions and confirms the data holder's or querying party's responsibilities. The supervisory committee shall form a decision and corresponding penalty or corrective measures through a threshold arbitration mechanism, and submit a summary of the decision to the evidence storage chain in the form of a decision record for subsequent accountability and auditing.

7. A regulated privacy information retrieval device, characterized in that, The device includes: The encoding and commitment initialization module is used for: the data holder to complete a publicly verifiable cryptographic commitment to the database version during the system initialization phase and record the database version commitment to the evidence storage chain; and the supervisory committee to establish a threshold signature system based on the distributed key generation protocol. The query and joint authorization module is used for: the supervisory committee to conduct compliance review of the external authorization credentials and authorization messages provided by the querying party; when the review is passed, a threshold signature is generated through the threshold signature system and the authorization event is recorded in the evidence storage chain; the querying party assembles an authorization query package based on the threshold signature returned by the supervisory committee and submits it to the data holder, so that the data holder can verify the threshold signature and the authorization query package; The kernel execution and response commitment module is used to: when the data holder verifies the threshold signature and the authorized query package and confirms that the authorization is legal and consistent with the database version commitment, call the privacy information retrieval PIR kernel to perform privacy retrieval, generate response ciphertext, record response events related to the query ciphertext and response ciphertext to the evidence storage chain, and support the querying party to verify and decrypt the response based on the response event records; The arbitration and liability determination module is used to: trigger on-demand arbitration when the querying party has doubts about the authenticity of the query results, when the supervisory committee conducts random inspections, or when the data holder reports an anomaly; review the authorization and execution process under the principle of minimum disclosure; verify membership based on the target database version snapshot; give a liability determination based on the version commitment, authorization event, and response event records in the evidence storage chain; and record a summary of the ruling in the evidence storage chain.

8. A regulated privacy information retrieval device, characterized in that, The device includes: At least one processor; At least one memory coupled to the at least one processor and storing instructions for execution by the at least one processor, the instructions implementing the method of any one of claims 1 to 6 when executed by the at least one processor.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a computer, performs the method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, The computer program product includes instructions that, when executed by a computer, cause the computer to perform the method according to any one of claims 1 to 6.

Images