A method for anti-quantum private information retrieval

Abstract

The application belongs to the technical field of information security, and discloses an anti-quantum private information retrieval method, which comprises the following steps: after a search key encapsulation ciphertext is obtained by using a post-quantum temporary public key sent by a client for encapsulation processing on a server side, the client uses a post-quantum temporary private key to decrypt the search key encapsulation ciphertext to obtain a search key; the client uses a homomorphic public key and the search key to encrypt a search vector corresponding to target search information to obtain encrypted homomorphic query ciphertext; the server side performs homomorphic linear combination processing on a prompt information set based on the encrypted homomorphic query ciphertext to obtain search result ciphertext, and uses the search key to encrypt the search result ciphertext to obtain encrypted search result ciphertext; and the client uses the search key and a homomorphic private key to decrypt the encrypted search result ciphertext to obtain a search result. Through the above method, the security of private information retrieval is improved.

Description

Technical Field

[0001] This application relates to the technical field of information security, and more specifically, to a quantum-resistant private information retrieval method. Background Technology

[0002] Private Information Retrieval (PIR) technology is a key technology for protecting user query privacy, allowing users to retrieve the data they need from a database without disclosing their query content to the database server. Traditional PIR schemes are mainly divided into information-theoretic PIR and computational PIR. Information-theoretic PIR typically requires multiple non-colluding database copies, which makes its deployment costly and complex. While computational PIR can be deployed on a single server, it has significant security flaws.

[0003] Most existing computational PIR schemes are based on traditional public-key cryptography, such as RSA or the discrete logarithm problem. However, with the development of quantum computing technology, these cryptographic schemes based on traditional mathematical problems face the risk of being broken by quantum computers. Once quantum computers are deployed in practical applications, these PIR schemes will not be able to provide sufficient security, and users' query privacy will be seriously threatened.

[0004] To address the challenges of quantum computing, post-quantum cryptography has emerged, particularly lattice-based cryptographic schemes, which offer a new direction for building quantum-resistant PIR (Progressive Irregularity) cryptography. However, existing schemes still face numerous challenges when combining post-quantum cryptography with PIR techniques. For example, some schemes, while pursuing high security, cause the ciphertext size to increase quadratically with security parameters, resulting in huge computational and storage overhead and severely impacting the system's computational efficiency. Furthermore, existing schemes typically require the server to perform homomorphic operations on the entire database in real time for each query, leading to high online query latency and heavy server load, making it difficult to support high-concurrency query requests. While some preprocessing schemes attempt to alleviate the online computation bottleneck, they often fail to deeply integrate with post-quantum cryptography or sacrifice the single-server model, increasing system complexity and interaction rounds.

[0005] To address the aforementioned issues, existing technologies urgently need improvement. Summary of the Invention

[0006] The purpose of this application is to provide a quantum-resistant private information retrieval method. On the server side, a pre-set set of prompts is homomorphically linearly combined using a retrieval key and an encrypted homomorphic query ciphertext to obtain the ciphertext of the retrieval results. The client then uses the retrieval key and the homomorphic private key from the homomorphic key pair to decrypt the encrypted ciphertext of the retrieval results, obtaining the retrieval results corresponding to the target information. This method addresses the shortcomings of existing private information retrieval technologies under quantum computing threats, such as insufficient security, high computational and storage overhead, high online query latency, and heavy server load. By employing a dual encryption and decryption mechanism, the method enhances the security of data transmission and storage, ensuring that user privacy is effectively protected even in the event of partial key leakage, thus improving the security of private information retrieval.

[0007] Firstly, this application provides a quantum-resistant private information retrieval method, applied to a client, including: Obtain the homomorphic key pair and post-quantum temporary key pair corresponding to the target retrieval information; After sending the post-quantum temporary public key in the post-quantum temporary key pair to the server, the server sends a retrieval key encapsulated ciphertext; the retrieval key encapsulated ciphertext is the ciphertext obtained by the server using the post-quantum temporary public key for encapsulation processing. Using the post-quantum temporary private key in the post-quantum temporary key pair, the ciphertext of the retrieval key is decrypted to obtain the retrieval key; Using the homomorphic public key in the homomorphic key pair and the retrieval key, the retrieval vector corresponding to the target retrieval information is encrypted to obtain the encrypted homomorphic query ciphertext, and the encrypted homomorphic query ciphertext is sent to the server. The server receives encrypted search result ciphertext sent by the server. The encrypted search result ciphertext is obtained by the server performing homomorphic linear combination processing on a pre-set set of prompt information based on the encrypted homomorphic query ciphertext and the search key to obtain the search result ciphertext, and then encrypting the search result ciphertext using the search key. Using the retrieval key and the homomorphic private key in the homomorphic key pair, the encrypted ciphertext of the retrieval result is decrypted to obtain the retrieval result corresponding to the target retrieval information.

[0008] The quantum-resistant private information retrieval method provided in this application enables information retrieval between a client and a server. On the server side, a pre-set set of prompts is homomorphically linearly combined using a retrieval key and an encrypted homomorphic query ciphertext to obtain the ciphertext of the retrieval results. The client then uses the retrieval key and the homomorphic private key from the homomorphic key pair to decrypt the encrypted ciphertext of the retrieval results, obtaining the retrieval results corresponding to the target retrieval information. This method addresses the shortcomings of existing private information retrieval technologies under the threat of quantum computing, such as insufficient security, high computational and storage overhead, high online query latency, and heavy server load. By employing a dual encryption and decryption mechanism, the method enhances the security of data transmission and storage, ensuring that user privacy is effectively protected even in the event of partial key leakage, thereby improving the security of private information retrieval.

[0009] Optionally, obtaining the homomorphic key pair and post-quantum temporary key pair corresponding to the target retrieval information includes: Obtain the target search information input by the user and retrieve pre-set common parameters; Based on the public parameters, generate homomorphic key pairs and post-quantum temporary key pairs corresponding to the target retrieval information.

