An efficient fast-recoverable laconic inadvertent transmission protocol

Abstract

This invention discloses a highly efficient and rapidly recoverable Laconic inadvertent transmission protocol, dividing the protocol into a main part and an extension part. The main part includes system initialization, database digest generation, message encryption, decryption cache generation, and a message recovery phase. The system initialization phase requires execution by a trusted third party. In subsequent phases, the protocol operates between two parties, referred to as the receiver and the sender. The receiver holds the database, and the sender holds two messages and a selection index. After the protocol completes, the receiver can recover the message without knowing any information about the other message. The extension part includes digest update, decryption cache update, PSI receiver encoding, and PSI sender encoding steps. This invention significantly reduces the computational overhead for the receiver when decrypting and recovering messages, solving performance bottlenecks. It supports efficient database updates, has a flexible structure, and wide applicability.

Description

Technical Field

[0001] This invention relates to the fields of cryptography and secure computing, and in particular to an efficient Laconic unintentional transmission protocol based on bilinear mapping, and a Laconic private set intersection protocol built based on this protocol. Background Technology

[0002] With the advent of the era of cloud computing, the Internet of Things, and big data, data has become a core production factor. However, data silos are prevalent, and while there is a strong demand for collaborative data computing among different institutions and individuals, direct sharing of raw data is impossible due to privacy regulations, trade secrets, and security concerns. Against this backdrop, secure multi-party computation (MPC), as a powerful cryptographic framework, has emerged. MPC allows multiple participants to collaboratively compute a function without revealing their private inputs, obtaining only the final output. This technology can unlock data value while protecting data privacy, demonstrating enormous application potential in numerous fields such as secure voting, privacy-preserving machine learning, joint risk control, genomic analysis, and advertising effectiveness measurement.

[0003] In the MPC protocol family, Oblivious Transfer (OT) is a fundamental and crucial cryptographic primitive. It was first proposed by Rabin in 1981 and has undergone years of development and refinement. In a typical 1-out-of-2 OT protocol, the sender holds two messages (e.g., ... and The receiver has a selection bit. After the protocol is executed, the receiver will be able to successfully obtain the message. However, it simultaneously satisfies two core security attributes: First, the sender cannot know the receiver's choice. (Recipient's privacy); Second, in addition to the recipient's privacy, In addition, regarding another message Complete ignorance (sender security). OT is not only the cornerstone of building general-purpose MPC, but is also directly applied to various advanced cryptographic protocols such as privacy information retrieval, commitment schemes, and zero-knowledge proofs.

[0004] Early implementations of the OT protocol typically relied on computationally expensive public-key cryptographic operations. An intuitive implementation approach is for the receiver to select an index. Encoded as a "one-hot code" vector, that is, a code that is only hot on the first... A vector with one bit set to 1 and the rest to 0 is encrypted using a homomorphic encryption algorithm and sent to the sender. The sender then uses the homomorphic property to calculate the inner product of this vector and the database in the ciphertext. Finally, the receiver decrypts the ciphertext to obtain the desired data. Although this method is conceptually simple and clear, the computational and communication overhead is significant, especially when the database is large. The sender needs to perform a large number of homomorphic operations, making this method difficult to implement in practice.

[0005] To address these challenges, the research focus in cryptography has gradually shifted towards improving the efficiency of OT protocols. However, in many MPC application scenarios, especially in client-server models, there is an inherent asymmetry in the computational and communication capabilities of the participants. Servers typically possess powerful computing resources and stable network connections, while clients (such as smartphones and IoT sensors) are often resource-constrained devices. Traditional OT protocols require both parties to share a relatively balanced computational load, which leads to clients needing to process large amounts of data or perform complex calculations, resulting in unacceptable latency and energy consumption, significantly limiting the widespread adoption of MPC technology.

