A verifiable private search method and system

Abstract

The application discloses a verifiable privacy search method and system, a server maps an original database into a lattice matrix and calculates an auxiliary index matrix, a client generates a hash digest of the auxiliary index matrix and strips the hash digest to the server for depositing; the client constructs privacy query ciphertext based on a linear privacy search mechanism of a lattice difficulty problem; the server calculates a homomorphic response vector and constructs a proof tensor; the client generates a challenge vector, and the server generates a compressed proof according to the proof tensor; the client performs consistency verification, and if the verification is passed, the client restores target data through a stripping signal, otherwise, the client triggers an alarm; and the client inversely maps the target data and delivers the target data to an application layer. The system is deployed in a client-server architecture and supports coexistence of stateful and stateless clients. The application realizes privacy search and response verification, is lightweight and suitable for resource-limited devices, can be applied to various structured database scenes, and has high security and implementability.

Description

Technical Field

[0001] This invention belongs to the interdisciplinary field of network security and privacy computing, and specifically relates to a verifiable privacy retrieval method and system. Background Technology

[0002] Privacy information retrieval is a core underlying technology for data privacy protection queries in the fields of privacy computing and secure multi-party computation. Its fundamental task is to allow users to obtain specific entry information from remote servers without disclosing the query index to the database server, thereby achieving efficient data retrieval while protecting the user's query intent, location privacy, and preference privacy.

[0003] In recent years, significant progress has been made in privacy information retrieval solutions for single-server scenarios. Based on different client storage requirements and security attributes, existing technologies can be mainly divided into the following three categories:

[0004] Category 1: Verifiable Simple Privacy Information Retrieval. This type of scheme is based on Regev's error-based learning problem encryption system. It processes the database as a matrix and uses a pre-processed "hint" matrix H for decryption and verification. Proofs are generated offline to ensure the correctness of responses in the online phase (see: L. De Castro and K. Lee, "VeriSimplePIR: Verifiability in SimplePIR at No Online Cost for HonestServers," in Proc. 33rd USENIX Security Symp., 2024). Its core drawback lies in the excessive client-side storage overhead. The decryption and verification process heavily relies on the local persistent storage of the large hint information H, resulting in a strong binding between the client state and lattice parameters, making it unsuitable for resource-constrained devices. Furthermore, this type of scheme recursively applies a verifiable lightweight homomorphic encryption scheme in the preprocessing stage, requiring the additional introduction of the Fiat-Shamir heuristic to reduce interactions. This not only increases protocol complexity but also relies on the random oracle assumption, failing to achieve security proof based on the standard lattice assumption.

[0005] The second category: Hintless single-server private information retrieval. This type of solution currently offers the lowest client-side storage overhead for single-server private information retrieval and belongs to the category of high-efficiency, non-verification-based retrieval solutions. Its core innovation lies in eliminating the need for the client to store large amounts of hint information. Instead, it uses fully homomorphic encryption to securely delegate the hint-related calculations, which would otherwise have to be performed locally on the client, to the server in encrypted form (see: Li, Baiyu, et al. "Hintless single-server private information retrieval." Annual International Cryptology Conference, 2024). It focuses entirely on reducing client-side storage and does not incorporate any verifiable mechanisms. It is impossible to determine whether the server has tampered with data, returned incorrect results, or launched a selective failure attack. It can only guarantee query privacy under the assumption of a semi-honest server, thus limiting its applicability.

[0006] The third category: Stateless privacy information retrieval. This type of solution is specifically designed for stateless clients and one-time access scenarios. By simplifying the preprocessing process, reconstructing the query structure, and optimizing the communication mode, it allows clients to initiate privacy queries without storing any long-term verification state. It is suitable for scenarios where browsers, mini-programs, and other applications cannot store state. While this type of solution achieves statelessness and low storage, it completely lacks verifiability and cannot resist arbitrary attacks from malicious servers. It can only guarantee that the query is not leaked, but cannot guarantee the correctness of the results, and is only suitable for semi-honest scenarios.

[0007] A comprehensive comparison of the three existing solutions reveals the following four common technical shortcomings in the field of verifiable privacy information retrieval:

[0008] 1. Verifiability and low client storage cannot be achieved simultaneously. This means that the client must store a large amount of data such as prompts and proof matrices, with storage overhead typically reaching hundreds of MB to GB. On the other hand, solutions that achieve extremely low or zero client storage (such as the second and third types) completely abandon the verifiability mechanism.