[0010] Optionally, the common parameters include ring dimension parameters, modulus parameters, polynomial ring parameters, and common polynomial parameters.

[0011] Optionally, the retrieval vector corresponding to the target retrieval information is encrypted using the homomorphic public key in the homomorphic key pair and the retrieval key to obtain the encrypted homomorphic query ciphertext, including: The target retrieval information is converted into a vector representation to obtain the retrieval vector; The retrieval vector is encrypted using the homomorphic public key in the homomorphic key pair to obtain the homomorphic query ciphertext; The homomorphic query ciphertext is encrypted using the retrieval key to obtain the encrypted homomorphic query ciphertext.

[0012] The quantum-resistant private information retrieval method provided in this application enables information retrieval between the client and the server. Through a dual encryption mechanism, the retrieval key is introduced into the encryption process of the homomorphic query ciphertext, which further enhances the security of the query ciphertext. Even if the homomorphic public key is leaked, it is difficult for attackers to obtain the original query information.

[0013] Optionally, the encrypted ciphertext of the search result is decrypted using the search key and the homomorphic private key in the homomorphic key pair to obtain the search result corresponding to the target search information, including: Using the retrieval key, the encrypted ciphertext of the retrieval result is decrypted to obtain the decrypted ciphertext of the retrieval result; Using the homomorphic private key in the homomorphic key pair, the decrypted ciphertext of the search result is decrypted to obtain the search result corresponding to the target search information.

[0014] The quantum-resistant private information retrieval method provided in this application enables information retrieval between the client and the server. Through a dual decryption mechanism, the confidentiality of the retrieval results during transmission and storage is ensured. Only the client with the retrieval key and the homomorphic private key can ultimately obtain the plaintext retrieval results.

[0015] Secondly, a quantum-resistant private information retrieval method, applied to the server side, includes: Obtain the post-quantum temporary public key sent by the client; Using the aforementioned post-quantum temporary public key, encapsulation processing is performed to obtain the retrieval key and the retrieval key encapsulated ciphertext; After encapsulating the retrieval key into ciphertext and sending it to the client, the system receives the encrypted homomorphic query ciphertext sent by the client. Based on the encrypted homomorphic query ciphertext and the retrieval key, a pre-set set of prompt information is subjected to homomorphic linear combination processing to obtain the retrieval result ciphertext. Using the retrieval key, the ciphertext of the retrieval result is encrypted to obtain the encrypted ciphertext of the retrieval result. The encrypted search results are sent to the client.

[0016] This quantum-resistant private information retrieval method, on the server side, uses a retrieval key and encrypted homomorphic query ciphertext to perform homomorphic linear combination processing on a pre-set set of prompt information in the database to obtain the ciphertext of the retrieval results. This ciphertext is then sent to the client. It addresses the shortcomings of existing private information retrieval technologies under quantum computing threats, such as insufficient security, high computational and storage overhead, high online query latency, and heavy server load. Through dual encryption and decryption mechanisms, it enhances the security of data transmission and storage, ensuring that user privacy is effectively protected even in the event of partial key leakage, thus improving the security of private information retrieval.

[0017] Optionally, the steps for constructing the set of prompt information include: The original data in the database is divided into multiple data sets, resulting in multiple data blocks; Using pre-set public parameters and an encoding function, the data block is mapped to the corresponding plaintext polynomial; Using a randomized homomorphic encryption algorithm, the plaintext polynomial is encrypted using the common parameters and randomly generated sampling noise to obtain the prompt information corresponding to the data block. The prompt information corresponding to each data block is summarized to obtain the prompt information set.

[0018] Optionally, based on the encrypted homomorphic query ciphertext and the retrieval key, a pre-set set of prompt information is subjected to homomorphic linear combination processing to obtain the ciphertext of the retrieval result, including: Using the retrieval key, the encrypted homomorphic query ciphertext is decrypted to obtain the decrypted homomorphic query ciphertext; Extract the target index information corresponding to the target retrieval information from the decrypted homomorphic query ciphertext; Based on the target index information, a homomorphic linear combination process is performed on the pre-set set of prompt information to obtain the ciphertext of the search results.

[0019] Optionally, based on the target index information, a pre-set set of prompt information is subjected to homomorphic linear combination processing to obtain the ciphertext of the search results, including: From the set of prompt information, determine the prompt information corresponding to the target index information; Based on the decrypted homomorphic query ciphertext, generate homomorphic linear coefficients; Based on the homomorphic linear coefficients and the prompt information, homomorphic linear operations are performed to obtain the encrypted search results.

[0020] Optionally, based on the homomorphic linear coefficients and the prompt information, a homomorphic linear operation is performed to obtain the ciphertext of the search results, including: Based on the homomorphic linear coefficients and the prompt information, homomorphic linear operations are performed to obtain the initial ciphertext of the search results; Based on the homomorphic public key in the homomorphic key pair sent by the client, generate small random noise data that meets the preset differential privacy requirements. The initial ciphertext of the search results is optimized using the small random noise data to obtain the ciphertext of the search results.

[0021] The quantum-resistant private information retrieval method provided in this application can realize information retrieval between the client and the server. By introducing small random noise data into the homomorphic linear operation results, the differential privacy protection of the retrieval results is further enhanced. Even if an attacker makes multiple queries, it is difficult to infer the original data information, thereby improving the overall security of the system.