[0006] To address this core contradiction, the concept of Laconic Cryptography was proposed. Its design philosophy is that in a two-party protocol, the majority of the computational burden is allocated to the resource-rich party (usually the receiver), while the computational and communication overhead of the resource-constrained party (the sender) depends solely on the size of its own input, independent of the size of the resource-rich party's large database. Laconic OT, as a typical representative of this paradigm, possesses three key characteristics: (1) the protocol requires only two rounds of communication; (2) the length of the first message sent by the receiver (i.e., a "digest" of its large database) is fixed and can be reused in multiple interactions; (3) the sender's computation and the size of its second message depend only on the amount of data it sends. This allows the client to complete its task extremely quickly and transition to an offline state, making it very suitable for real-world interactions between mobile devices and cloud servers.

[0007] Despite ongoing research, existing technologies still face two prominent bottlenecks: First, there is the efficiency bottleneck in the recovery phase. In most existing Laconic OT schemes, the process by which the receiver recovers the target message from the sender's response in the final stage (i.e., the recovery phase) has high computational complexity and typically requires multiple steps. Even more cryptographic operations (such as exponentiation, bilinear pairing), in which This refers to the database size. When At high speeds, this stage becomes the performance bottleneck of the entire protocol, severely limiting system throughput and response speed. Secondly, dynamic data updates are inefficient. In many application scenarios, the receiver's database is not static but requires frequent operations such as adding, deleting, and modifying data. Many existing solutions often require regenerating the entire digest and related internal state when the database undergoes minor changes, incurring significant overhead. This inefficient update mechanism, where a single change affects the entire system, severely limits the application of Laconic OT in dynamic environments that require real-time or near-real-time data updates (such as real-time recommendation systems and dynamic access control lists). Summary of the Invention

[0008] Purpose of the invention: Based on existing technology, there is an urgent need in the field for a new Laconic OT protocol that, while maintaining the core advantages of Laconic cryptography (i.e., efficient sender and simple communication), significantly optimizes the performance of the receiver during the recovery phase and can efficiently support dynamic database updates, thereby providing a solid foundation for privacy-preserving computing applications with high concurrency, low latency, and dynamic data changes.

[0009] To address the problems and shortcomings of existing technologies, such as slow receiver recovery time and high protocol update costs during dynamic database updates, this invention provides a novel method for constructing the Laconic OT protocol to overcome these issues. This protocol offers the following advantages: High computational efficiency during the recovery phase: Significantly reduces the computational overhead for the receiver when decrypting the recovery message, thus resolving performance bottlenecks.

[0010] Supports efficient database updates: When the recipient's database undergoes partial changes, it can quickly update the digest and decryption cache with low computational overhead (O(n)), adapting to dynamic data scenarios.

[0011] Flexible construction and wide application: Based on this Laconic OT protocol, a Laconic private set intersection protocol with better performance can be constructed efficiently.

[0012] Related knowledge Bilinear mapping: Let and For two Factorial cyclic group yes The generator of bilinear mappings. It satisfies the following properties: 1) Bilinear: For any and ,have .

[0013] 2) Non-degradability: no The generator.

[0014] 3) Computability: There exists an efficient algorithm for computation. .

[0015] Laconic OT: Simple Inadvertent Transmission, it is a special inadvertent transmission protocol that includes four algorithms: 1)crsGen: Generates a common reference string and uses it to generate a key.

[0016] 2) Hash: The receiver compresses its database into a fixed-length digest.

[0017] 3) Send: The sender uses the digest and two messages to generate ciphertext.

[0018] 4) Receive: The receiver uses its database status information to decrypt and obtain the target message.

[0019] The core features of this protocol are: 1. The number of communication rounds is fixed at two; 2. The length of the first message (i.e., digest) of the receiver is fixed and can be reused; 3. The computational overhead of the sender is only related to the size of its own input and is independent of the size of the receiver's database.

[0020] n-DBDH Assumption: This assumption is fundamental to the security of this scheme. For a bilinear mapping... Given a tuple ,in yes generator, yes One of the random elements, yes The random elements in the matrix, for any probabilities in polynomial time, distinguish... and One of the random elements is computationally difficult to distinguish. and A random element in the equation is computationally difficult.