[0009] 2. Only supports single-state clients, unable to adapt to mixed scenarios. Existing technologies force clients to maintain long-term state, and stateless clients, unable to store verification data, lack malicious security protection; stateless solutions, in pursuit of lightweight design, completely eliminate preprocessing and verification, providing only the weakest semi-honest security. Currently, no solution can simultaneously support the coexistence of long-term stateful users and temporary stateless users, failing to match mixed scenarios in real-world systems such as high-frequency users, temporary visitors, and anonymous access.

[0010] 3. Reliance on non-standard security assumptions and redundant and complex protocol structure: Since mainstream verifiable schemes generally rely on non-standard assumptions such as random oracles, Fiat-Shamir heuristics, and recursive verifiable homomorphic encryption, security proofs are complex and have poor universality. At the same time, the protocol process is nested with multiple layers of logic, the preprocessing stage is cumbersome, and the verification logic and decryption logic are bound in the same process, which cannot be separated, simplified or optimized separately, resulting in high overall implementation cost, poor stability and difficulty in deployment on lightweight devices.

[0011] 4. Client initialization and preprocessing overhead is enormous. Existing verifiable solutions require a lengthy, high-traffic offline preprocessing process before the client's first use. This involves downloading a large amount of verification materials, database summaries, and proof data from the server and verifying and storing them locally. The entire initialization process can take tens of seconds to several minutes, which can easily lead to timeouts and lag on resource-constrained terminals such as mobile phones and IoT devices. Summary of the Invention

[0012] Purpose of the Invention: To address the inherent shortcomings of existing verifiable privacy information retrieval technologies, such as the inability to simultaneously achieve verifiability and low storage, support for only single-state clients, reliance on non-standard security assumptions, excessive preprocessing and initialization overhead, and insufficient protocol robustness, this invention provides a verifiable privacy retrieval method and system. The aim is to solve the technical problems of existing verifiable privacy retrieval technologies, including large client storage requirements, high proof overhead, lack of security guarantees for stateless clients, and reliance on non-standard assumptions.

[0013] Technical Solution: The present invention provides a verifiable privacy retrieval method, which performs the following steps based on a novel verifiable linear homomorphic encryption architecture:

[0014] Step 1: Database structured modeling and physical separation of storage burden:

[0015] The server maps the original database D containing N entries into a lattice matrix. , m is the dimension of each data entry; the server calculates the auxiliary index matrix. A is a random benchmark matrix. ;

[0016] The client generates an auxiliary index matrix using a collision-resistant hash function. constant space hash digest Then the auxiliary index matrix Physically stripping storage from the client's local memory and transferring it to server-side persistent storage reduces client storage overhead. downgraded to This achieves complete decoupling from the size of the database;

[0017] The original database is any of the following structured databases: privacy identity database, password leakage detection database, blockchain account database, or distributed lightweight node feature database; the database entries are any of the following binary data: hash value, public key, ciphertext block, or feature vector; the resource-constrained client is any of the following devices: mobile phone, Internet of Things (IoT) device, or stateless terminal;

[0018] Step 2, Constructing a privacy-preserving query based on noise masking: that is, the client constructs the query based on the query index. Constructing a query vector containing random perturbation parameters based on the lattice structure noise perturbation mechanism ;

[0019] Step 3: Homomorphic response calculation and linear proof trajectory generation, i.e., receiving the ciphertext query. Then, the server calculates the response vector in the encrypted space. Simultaneously construct the proof tensor ;

[0020] Step 4: Proof Dimensionality Reduction and Compression Driven by Random Challenges:

[0021] The client first generates the challenge vector. The server determines the challenge vector. Perform a linear dimension reduction mapping on the proof tensor Z to generate a compressed proof vector. To reduce communication overhead from Compress to ;

[0022] Step 5: Explicitly separate the response consistency verification logic from the target masking signal:

[0023] The client performs a consistency check to determine if the inequality is true. If true, the client confirms the server's response is correct and performs a signal stripping operation to restore the target data. If false, the client refuses to respond and triggers a malicious alarm mechanism.

[0024] Step 6: Data Reverse Mapping and Application Layer Delivery

[0025] The client will recover the target data The values ​​in the modulus space are inversely mapped to binary bit sequences, and the original entries are reconstructed by concatenation and splicing before being delivered to the application layer interface.