[0022] Beneficial Effects: The quantum-resistant private information retrieval method provided in this application, on the server side, uses a retrieval key and an encrypted homomorphic query ciphertext to perform homomorphic linear combination processing on a pre-set set of prompt information to obtain the ciphertext of the retrieval results. After obtaining the ciphertext of the retrieval results, the client uses the retrieval key and the homomorphic private key in the homomorphic key pair to decrypt the encrypted ciphertext of the retrieval results, obtaining the retrieval results corresponding to the target retrieval information. This solves the problems of insufficient security, high computational and storage overhead, high online query latency, and heavy server load in existing private information retrieval technologies under the threat of quantum computing. By using a dual encryption and decryption mechanism, the security of data transmission and storage is enhanced, ensuring that user privacy can still be effectively protected even if some keys are leaked, thus improving the security of private information retrieval. Attached Figure Description

[0023] Figure 1 A flowchart illustrating a quantum-resistant private information retrieval method provided in this application embodiment.

[0024] Figure 2 A flowchart of another quantum-resistant private information retrieval method provided in this application embodiment. Detailed Implementation

[0025] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0026] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0027] Please refer to Figure 1 , Figure 1 A quantum-resistant private information retrieval method provided in this application embodiment, applied to a client for information retrieval from a server, includes: Step S1: Obtain the homomorphic key pair and the post-quantum temporary key pair corresponding to the target retrieval information; Step S2: After sending the post-quantum temporary public key in the post-quantum temporary key pair to the server, receive the retrieval key encapsulated ciphertext sent by the server; the retrieval key encapsulated ciphertext is the ciphertext obtained by the server using the post-quantum temporary public key for encapsulation processing; Step S3: Use the post-quantum temporary private key in the post-quantum temporary key pair to decrypt the ciphertext encapsulated in the retrieval key to obtain the retrieval key; Step S4: Using the homomorphic public key and retrieval key in the homomorphic key pair, encrypt the retrieval vector corresponding to the target retrieval information to obtain the encrypted homomorphic query ciphertext, and send the encrypted homomorphic query ciphertext to the server. Step S5: Receive the encrypted search result ciphertext sent by the server; the encrypted search result ciphertext is obtained by the server performing homomorphic linear combination processing on the encrypted homomorphic query ciphertext and the search key to obtain the search result ciphertext, and then encrypting the search result ciphertext using the search key. Step S6: Use the retrieval key and the homomorphic private key in the homomorphic key pair to decrypt the encrypted ciphertext of the retrieval result to obtain the retrieval result corresponding to the target retrieval information.

[0028] The quantum-resistant private information retrieval method provided in this application, on the server side, uses a retrieval key and an encrypted homomorphic query ciphertext to perform homomorphic linear combination processing on a pre-set set of prompt information to obtain the ciphertext of the retrieval result. After obtaining the ciphertext of the retrieval result, the client uses the retrieval key and the homomorphic private key in the homomorphic key pair to decrypt the encrypted ciphertext of the retrieval result, obtaining the retrieval result corresponding to the target retrieval information. This method solves the problems of insufficient security, high computational and storage overhead, high online query latency, and heavy server load in existing private information retrieval technologies under the threat of quantum computing. By using a dual encryption and decryption mechanism, the method enhances the security of data transmission and storage, ensuring that user privacy can still be effectively protected even if some keys are leaked, thus improving the security of private information retrieval.

[0029] Specifically, in step S1, obtaining the homomorphic key pair and the post-quantum temporary key pair corresponding to the target retrieval information includes: Obtain the target search information input by the user and retrieve pre-set common parameters; Based on the common parameters, generate homomorphic key pairs and post-quantum temporary key pairs corresponding to the target retrieval information.

[0030] In step S1, a search request initiated by the user is received, and the specific information that the user wishes to query is extracted from it. This target search information can be a keyword, a phrase, a document ID, or any other data that can be used to identify the user's search intent. This target search information forms the basis for generating the subsequent search vector and is the starting point of the entire private information retrieval process.

[0031] Before key generation, the client retrieves a set of predefined parameters, known as public parameters, from local storage or a trusted source via a secure channel. These public parameters are essential for the proper functioning of homomorphic encryption and post-quantum cryptography schemes. They may include parameters such as ring dimension, modulus, polynomial ring parameters, and public polynomial parameters, ensuring that the client and server use the same mathematical structure and security configuration during encryption and decryption operations, thus guaranteeing key compatibility and the correctness of the encryption process. These public parameters can be determined through negotiation between the client and server before the retrieval begins. The public parameters support polynomial multiplication in O(nlogn, linear logarithmic order). In homomorphic encryption schemes, the ring dimension parameter refers to the parameter used to define the dimension or size of the polynomial ring parameter. For example, the ring dimension parameter N=2. k (For example, in 4096, k is the ring dimension exponent parameter, used to determine the dimension of the polynomial ring, i.e., the size of the ring dimension parameter, which is a core parameter in lattice-based cryptography (RLWE, Ring Learning with Errors). This ring dimension parameter directly affects the computational complexity and security level of the encryption scheme. The modulus parameter refers to the integer used for modular arithmetic in homomorphic encryption. Its selection is crucial for controlling ciphertext noise growth, ensuring decryption correctness, and resisting specific attacks. For example, the modulus parameter q is a special prime number that satisfies the requirements of Number Theoretic Transform (NTT). The polynomial ring parameter refers to the algebraic structure upon which homomorphic encryption relies, usually a polynomial ring. This parameter defines key properties of the polynomial, such as the coefficient field and irreducibility. The common polynomial parameter refers to the specific polynomial used to define the polynomial ring in a homomorphic encryption scheme, such as an irreducible polynomial, which plays a fundamental role in operations on the ring. The ring dimension parameter, modulus parameter, polynomial ring parameter, and common polynomial parameter together provide the necessary mathematical context and operational constraints for the key generation algorithm, which can be set according to actual needs.