[0021] Technical Solution: A highly efficient and rapidly recoverable Laconic unintentional transmission protocol, divided into a main body and an extension body. The main body includes system initialization, database digest generation, message encryption, decryption cache generation, and message recovery. The system initialization phase requires execution by a trusted third party. In subsequent phases, the protocol operates between two parties, referred to as the receiver and the sender, with the receiver holding the database. (a length of of (vector), the sender holds two messages. and a selection index After the agreement is completed, the receiver can resend the message. (That is, if the database) The Position Then the message can be restored. ,like The Setting the bit to 1 allows the message to be recovered. ), and at the same time, they will not know about another message. Any information. The specific process will be described below.

[0022] The extended portion of the protocol includes steps for digest update, decryption buffer update, PSI receiver encoding, and PSI sender encoding. The digest update and decryption buffer update steps correspond to the receiver database. When changes occur One of them When changes occur, these two steps allow for rapid updates to the database digest and decryption cache without recalculation. Furthermore, a high-efficiency Laconic PSI protocol is built based on the Laconic OT protocol. In the Laconic PSI protocol, the receiver holds the data set. The sender holds the data set Through the Laconic PSI protocol, the receiver can eventually recover the set. ,right It will not know any information, and the entire protocol process retains the characteristics of Laconic Cryptography (two rounds of communication, the first round of messages has a fixed length and can be reused, and the second round of messages is independent of the size of the receiver's database). Through two steps—PSI receiver encoding and PSI sender encoding—a Laconic PSI protocol was successfully constructed using the Laconic OT protocol.

[0023] The following describes the specific implementation of each step of the protocol, starting with the main phases of the protocol: S1: System Initialization Executed by a trusted third party, with input security parameters and database length .set up for Bilinear group of order 1 for The generator. In the p-order prime field Randomly select elements ,calculate: for ,in Calculate the database length. and Then use the exponentiation operation on the group to calculate and and defined respectively ,Right now Output public key and private key .

[0024] Ultimately, a trusted third party will provide the public key. Send the private key to both the sender and receiver simultaneously. Send to the recipient.

[0025] S2: Generate database summary The recipient enters their private key. and database (a length of of (Vector). Random selection Calculate database summary: in Representing vectors The Bit, Indicates based on subscript The private key set generated in S1 Select the element at the corresponding position. Output a summary. and state Subsequently, the recipient sends the message digest. Send to the sender.

[0026] S3: Message Encryption The sender inputs the public key. Its selection index Two messages and the digest sent by the recipient Random selection ,calculate: in Indicates based on subscript The public key set generated in S1 Select the element at the corresponding position and use... Group exponentiation is performed using the power as a power.

[0027] Output ciphertext The sender will send the encrypted message. Send to the recipient.

[0028] S4: Generate decryption cache The recipient inputs the public key. Private key ,database and state For each position Calculate the decryption cache value: Output decryption cache set .

[0029] S5: Message Recovery Receiver input decryption buffer and ciphertext For each : calculate ; calculate ; if If it is a meaningful and expected message, then output As a result of the recovery.

[0030] The following is a detailed implementation of each step in the protocol's extension phase: E1: Summary Update When the receiver needs to modify the database... When entering the value of the bit, input the private key. Original Abstract Modify location and the original state Random selection Calculate the new summary: Output new summary New state and state increment .

[0031] E2: Decrypt cache update Input original decryption cache Public key Private key Original state and state increment For each Calculate the new decryption cache value: Output a new decryption cache set .

[0032] E3: PSI receiver encoding Input a simple hash function and the recipient's database .make Defined as a hash function value range, initialization .for Each element in ,calculate Let h() represent a hash function, and let Finally, the output is... As a database held by the recipient in the Laconic OT protocol.

[0033] E4: PSI sender code Input a simple hash function and the sender's database Initialize the collection It is an empty set. For Each element in ,calculate ,Will Add to collection ,in Indicates invalid output. Output set Ultimately, the sender and receiver run... The Laconic OT protocol, during each run, allows the selection of an index. Message sent .