[0026] Furthermore, in step 1, the original database D is mapped to a lattice matrix. The specific method is as follows: slice the bitstream of each entry j into a mapping operator. The expression is as follows:

[0027] ;

[0028] Thus constructing a database matrix ;

[0029] Where m represents each database entry, which is divided into m independent bit segments, corresponding to the row dimension of matrix D, and k represents the binary bit weight index. This represents the binary bit value of the k-th bit in the i-th row of data, with i pointing to the entry index (row index) in the database.

[0030] Furthermore, the specific method for constructing the query ciphertext in step 2 includes:

[0031] Step 2.1, secret sampling;

[0032] The client obtains the n-dimensional secret vector by sampling using a hardware random number generator. and from discrete Gaussian distribution N noise values ​​are extracted from the noise vector to form a noise vector e;

[0033] ;

[0034] Among them, the hard random number generator obtains a high-entropy seed, and in the model... Perform uniform distribution sampling within the integer field Discrete Gaussian distribution Center 0 and standard deviation is ;

[0035] The noise vector e mentioned above is derived from a discrete Gaussian distribution. Independent and identically distributed sampling It consists of a series of tiny noise values, expressed as: ; ;

[0036] Step 2.2, Linear Encoding;

[0037] Using unit impulse vector Capture the target location of the query and compare it with the scaling factor. Multiply, where ;

[0038] Step 2.3: Ciphertext synthesis;

[0039] By calculating the combination of matrix and vector multiplication. It uses grid noise to mask specific query indexes of users.

[0040] Furthermore, in step 3, the server receives the query ciphertext. Then, without performing any decryption operations, linear projection calculation is directly performed on the ciphertext space. The specific method is as follows:

[0041] Step 3.1: Homomorphic projection, the server calculates the response vector. The response vector is logically equivalent to a linear combination of the target data, the prompt information, and the noise term:

[0042] modq);

[0043] in That is, the target data column;

[0044] Step 3.2: Calculate the trajectory correlation proof. To address the risk of malicious server tampering, the server synchronously constructs a high-dimensional proof matrix. The server constructs a proof tensor to lock the computation path. , its first OK The elements of a column are represented as the locus of the product of database elements and query components:

[0045] ;

[0046] This construction ensures that: This matrix records the database matrix. With query noise The linear interaction trajectory between them serves as mathematical evidence for subsequent "black box reconciliation".

[0047] Furthermore, the challenge vector in step 4 Each of its components Taken from a predefined short integer challenge space or The client invokes a pseudo-random number generator, using the temporary timestamp of the current retrieval session and the private key derivation value as the seed. Generate m independent and identically distributed random components to construct the challenge vector. ;

[0048] The server receives the challenge vector. Then, the principle of linear superposition was used to prove the matrix. Perform dimensionality reduction mapping to generate compressed proof vectors ;

[0049] ;

[0050] in for The Row vectors; compressed proof vectors The downlink communication overhead is collapsed from matrix level to vector level; the proof shows that the size is reduced from... Collapse into Communication overhead optimized to .

[0051] Furthermore, the security boundary in step 5 is set as follows: Consistency verification is used to perform inverse lattice space mapping on the compressed proof returned by the server, restoring the verification baseline value related to the current query noise e. When the verification fails, the client directly rejects the response without needing to re-execute the offline preprocessing steps. In the protocol closed-loop phase, the client executes the final "denoising" and verification logic. The specific method is as follows:

[0052] Step 5.1, Consistency Verification;

[0053] The client uses private parameters Execute decoding and verification logic :

[0054] ;

[0055] The verification judgment expression is ;

[0056] in This is an indicator function, a binary decision operator used to transform the logical expression within parentheses into a discrete output; when the decision condition (residual norm less than a threshold) is met... When the condition is met, the output verification signal is passed. Conversely, if the condition is not met, a verification failure signal is output. This triggers the system's malicious alert mechanism;

[0057] in It is an infinite norm, used to map and capture the peak absolute value component in the boundary of the dynamic error vector, thereby defining the amount of computational drift generated by the server under extreme noise topology distribution, and ensuring that it does not exceed the preset safety constraint boundary. This serves as a safety boundary; if the inequality holds, it proves that the server has not... To illegally tamper with; Compressed proof used for sending back to the server Perform inverse mapping of the lattice space to restore the noise associated with the current query. Relevant verification benchmark values ​​are used to eliminate quantization losses caused by network transmission;

[0058] Step 5.2, signal stripping: If the equation holds true (i.e., the server did not cheat), The client performs a signal stripping operation. ;

[0059] If the equation is not true (i.e.) The client directly rejects the response, without performing signal stripping, and there's no need to re-execute the offline preprocessing step, thus improving protocol robustness. This step enables precise separation of the most stable and correct response signal through consistency verification even in noisy environments. This ensures the security of search results against malicious attacks even under extremely low storage conditions.