[0032] Using the aforementioned public parameters and the target retrieval information input by the user, a specific key generation algorithm is employed to generate a homomorphic key pair and a post-quantum temporary key pair for this private information retrieval session. The homomorphic key pair includes a homomorphic public key and a homomorphic private key, used for homomorphic encryption and decryption of the retrieval vector. The homomorphic public key pk... c For a ring element , e is a random error term. Here, s is the public polynomial parameter, and s is the homomorphic private key. The parameters are polynomial ring parameters. Homomorphic key pairs can be generated using key generation algorithms, such as lattice-based fully homomorphic encryption schemes like BGV, BFV, or CKKS. Post-quantum ephemeral key pairs include a post-quantum ephemeral public key and a post-quantum ephemeral private key, used to securely negotiate and retrieve keys between the client and server to defend against attacks from future quantum computers. Post-quantum ephemeral key pairs can be generated using post-quantum cryptographic algorithms (such as ML-KEM). The key generation algorithm and the post-quantum cryptographic algorithm are existing technologies and will not be detailed here.

[0033] Specifically, in step S2, the client sends the post-quantum temporary public key from the post-quantum temporary key pair to the server. Upon receiving the post-quantum temporary public key, the server encapsulates it to obtain the retrieval key encapsulated ciphertext. For example, a post-quantum KEM scheme such as Kyber can be used to generate a random retrieval key, which is then encrypted using the client's post-quantum temporary public key to obtain the retrieval key encapsulated ciphertext. The server then sends the generated retrieval key encapsulated ciphertext back to the client. Here, the retrieval key refers to a session key generated for this retrieval process.

[0034] Specifically, in step S3, after receiving the ciphertext encapsulated with the retrieval key, the client decrypts it using the post-quantum temporary private key from the post-quantum temporary key pair to obtain the retrieval key. This decryption process also employs a post-quantum KEM scheme that matches the encapsulation process. In this way, the client and server securely negotiate and establish a shared retrieval key, which is quantum-resistant.

[0035] Specifically, in step S4, the retrieval vector corresponding to the target retrieval information is encrypted using the homomorphic public key and the retrieval key in the homomorphic key pair, resulting in the encrypted homomorphic query ciphertext, including: The target retrieval information is converted into a vector representation to obtain the retrieval vector; The retrieval vector is encrypted using the homomorphic public key in the homomorphic key pair to obtain the homomorphic query ciphertext; The homomorphic query ciphertext is encrypted using the retrieval key to obtain the encrypted homomorphic query ciphertext.

[0036] In step S4, using preset encoding rules or algorithms, such as one-hot encoding, word embedding, or hash functions, the user-input target retrieval information is mapped into a fixed-length or variable-length numerical vector. This retrieval vector can transform non-numerical retrieval information into a format that can be mathematically operated on, accurately representing the semantic content or features of the target retrieval information, thus facilitating subsequent encryption and homomorphic operations.

[0037] Using the homomorphic public key from the pre-homomorphic key pair, the retrieval vector obtained above is homomorphically encrypted to produce the homomorphic query ciphertext. Homomorphic encryption allows direct computation on the ciphertext without decryption, thus protecting the privacy of the retrieval information. Therefore, the resulting homomorphic query ciphertext can be homomorphically linearly combined on the server side without revealing the content of the original retrieval vector.

[0038] Building upon homomorphic encryption, the obtained homomorphic query ciphertext is further encrypted using a retrieval key negotiated between the client and server, resulting in a new encrypted homomorphic query ciphertext. This secondary encryption can employ symmetric encryption algorithms, such as the Advanced Encryption Standard (AES), providing an additional layer of security to prevent eavesdroppers from acquiring and analyzing the homomorphic query ciphertext during transmission. Even though homomorphic encryption itself is quantum resistant, the introduction of the retrieval key enhances overall security and lays the foundation for subsequent encryption of the retrieval result ciphertext by the server.

[0039] After generating the encrypted homomorphic query ciphertext, the client sends this encrypted homomorphic query ciphertext to the server.

[0040] Specifically, in step S5, the server receives the encrypted search result from the server. After receiving the encrypted homomorphic query ciphertext, the server first uses the search key and the encrypted homomorphic query ciphertext to perform homomorphic linear combination processing on the pre-stored set of prompt information to obtain the ciphertext of the search result. Then, the server uses the search key to encrypt the ciphertext of the search result, generating the encrypted ciphertext of the search result.

[0041] The process involves the server receiving the encrypted homomorphic query ciphertext and generating encrypted search result ciphertext as follows: First, the encrypted homomorphic query ciphertext is decrypted using the search key, resulting in the decrypted homomorphic query ciphertext. Then, based on this ciphertext, the server performs homomorphic linear combination processing on a pre-stored set of prompts to obtain the encrypted search result ciphertext. This process is the core of private information retrieval; the server obtains the ciphertext through homomorphic operations without decrypting the query ciphertext or prompts. This ciphertext domain computation ensures that the server cannot know the specific query content or search results. To protect the privacy of the search results, the server encrypts the ciphertext again using the search key, generating encrypted search result ciphertext.

[0042] Specifically, in step S6, the encrypted ciphertext of the search result is decrypted using the search key and the homomorphic private key in the homomorphic key pair to obtain the search result corresponding to the target search information, including: Use the retrieval key to decrypt the encrypted ciphertext of the retrieval results, and obtain the decrypted ciphertext of the retrieval results; Using the homomorphic private key in the homomorphic key pair, the decrypted ciphertext of the search results is decrypted to obtain the search results corresponding to the target search information.

[0043] In step S6, after receiving the encrypted ciphertext of the search result sent by the server, the client uses the search key to perform symmetric decryption on the encrypted ciphertext, obtaining the decrypted ciphertext, which is the original ciphertext. This search key is obtained by encapsulating a post-quantum temporary key pair, ensuring quantum-resistant security of key exchange. Through this step, the encrypted ciphertext is restored to the original ciphertext, which has only undergone homomorphic encryption.