[0034] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the efficient and fast-recoverable Laconic inadvertent transmission protocol as described above.

[0035] A computer-readable storage medium having a computer program / instructions thereon that, when executed by a processor, implements the steps of the efficient and fast-recoverable Laconic inadvertent transmission protocol as described above.

[0036] Beneficial effects: Compared with the prior art, the present invention has the following advantages: I. Significantly Improved Performance in the Recovery Phase: By introducing a pre-computed decryption caching mechanism and optimizing the core pairing and exponential operations, the computational complexity of the receiver during message recovery is reduced. Experiments show that this protocol improves performance by approximately 50% in the recovery phase compared to the existing best-in-class solution, effectively addressing the protocol's performance bottleneck.

[0037] II. Highly Efficient Dynamic Update Capability: When the receiver's database undergoes partial modifications, this invention provides specialized digest update and decryption cache update algorithms, resulting in an update overhead of only O(n), far superior to the O(n) required in existing technologies. This method involves globally recalculating the overhead. This makes this protocol particularly suitable for dynamic application scenarios where the database changes frequently.

[0038] Third, security is guaranteed: The security of the protocol is based on the standard n-DBDH difficulty assumption, which has been widely studied and is considered reliable in bilinear groups, ensuring the cryptographic robustness of the protocol.

[0039] IV. High scalability and wide application: This invention clearly demonstrates how to apply the proposed high-efficiency Laconic OT protocol to the construction of the Laconic PSI protocol. Due to the efficiency of the underlying OT protocol, the constructed PSI protocol also surpasses existing solutions in performance, providing a new and efficient tool for privacy-preserving set operations. Attached Figure Description

[0040] Figure 1 This is a simplified flowchart illustrating the main body of the invention. Figure 2 This is an example diagram illustrating the construction of PSI during the extended phase of this invention; Figure 3 This is a comparison chart of the decryption time overhead of this invention and other similar protocols under experimental conditions. Detailed Implementation

[0041] The present invention will be further illustrated below with reference to specific embodiments. It should be understood that these embodiments are for illustrative purposes only and are not intended to limit the scope of the invention. After reading the present invention, any modifications of the present invention in various equivalent forms by those skilled in the art will fall within the scope defined by the appended claims.

[0042] like Figure 1 and 2As shown, a highly efficient and fast-recoverable Laconic unintentional transmission protocol is divided into a main body and an extension body. The main body includes system initialization, database digest generation, message encryption, decryption buffer generation, and message recovery phases. The system initialization phase requires execution by a trusted third party. In subsequent phases, the protocol operates between two parties, referred to as the receiver and the sender. The receiver holds the database... (a length of of (vector), the sender holds two messages. and a selection index After the agreement is completed, the receiver can resend the message. (That is, if the database) The Position Then the message can be restored. ,like The Setting the bit to 1 allows the message to be recovered. ), and at the same time, they will not know about another message. Any information. The specific process will be described below.

[0043] The extended portion of the protocol includes steps for digest update, decryption buffer update, PSI receiver encoding, and PSI sender encoding. The digest update and decryption buffer update steps correspond to the receiver database. When changes occur One of them When changes occur, these two steps allow for rapid updates to the database digest and decryption cache without recalculation. Furthermore, a high-efficiency Laconic PSI protocol is built based on the Laconic OT protocol. In the Laconic PSI protocol, the receiver holds the data set. The sender holds the data set Through the Laconic PSI protocol, the receiver can eventually recover the set. ,right It will not know any information, and the entire protocol process retains the characteristics of Laconic Cryptography (two rounds of communication, the first round of messages has a fixed length and can be reused, and the second round of messages is independent of the size of the receiver's database). Through two steps—PSI receiver encoding and PSI sender encoding—a Laconic PSI protocol was successfully constructed using the Laconic OT protocol.