[0060] Furthermore, step 6, data inverse mapping and application layer delivery, specifically includes:

[0061] Step 6.1, Scalar to Bitstream Inverse Projection Mapping: For each component in the recovered target data Perform bit-width-based binary decomposition to restore the modulus space values ​​to a binary bit sequence. ;

[0062] ;

[0063] This operator collapses the numerical scalar in the modulo space back into the binary Boolean space;

[0064] Step 6.2, Global Bitstream Concatenation and Reconstruction, i.e., the client uses the serial concatenation operator. The bit sequences of all components are concatenated and spliced ​​according to a preset topological order to reconstruct the complete original entry bit stream. ;

[0065] ;

[0066] Step 6.3, Data Semantic Recovery and Delivery: The original entry bitstream is processed according to a predefined metadata format. Decoding to recover semantic properties and deliver the data to the application layer;

[0067] ;

[0068] Step 6.4, memory-safe destruction, which involves synchronously executing memory scrambling instructions to destroy all temporary intermediate variables involved in this retrieval session. To ensure forward safety.

[0069] This invention also discloses a verifiable privacy retrieval system, deployed in a client-server architecture, comprising:

[0070] The database modeling module, located on the server side, is used to map the original database D into a lattice matrix and calculate the auxiliary index matrix H;

[0071] The client-side query construction module, located on the client side, is used to construct query vectors and generate challenge vectors based on the lattice structure noise perturbation mechanism.

[0072] The server response module, located on the server side, is used to compute the response vector v and the proof tensor Z in the homomorphic ciphertext space, and generate a compressed proof vector based on the challenge vector.

[0073] The client-side verification and stripping module, located on the client side, is used to perform consistency checks to determine the correctness of the server response, and to perform signal stripping to restore the target data when the verification passes.

[0074] The data delivery and destruction module, located on the client side, is used to perform data inverse mapping, bitstream reconstruction, semantic recovery, result delivery, and memory-safe destruction of session temporary variables.

[0075] The client-server architecture supports the coexistence of stateful and stateless clients. The stateless client performs verifiable privacy retrieval without persistently storing the auxiliary index matrix H by executing the hash digest storage and auxiliary index matrix remote storage mechanism in step 1.

[0076] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0077] 1. Achieve synergistic compatibility between verifiability and extremely low client storage, fundamentally overcoming the bottleneck of their mutual exclusion.

[0078] This invention breaks the inherent contradiction in existing technologies where "verification requires high storage, while low storage requires abandoning verification altogether." While fully preserving the ability to verify against malicious servers, it reduces client-side persistent storage overhead by more than three orders of magnitude, from gigabit levels to kilobits. By securely and remotely hosting the core computations required for verification and decryption to the server and eliminating the client's reliance on storing large auxiliary index matrices, the solution truly aligns with the design principle of "saving client-side storage" in privacy information retrieval, enabling stable deployment on resource-constrained devices such as mobile phones and IoT terminals.

[0079] 2. Build a unified security model that is compatible with both stateful and stateless clients, covering real-world hybrid application scenarios.

[0080] This invention constructs an asynchronous verification topology that allows for the coexistence of stateful and stateless clients. Because the ciphertext of queries generated by stateless clients and those generated by stateful clients is computationally indistinguishable in the cryptographic space, malicious servers cannot predict whether the current query contains the full auxiliary index matrix. When a malicious server attempts to implement a false response or data tampering, its tampering behavior will be captured with deterministic probability by the stateful client containing the full auxiliary index matrix through residual verification, triggering an alarm. This forms a cryptographically constrained technical defense mechanism in the global network, ensuring the integrity of the retrieved data. This meets the complex scenario requirements of real-world systems where multiple types of clients, such as high-frequency users, temporary users, and anonymous access, coexist.

[0081] 3. A lightweight protocol is built based on the standard lattice cryptography assumption, discarding redundant structures and non-standard assumptions.