[0044] After obtaining the decrypted ciphertext of the search results, the client uses the homomorphic private key from its homomorphic key pair to perform homomorphic decryption on the decrypted ciphertext. The homomorphic private key is paired with the homomorphic public key and is used to decrypt data encrypted by the homomorphic public key. Through this step, the original search results corresponding to the target search information are finally obtained.

[0045] This layered decryption mechanism enables the client to securely receive and ultimately obtain the private information it queries, while maintaining the privacy of the server when processing the query.

[0046] In an optional implementation, to further enhance metadata privacy and prevent inference attacks based on traffic analysis, the client can also configurably initiate a pseudo query (using the above method). The specific process of the pseudo query includes: (1) The client generates the retrieval vector of the pseudo query according to the same process as the real query, and encrypts it using a homomorphic public key and a retrieval key to obtain the pseudo homomorphic query ciphertext, whose statistical characteristics are indistinguishable from the real query ciphertext. (2) The client sends the pseudo query ciphertext and the real query ciphertext together to the server. (3) The server treats the pseudo query and the real query equally, performs a complete homomorphic linear combination calculation, and returns the encrypted retrieval result ciphertext. (4) The client discards the result ciphertext corresponding to the pseudo query directly without decryption.

[0047] Therefore, by adjusting the proportion of fake queries, query traffic can be obfuscated, preventing servers or eavesdroppers from inferring users' true query intentions by analyzing metadata such as query time, frequency, and patterns. This achieves a balance between system overhead and the strength of metadata privacy protection.

[0048] As shown above, this quantum-resistant private information retrieval method, on the server side, uses a retrieval key and an encrypted homomorphic query ciphertext to perform homomorphic linear combination processing on a pre-set set of prompt information to obtain the ciphertext of the retrieval results. The client then uses the retrieval key and the homomorphic private key from the homomorphic key pair to decrypt the encrypted ciphertext of the retrieval results, obtaining the retrieval results corresponding to the target retrieval information. This method addresses the shortcomings of existing private information retrieval technologies under the threat of quantum computing, such as insufficient security, high computational and storage overhead, high online query latency, and heavy server load. By employing a dual encryption and decryption mechanism, the method enhances the security of data transmission and storage, ensuring that user privacy is effectively protected even in the event of partial key leakage, thus improving the security of private information retrieval.

[0049] Please refer to Figure 2 , Figure 2 Another quantum-resistant private information retrieval method provided in this application embodiment, applied to the server, to realize information retrieval initiated by the client, includes: Step A1: Obtain the post-quantum temporary public key sent by the client; Step A2: Use the post-quantum temporary public key to perform encapsulation processing to obtain the retrieval key and the retrieval key encapsulated ciphertext; Step A3: After sending the ciphertext containing the retrieval key to the client, receive the encrypted homomorphic query ciphertext sent by the client. Step A4: Based on the encrypted homomorphic query ciphertext and the retrieval key, perform homomorphic linear combination processing on the pre-set set of prompt information to obtain the ciphertext of the retrieval result; Step A5: Use the search key to encrypt the ciphertext of the search results to obtain the encrypted ciphertext of the search results; Step A6: Send the encrypted search results to the client.

[0050] This quantum-resistant private information retrieval method, on the server side, uses a retrieval key and an encrypted homomorphic query ciphertext to perform homomorphic linear combination processing on a pre-set set of prompt information in the database to obtain the ciphertext of the retrieval result. After obtaining the ciphertext of the retrieval result, it sends the ciphertext of the retrieval result to the client. The dual encryption and decryption mechanism enhances the security of data transmission and storage, ensuring that user privacy can still be effectively protected even if some keys are leaked, thus improving the security of private information retrieval.

[0051] Specifically, in step A1, the server receives the post-quantum temporary public key sent by the client.

[0052] Specifically, in step A2, after receiving the post-quantum ephemeral public key, the server encapsulates it to obtain the retrieval key and its ciphertext. Specifically, the server can randomly generate a retrieval key and encapsulate it using the client's post-quantum ephemeral public key. This random generation process can rely on the server's hardware random number generator or a cryptographically secure pseudo-random number generator to ensure the randomness and security of the retrieval key. The retrieval key is a session key generated specifically for this retrieval process.

[0053] Specifically, in step A3, the server sends the ciphertext encapsulated with the retrieval key to the client. The client uses the post-quantum temporary private key from the post-quantum temporary key pair to decrypt the ciphertext encapsulated with the retrieval key, obtaining the retrieval key. Then, using the homomorphic public key from the homomorphic key pair and the retrieval key, the client encrypts the retrieval vector corresponding to the target retrieval information, obtaining the encrypted homomorphic query ciphertext. This encrypted homomorphic query ciphertext is then sent back to the server. The above implementation already describes the client receiving the ciphertext encapsulated with the retrieval key and generating the encrypted homomorphic query ciphertext, which will not be repeated here.

[0054] Specifically, in step A4, based on the encrypted homomorphic query ciphertext and the retrieval key, the set of prompt information is subjected to homomorphic linear combination processing to obtain the ciphertext of the retrieval result, including: Using the retrieval key, the encrypted homomorphic query ciphertext is decrypted to obtain the decrypted homomorphic query ciphertext; Extract the target index information corresponding to the target retrieval information from the decrypted homomorphic query ciphertext; Based on the target index information, the set of prompt information is processed by homomorphic linear combination to obtain the ciphertext of the search results.

[0055] Specifically, the steps for constructing the pre-set set of prompt messages include: The original data in the database is divided into multiple data sets, resulting in multiple data blocks; Using pre-set common parameters and an encoding function, data blocks are mapped to corresponding plaintext polynomials; Using a randomized homomorphic encryption algorithm, common parameters are used in conjunction with randomly generated sampling noise to encrypt the plaintext polynomial, thereby obtaining the prompt information corresponding to the data block. The prompts corresponding to each data block are summarized to obtain a set of prompts.