[0044] The following describes the specific implementation of each step of the protocol, starting with the main phases of the protocol: S1: System Initialization Executed by a trusted third party, with input security parameters and database length .set up for Bilinear group of order 1 for The generator. Randomly selected. ,calculate: for and ,calculate Output public key and private key .

[0045] Ultimately, a trusted third party will provide the public key. Send the private key to both the sender and receiver simultaneously. Send to the recipient.

[0046] S2: Generate database summary The recipient enters their private key. and database (a length of of (Vector). Random selection Calculate database summary: Output Summary and state Subsequently, the recipient sends the message digest. Send to the sender.

[0047] S3: Message Encryption The sender inputs the public key. Its selection index Two messages and the digest sent by the recipient Random selection ,calculate: Output ciphertext The sender will send the encrypted message. Send to the recipient.

[0048] S4: Generate decryption cache The recipient inputs the public key. Private key ,database and state For each position Calculate the decryption cache value: Output decryption cache set .

[0049] S5: Message Recovery Receiver input decryption buffer and ciphertext For each : calculate calculate if If it is a meaningful and expected message, then output As a result of the recovery.

[0050] The following is a detailed implementation of each step in the protocol's extension phase: E1: Summary Update When the receiver needs to modify the database... When entering the value of the bit, input the private key. Original Abstract Modify location and the original state Random selection Calculate the new summary: Output new summary New state and state increment .

[0051] E2: Decrypt cache update Input original decryption cache Public key Private key Original state and state increment For each Calculate the new decryption cache value: Output a new decryption cache set .

[0052] E3: PSI receiver encoding Input a simple hash function and the recipient's database .make Defined as a hash function value range, initialization .for Each element in ,calculate Let h() represent a hash function, and let Finally, the output is... As a database held by the recipient in the Laconic OT protocol.

[0053] E4: PSI sender code Input a simple hash function and the sender's database Initialize the collection It is an empty set. For Each element in ,calculate ,Will Add to collection Output set Ultimately, the sender and receiver run... The Laconic OT protocol, during each run, allows the selection of an index. Message sent .

[0054] This invention provides an instantiation method based on PBC. It utilizes a curve-based approach. A-type elliptic curve pairing, safety parameters .

[0055] Experimental results We conducted tests on an Intel Core i9-13900H 2.60 GHz device, and the results are shown in Tables 1 and 2. Comparison results with other similar protocols are as follows: Figure 3 As shown in the table, m and n represent the data size of the sender and receiver, respectively. We combine the generation of the database digest and the generation of the decryption cache into a preprocessing step.

[0056] Table 1. Cost statistics for different steps

[0057] Table 2. Statistics on computational costs at different steps in the scenario of imbalanced datasets.

[0058] Experimental results show that our protocol fully satisfies the characteristics of the Laconic unintentional transmission protocol. The encryption steps performed by the sender have very low time overhead, and the communication overhead during the interaction between the two parties is also very small. Furthermore, these two factors are linearly related only to the amount of data sent, and are independent of the amount of data received. Simultaneously, our protocol has shorter initialization and preprocessing times, and exhibits significant optimization in the decryption phase compared to similar protocols.

[0059] It is obvious to those skilled in the art that the efficient and fast-recoverable Laconic inadvertent transmission protocol steps of the above-described embodiments of the present invention can be implemented using general-purpose computing devices. These steps can be centralized on a single computing device or distributed across a network of multiple computing devices. Optionally, they can be implemented using device-executable program code, which can then be stored in a storage device for execution by the computing device. Furthermore, in some cases, the steps shown or described can be performed in a different order than presented herein, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the embodiments of the present invention are not limited to any particular hardware and software combination.