[0082] This invention abandons the redundant designs of existing technologies, such as random oracles, Fiat-Shamir heuristics, and recursive verifiable homomorphic encryption. Instead, it constructs a secure system entirely based on standard, universal, and formally provable lattice-hard assumptions, such as the (ring)band error learning problem (R / LWE) and the small integer solution problem (SIS). Simultaneously, it simplifies the preprocessing flow, removes complex structures such as recursive calls and double commitments, reduces the difficulty of protocol implementation, improves operational stability, and makes the solution easier to deploy in engineering, port across platforms, and maintain long-term security.

[0083] 4. Significantly reduce client initialization and preprocessing overhead, enabling lightweight, streaming, and low-latency startup.

[0084] This invention addresses the problems of slow initialization, high bandwidth usage, and high resource consumption in existing solutions. Through methods such as proof compression, random challenge dimensionality reduction, streaming preprocessing, and segmented loading, it compresses massive verification data to an extremely small size, allowing clients to start the service without having to download, store, and verify all data at once. This significantly reduces initial usage time, network bandwidth consumption, and memory usage, enabling the solution to quickly complete initialization and be deployed even on weak network, narrowband, and low-performance devices.

[0085] 5. Enhance protocol robustness, effectively resist selective failure attacks, and enable rapid recovery from verification failures.

[0086] This invention improves the system's stability and anti-attack capabilities in malicious environments, enabling clients to effectively resist selective failure attacks, response tampering attacks, and forged data attacks by the server. At the same time, it enables proof reusability and eliminates the need to re-execute the complete preprocessing if verification fails, greatly improving the system's fault tolerance and operational smoothness. It also avoids service interruption due to a single verification anomaly, thereby maintaining continuous, reliable, and efficient privacy retrieval services in real, untrusted network environments. Attached Figure Description

[0087] Figure 1 This is a diagram illustrating the overall logical architecture of the present invention;

[0088] Figure 2 This is a diagram illustrating the entire process architecture for intercepting malicious mobile websites based on privacy-verifiable retrieval. Detailed Implementation

[0089] The technical solution of the present invention will be described in detail below, but the scope of protection of the present invention is not limited to the embodiments described.

[0090] like Figure 1 and Figure 2 As shown, the verifiable privacy retrieval method of the present invention performs the following steps based on a novel verifiable linear homomorphic encryption architecture:

[0091] Step 1: Database structured modeling and physical separation of storage burden:

[0092] The server maps the original database D containing N entries into a lattice matrix. Where m is the dimension of each data entry; then the auxiliary index matrix is ​​calculated. A is a random benchmark matrix. The client generates an auxiliary index matrix using a collision-resistant hash function. constant space hash digest Then the auxiliary index matrix The data is physically stripped from the client's local memory and then persistently stored on the server. Existing technologies rely on random oracles and non-standard assumptions, but this embodiment replaces them with the standard lattice hard assumption based on the annular error learning difficulty assumption and the short integer solution problem.

[0093] Step 2, Constructing a privacy-preserving query based on noise masking: that is, the client constructs the query based on the query index. Constructing query vectors based on lattice structure noise perturbation mechanism Existing technologies typically require the client to download and store the complete retrieval auxiliary parameter matrix (hint auxiliary matrix) at once. The linear privacy retrieval mechanism delegates the calculation process of retrieval auxiliary parameters to the server and adopts a streaming processing method, which realizes simultaneous collection, calculation, and discarding, leaving only compressed proof.

[0094] Step 3: Homomorphic response calculation and linear proof trajectory generation, i.e., receiving the ciphertext query. Then, the server calculates the response vector in the encrypted space. Simultaneously construct the proof tensor ;

[0095] Step 4: Proof Dimensionality Reduction and Compression Driven by Random Challenges:

[0096] The client first generates the challenge vector. The server determines the challenge vector. Linear dimensionality reduction mapping is performed on the proof tensor Z to generate a compressed proof vector. ;

[0097] Step 5: Explicitly separate the response consistency verification logic from the target masking signal. The client performs a consistency check; if the check passes, the server response is confirmed as correct, and the client performs a signal stripping operation to restore the target data. If the check fails, the client refuses to respond and triggers a malicious alert mechanism. Query-level preprocessing is introduced here to offset the server computational overhead caused by enhanced security. By pre-calculating some intermediate values, the online latency is kept at a level comparable to the fastest solution.