[0056] Before obtaining the set of prompts, the raw data in the database needs to be preprocessed. This preprocessing involves dividing the raw data into multiple smaller data sets according to preset rules or strategies, thus obtaining multiple data blocks. For example, the data can be divided based on factors such as data type, data size, and data access frequency to improve the efficiency and flexibility of subsequent processing.

[0057] Furthermore, to process data in a homomorphic encryption environment, these data blocks need to be converted into a format suitable for encryption. To this end, using pre-defined common parameters, an encoding function maps each data block to a corresponding plaintext polynomial. The encoding function converts discrete data values ​​into polynomial coefficients or structures, enabling data computation on a polynomial ring. The common parameters provide a unified basis for the encoding and encryption processes, ensuring consistency in the processing of different data blocks.

[0058] Building upon this foundation, a randomized homomorphic encryption algorithm is employed to generate privacy-preserving prompts. This algorithm utilizes common parameters and incorporates randomly generated sampling noise to encrypt the plaintext polynomial obtained above, yielding the prompts corresponding to the data blocks. The introduction of random sampling noise aims to enhance the randomness and security of the encryption, making it difficult to deduce the original plaintext information from the ciphertext even during homomorphic operations. In this way, each data block is encrypted into its corresponding prompt.

[0059] Finally, the prompts corresponding to all data blocks are aggregated to form a complete set of prompts. This set of prompts forms the basis for subsequent private information retrieval by the server. It contains information from the original data in the database in an encrypted form, ensuring data privacy. Furthermore, the step of obtaining this set of prompts can be performed offline without affecting the retrieval speed.

[0060] For example, divide a database TAB containing L original data entries into M data blocks. ,in, Let M be the total number of data blocks, and M be the j-th data block. Use the encoding function `Encode` to encode each data block. Mapped to plaintext polynomial ,in, Let j be the plaintext polynomial corresponding to the j-th data block. Let be the polynomial ring parameters. Simultaneously, the encoding function `Encode` must satisfy the linear property, i.e.: .

[0061] Perform a one-time batch calculation using the common polynomial parameter A from the common parameters to generate a set of prompt messages: ; ; in, The prompt message corresponding to the j-th data block; For randomized homomorphic encryption algorithms based on RLWE (such as BFV or BGV schemes). Generate a public key for the prompt message; this can be a public parameter public key or a server public key. For common polynomial parameters; The polynomial corresponding to the random sampling noise; This is a set of prompt messages.

[0062] When the encoding function Encode satisfies the linear property If the homomorphism holds, the server can extract the accurate plaintext polynomial. The subsequent steps can continue. When the encoding function `Encode` does not satisfy the linear property, The homomorphism does not hold, and the server cannot extract the accurate plaintext polynomial. If this happens, subsequent steps will not function correctly.

[0063] During the process of obtaining the set of prompt information, although the public polynomial parameter A is public, the prompt information... It is ciphertext generated using a randomized homomorphic encryption algorithm, and random sampling noise is introduced during the encryption process. Therefore, this preprocessing process does not leak plaintext information from the database, thus meeting semantic security requirements.

[0064] Furthermore, when a data block is updated, the notification message set is also updated accordingly, that is: ; ; ; in, The data update amount for the prompt information corresponding to the j-th data block; For the updated j-th data block; This is the prompt message corresponding to the updated j-th database; This is the updated set of prompt messages.

[0065] Thus, by pre-computing the set of prompt information, the vast majority of the computational load is shifted to a one-time offline phase. During online querying (retrieval), the server only needs to perform a lightweight homomorphic linear combination, reducing the server's computational complexity from polynomial to constant level, achieving quantum-resistant PIR support for high concurrency and sub-millisecond real-time queries.

[0066] Specifically, in step A4, after receiving the encrypted homomorphic query ciphertext sent by the client, the server uses the retrieval key to perform symmetric decryption on the ciphertext, obtaining the decrypted homomorphic query ciphertext, which is the original homomorphic query ciphertext. The purpose of this step is to remove the additional encryption layer applied by the retrieval key, thereby recovering the homomorphic query ciphertext encrypted only by the homomorphic public key (i.e., the original homomorphic query ciphertext), preparing for subsequent homomorphic operations.

[0067] After obtaining the decrypted homomorphic query ciphertext, the server identifies and extracts the index identifiers implicit in the ciphertext that are related to the client's target retrieval information through specific parsing or homomorphic operations. The target index information is an encrypted pointer or identifier used to precisely indicate the data location or type that needs to be operated on within the set of prompt information.

[0068] The server uses the extracted target index information as coefficients or selectors to perform linear combination operations on the pre-stored set of prompt information in an encrypted state. This process achieves the aggregation or filtering of relevant data without decrypting the set of prompt information or revealing the target index information, and finally generates encrypted ciphertext search results.

[0069] Specifically, in step A4, based on the target index information, the set of prompt information is subjected to homomorphic linear combination processing to obtain the ciphertext of the search results, including: From the set of prompts, determine the prompt information that corresponds to the target index information; Generate homomorphic linear coefficients based on the decrypted homomorphic query ciphertext; Based on the homomorphic linear coefficients and the hint information, homomorphic linear operations are performed to obtain the encrypted search results.

[0070] In step A4, the server, based on the target index information extracted from the decrypted homomorphic query ciphertext, identifies and selects the encrypted data block associated with the target index information from a pre-set set of prompt information. Within the prompt information set, the prompt information corresponding to each data block can be pre-divided into multiple segments, each segment containing multiple prompt information messages. When reading the target index information, the segment number and offset within the segment to which the corresponding prompt information belongs are calculated based on the target index information. Then, using pointer arithmetic for O(1) complexity memory access, the prompt information corresponding to the target index information is extracted from the set of prompt information messages.