Claims

1. A highly efficient and rapidly recoverable Laconic unintentional transmission protocol, characterized in that, The protocol consists of a main body and extensions. The main body includes system initialization, database digest generation, message encryption, decryption cache generation, and message recovery. System initialization requires execution by a trusted third party. The protocol operates between the receiver and sender, with the receiver holding the database. ,database For a length of of Vector, the sender holds two messages and a selection index After the agreement is completed, the receiver can recover the message. If the database The Position Then the message can be recovered. ,like The A bit value of 1 indicates that the message can be recovered. At the same time, they will not know about another message. Any information; The extended portion of the protocol includes steps for digest update, decryption cache update, PSI receiver encoding, and PSI sender encoding; among these, the digest update and decryption cache update steps correspond to the receiver database. When changes occur One of them When changes occur, the database digest and decryption cache are updated through two steps: updating the database digest and updating the decryption cache, without recalculation. A Laconic PSI protocol is built based on the Laconic OT protocol. In the Laconic PSI protocol, the receiver holds the data set. The sender holds the data set Through the Laconic PSI protocol, the receiver can eventually recover the set. ,right It will not know any information, and the entire protocol process maintains the characteristics of Laconic Cryptography, namely two rounds of communication, the first round of messages being of fixed length and reusable, and the second round of messages being independent of the size of the receiver's database. Through two steps of PSI receiver encoding and PSI sender encoding, a Laconic PSI protocol was successfully constructed using the Laconic OT protocol.

2. The efficient and fast-recoverable Laconic unintentional transmission protocol according to claim 1, characterized in that, System initialization is performed by a trusted third party, with security parameters input. and database length ;set up for Bilinear group of order 1 for Generator; randomly selected ,calculate: for and ,calculate ; Output public key and private key ; Ultimately, a trusted third party will provide the public key. Send the private key to both the sender and receiver simultaneously. Send to the recipient.

3. The efficient and fast-recoverable Laconic unintentional transmission protocol according to claim 1, characterized in that, In the generated database digest, the recipient inputs their private key. and database Random selection Calculate database summary: Output Summary and state Subsequently, the recipient sends the message digest. Send to the sender.

4. The efficient and fast-recoverable Laconic unintentional transmission protocol according to claim 1, characterized in that, In the message encryption, the sender inputs the public key. Its selection index Two messages and the digest sent by the recipient Random selection ,calculate: Output ciphertext The sender will ciphertext Send to the recipient.

5. The efficient and fast-recoverable Laconic unintentional transmission protocol according to claim 1, characterized in that, In the process of generating the decryption cache, the receiver inputs the public key. Private key ,database and state For each position Calculate the decryption cache value: Output decryption cache set .

6. The efficient and fast-recoverable Laconic unintentional transmission protocol according to claim 1, characterized in that, During message recovery, the receiver inputs the decryption cache. and ciphertext For each : calculate ; calculate ; if If it is a meaningful and expected message, then output As a result of the recovery.

7. The efficient and fast-recoverable Laconic unintentional transmission protocol according to claim 1, characterized in that, In the digest update, when the receiver needs to modify the first item in the database... When entering the value of the bit, input the private key. Original Abstract Modify location and the original state Random selection Calculate the new summary: Output new summary New state and state increment ; Decryption cache is being updated. Please enter the original decryption cache. Public key Private key Original state and state increment For each Calculate the new decryption cache value: Output a new decryption cache set .

8. The efficient and fast-recoverable Laconic unintentional transmission protocol according to claim 1, characterized in that, In the PSI receiver encoding, a simple hash function is input. and the recipient's database ;make Defined as a hash function value range, initialization ;for Each element in ,calculate Let h() represent a hash function, and let Finally, the output As a database held by the recipient in the Laconic OT protocol; In the PSI sender encoding, a hash function is input. and the sender's database Initialize the collection It is an empty set; for Each element in ,calculate ,Will Add to collection Output set Ultimately, the sender and receiver run... The Laconic OT protocol, during each run, allows the selection of an index. Message sent .

9. A computer device, characterized in that: The computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps of the efficient and fast-recoverable Laconic unintentional transfer protocol as described in any one of claims 1-8.

10. A computer-readable storage medium having a computer program / instructions stored thereon, characterized in that: When the computer program / instruction is executed by the processor, it implements the steps of the efficient and fast-recoverable Laconic inadvertent transmission protocol as described in any one of claims 1-8.

Images