[0071] By utilizing the query logic and structure contained in the decrypted homomorphic query ciphertext, a series of coefficients for subsequent homomorphic linear operations are generated within the encrypted domain, resulting in homomorphic linear coefficients (usually a small ciphertext or scalar). For example, a polynomial coefficient extraction is performed on the decrypted homomorphic query ciphertext (represented as a vector) to identify the extracted polynomial coefficients as homomorphic linear coefficients. These homomorphic linear coefficients are essentially a mathematical representation of the client's retrieval request; they act as weights or selectors in homomorphic operations, guiding how to combine prompts. Only when the server uses the correct homomorphic linear coefficients and the correct set of prompts can it execute the correct retrieval operation and obtain the correct retrieval results.

[0072] Leveraging the properties of homomorphic encryption schemes, a series of homomorphic addition and multiplication operations are performed on the hint information and homomorphic linear coefficients without decrypting them, yielding the ciphertext of the search results. These operations combine the selected hint information with the corresponding homomorphic linear coefficients to compute the final ciphertext of the search results within the encrypted domain. The entire computation process is strictly performed in an encrypted state, ensuring data privacy. Specifically, in step A4, a homomorphic linear operation is performed based on the homomorphic linear coefficients and the prompt information to obtain the ciphertext of the search results, including: Based on the homomorphic linear coefficients and the hint information, homomorphic linear operations are performed to obtain the ciphertext of the initial search results; Based on the homomorphic public key in the homomorphic key pair sent by the client, generate small random noise data that meets the preset differential privacy requirements. By utilizing small random noise data, the initial ciphertext of the search results is optimized to obtain the ciphertext of the search results.

[0073] In step A4, based on the homomorphic linear coefficients and the hint information, homomorphic linear operations are performed directly to obtain the initial ciphertext of the search result, i.e. ,in, The initial retrieval results are in encrypted form. The coefficients are homomorphic linear. For homomorphic linear operations (homomorphic scalar multiplication or homomorphic dot product), when the homomorphic linear coefficients C are scalars... For homomorphic scalar multiplication, when the homomorphic linear coefficients C are vectors, This is a homomorphic dot product.

[0074] Based on the homomorphic public key in the homomorphic key pair sent by the client, generate small random noise data that meets the preset differential privacy requirements. ,in, For homomorphic public keys, Small random noise data is random noise sampled from data that meets preset differential privacy requirements (such as a Laplace or Gaussian distribution). Small random noise data is a series of statistically significant random perturbations, such as those found in privacy budgets. and , The upper bound for controlling privacy loss: the smaller the value, the stronger the privacy protection, but the lower the data utility. This represents the acceptable probability of privacy protection failure and is typically set to an extremely small value. By using minimal random noise in the data, it prevents sensitive information from being inferred through reverse engineering or multiple queries. This makes it difficult for attackers to accurately deduce the existence or specific value of any individual data item in the database, even if they obtain multiple query results.

[0075] By using operations such as isomorphic addition, the generated small random noise data is combined with the initial ciphertext of the search results to obtain the ciphertext of the search results, i.e. , To encrypt the search results, This is a homomorphic addition operation.

[0076] Specifically, in step A5, the server uses the retrieval key and an existing encryption algorithm, such as AES-256-GCM, to encrypt the ciphertext of the retrieval result, thus obtaining the encrypted ciphertext of the retrieval result.

[0077] Specifically, in step A6, the server sends the encrypted search results to the client. After receiving the encrypted search results, the client decrypts them to obtain the search results corresponding to the target search information, i.e., the final search content.

[0078] In summary, by adopting a three-pronged collaborative architecture of "structured lattice cryptography foundation + server-side preprocessing + hybrid cryptographic system", a balance is achieved between quantum security, high online efficiency and low communication overhead, thereby improving the security of the private information retrieval process.

[0079] As shown above, this quantum-resistant private information retrieval method, on the server side, uses a retrieval key and an encrypted homomorphic query ciphertext to perform homomorphic linear combination processing on a pre-set set of prompt information in the database to obtain the ciphertext of the retrieval result. This ciphertext is then sent to the client. This addresses the shortcomings of existing private information retrieval technologies under quantum computing threats, such as insufficient security, high computational and storage overhead, high online query latency, and heavy server load. By employing a dual encryption and decryption mechanism, the method enhances the security of data transmission and storage, ensuring that user privacy is effectively protected even in the event of partial key leakage, thus improving the security of private information retrieval.

[0080] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0081] Furthermore, the units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0082] Furthermore, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0083] In this document, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, without necessarily requiring or implying any such actual relationship or order between these entities or operations.

[0084] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A quantum-resistant private information retrieval method, characterized in that, Applied to the client side, including: Obtain the homomorphic key pair and post-quantum temporary key pair corresponding to the target retrieval information; After sending the post-quantum temporary public key in the post-quantum temporary key pair to the server, the server sends a retrieval key encapsulated ciphertext; the retrieval key encapsulated ciphertext is the ciphertext obtained by the server using the post-quantum temporary public key for encapsulation processing. Using the post-quantum temporary private key in the post-quantum temporary key pair, the ciphertext of the retrieval key is decrypted to obtain the retrieval key; Using the homomorphic public key in the homomorphic key pair and the retrieval key, the retrieval vector corresponding to the target retrieval information is encrypted to obtain the encrypted homomorphic query ciphertext, and the encrypted homomorphic query ciphertext is sent to the server. The server receives encrypted search result ciphertext sent by the server. The encrypted search result ciphertext is obtained by the server performing homomorphic linear combination processing on a pre-set set of prompt information based on the encrypted homomorphic query ciphertext and the search key to obtain the search result ciphertext, and then encrypting the search result ciphertext using the search key. Using the retrieval key and the homomorphic private key in the homomorphic key pair, the encrypted ciphertext of the retrieval result is decrypted to obtain the retrieval result corresponding to the target retrieval information; The set of prompt information is pre-built by the server, and the steps for building the set of prompt information include: The original data in the database is divided into multiple data sets, resulting in multiple data blocks; Using pre-set public parameters and an encoding function, the data block is mapped to the corresponding plaintext polynomial; Using a randomized homomorphic encryption algorithm, the plaintext polynomial is encrypted using the common parameters and randomly generated sampling noise to obtain the prompt information corresponding to the data block. The prompt information corresponding to each data block is summarized to obtain the prompt information set; The set of prompt information is pre-constructed by the server, and the calculation process of the prompt information is as follows: ； in, The prompt message corresponding to the j-th data block; This is a randomized homomorphic encryption algorithm based on RLWE; Generate a public key for the prompt message; For common polynomial parameters; The polynomial corresponding to random sampled noise Let j be the plaintext polynomial corresponding to the j-th data block. , For polynomial ring parameters; The encoding function Encode satisfies the linear property. If the homomorphism holds, the server can extract the accurate plaintext polynomial. If the encoding function Encode does not satisfy the linear property, the subsequent steps can continue; The homomorphism does not hold, and the server cannot extract the accurate plaintext polynomial. If this happens, subsequent steps will not function correctly.

2. The quantum-resistant private information retrieval method according to claim 1, characterized in that, Obtain the homomorphic key pair and post-quantum temporary key pair corresponding to the target retrieval information, including: Obtain the target search information input by the user and retrieve pre-set common parameters; Based on the public parameters, generate homomorphic key pairs and post-quantum temporary key pairs corresponding to the target retrieval information.

3. The quantum-resistant private information retrieval method according to claim 2, characterized in that, The common parameters include ring dimension parameters, modulus parameters, polynomial ring parameters, and common polynomial parameters.

4. The quantum-resistant private information retrieval method according to claim 1, characterized in that, Using the homomorphic public key in the homomorphic key pair and the retrieval key, the retrieval vector corresponding to the target retrieval information is encrypted to obtain the encrypted homomorphic query ciphertext, including: The target retrieval information is converted into a vector representation to obtain the retrieval vector; The retrieval vector is encrypted using the homomorphic public key in the homomorphic key pair to obtain the homomorphic query ciphertext; The homomorphic query ciphertext is encrypted using the retrieval key to obtain the encrypted homomorphic query ciphertext.

5. The quantum-resistant private information retrieval method according to claim 1, characterized in that, Using the retrieval key and the homomorphic private key in the homomorphic key pair, the encrypted ciphertext of the retrieval result is decrypted to obtain the retrieval result corresponding to the target retrieval information, including: Using the retrieval key, the encrypted ciphertext of the retrieval result is decrypted to obtain the decrypted ciphertext of the retrieval result; Using the homomorphic private key in the homomorphic key pair, the decrypted ciphertext of the search result is decrypted to obtain the search result corresponding to the target search information.

6. A quantum-resistant private information retrieval method, characterized in that, Applied to the server side, including: Obtain the post-quantum temporary public key sent by the client; Using the aforementioned post-quantum temporary public key, encapsulation processing is performed to obtain the retrieval key and the retrieval key encapsulated ciphertext; After encapsulating the retrieval key into ciphertext and sending it to the client, the system receives the encrypted homomorphic query ciphertext sent by the client. Based on the encrypted homomorphic query ciphertext and the retrieval key, a pre-set set of prompt information is subjected to homomorphic linear combination processing to obtain the retrieval result ciphertext. Using the retrieval key, the ciphertext of the retrieval result is encrypted to obtain the encrypted ciphertext of the retrieval result. The encrypted search results are sent to the client. The set of prompt information is pre-constructed by the server, and the calculation process of the prompt information is as follows: ； in, The prompt message corresponding to the j-th data block; This is a randomized homomorphic encryption algorithm based on RLWE; Generate a public key for the prompt message; For common polynomial parameters; The polynomial corresponding to random sampled noise Let j be the plaintext polynomial corresponding to the j-th data block. , For polynomial ring parameters; The encoding function Encode satisfies the linear property. If the homomorphism holds, the server can extract the accurate plaintext polynomial. If the encoding function Encode does not satisfy the linear property, the subsequent steps can continue; The homomorphism does not hold, and the server cannot extract the accurate plaintext polynomial. If this happens, subsequent steps will not function correctly.

7. The quantum-resistant private information retrieval method according to claim 6, characterized in that, Based on the encrypted homomorphic query ciphertext and the retrieval key, a pre-set set of prompt information is subjected to homomorphic linear combination processing to obtain the ciphertext of the retrieval result, including: Using the retrieval key, the encrypted homomorphic query ciphertext is decrypted to obtain the decrypted homomorphic query ciphertext; Extract the target index information corresponding to the target retrieval information from the decrypted homomorphic query ciphertext; Based on the target index information, a homomorphic linear combination process is performed on the pre-set set of prompt information to obtain the ciphertext of the search results.

8. The quantum-resistant private information retrieval method according to claim 7, characterized in that, Based on the target index information, a homomorphic linear combination process is performed on the pre-set set of prompt information to obtain the ciphertext of the search results, including: From the set of prompt information, determine the prompt information corresponding to the target index information; Based on the decrypted homomorphic query ciphertext, generate homomorphic linear coefficients; Based on the homomorphic linear coefficients and the prompt information, homomorphic linear operations are performed to obtain the encrypted search results.

9. The quantum-resistant private information retrieval method according to claim 8, characterized in that, Based on the homomorphic linear coefficients and the prompt information, homomorphic linear operations are performed to obtain the ciphertext of the search results, including: Based on the homomorphic linear coefficients and the prompt information, homomorphic linear operations are performed to obtain the initial ciphertext of the search results; Based on the homomorphic public key in the homomorphic key pair sent by the client, generate small random noise data that meets the preset differential privacy requirements. The initial ciphertext of the search results is optimized using the small random noise data to obtain the ciphertext of the search results.

Images