[0098] Step 6, Data Inverse Mapping and Application Layer Delivery: The client inverse maps the recovered target data from the modulo space numerical values ​​to a binary bit sequence, reconstructs the original entry through concatenation, and delivers it to the application layer interface; the state indistinguishability mechanism ensures that stateless client queries and stateful client queries remain cryptographically indistinguishable, thereby constructing a malicious response detection constraint space.

[0099] The core logic of the above method is shown in the following mathematical mapping model:

[0100] ;

[0101] The definitions of the core parameters and symbols are as follows: It is the client targeting the index The generated masked query vector; It is a remotely hosted auxiliary index matrix, stored on the server side; It is an intermediate proof matrix generated by the server; It is a random challenge factor initiated by the client; Remote Hosting Auxiliary Index Matrix A summary of commitments and identification; For the system's global protocol parameter set, For lattice dimension, and It is a dual-modulus system. This is the signal scaling factor. The noise distribution is discrete Gaussian. This verifies the decision output (a Boolean value representing "accept" or "reject"). These are the final target data entries extracted.

[0102] In step 1 of this embodiment, the original database D is mapped to a lattice matrix. The specific method includes: slicing the bitstream of each entry j into a mapping operator. The expression is as follows:

[0103] ;

[0104] Thus constructing a database matrix ;

[0105] Where m represents each database entry, which is divided into m independent bit segments, corresponding to the row dimension of the database matrix D, and k represents the binary bit weight index. This represents the binary bit value of the k-th bit in the i-th row of data.

[0106] The specific method for constructing the query ciphertext in step 2 of this embodiment includes:

[0107] Step 2.1, secret sampling;

[0108] The client obtains the n-dimensional secret vector by sampling using a hardware random number generator. and from discrete Gaussian distribution Extract N noise values ​​to form a noise vector ;

[0109] ;

[0110] Among them, the hard random number generator obtains a high-entropy seed, and in the model... Perform uniform distribution sampling within the integer field Discrete Gaussian distribution Center 0 and standard deviation is ;

[0111] The above noise direction From discrete Gaussian distribution Independent and identically distributed sampling It consists of a series of tiny noise values, expressed as: ; ;

[0112] Step 2.2, Linear Encoding;

[0113] Using unit impulse vector Capture the target location of the query and compare it with the scaling factor. Multiply, where ;

[0114] Step 2.3: Ciphertext synthesis;

[0115] Perform matrix-vector multiplication and addition operations This hides the query intent i within the grid noise.

[0116] In step 3 of this embodiment, the server receives the query ciphertext. Then, without performing any decryption operations, linear projection calculation is directly performed on the ciphertext space. The specific method is as follows:

[0117] Step 3.1: Homomorphic projection, the server calculates the response vector. :

[0118] modq); For the target data column;

[0119] Step 3.2: Calculate the trajectory correlation proof; the server synchronously constructs a high-dimensional proof matrix. The server constructs a proof tensor to lock the computation path. , its first OK The elements of a column are represented as the locus of the product of database elements and query components:

[0120] ;

[0121] .

[0122] The challenge vector in step 4 of this embodiment Each of its components Taken from a predefined short integer challenge space or The client invokes a pseudo-random number generator, using the temporary timestamp of the current retrieval session and the private key derivation value as the seed. Generate m independent and identically distributed random components to construct the challenge vector. ;

[0123] The server receives the challenge vector. Then, the principle of linear superposition was used to prove the matrix. Perform dimensionality reduction mapping to generate compressed proof vectors ;

[0124] ;

[0125] in for The Row vectors.

[0126] In step 5 of this embodiment, the safety boundary is set as follows: Consistency verification is used to perform inverse lattice space mapping on the compressed proof returned by the server, restoring the verification baseline value related to the current query noise e. When the verification fails, the client directly rejects the response without needing to re-execute offline preprocessing. The specific verification method is as follows:

[0127] Step 5.1, Consistency Verification;

[0128] The client uses private parameters Execute decoding and verification logic :

[0129] ;

[0130] The verification judgment expression is ;

[0131] in For indicator functions, It is an infinite norm. ;

[0132] When the judgment condition is met, output a verification pass signal. Conversely, if the condition is not met, a verification failure signal is output. This triggers the system's malicious alert mechanism;

[0133] Step 5.2, signal stripping: If the equation holds true, meaning the server did not cheat, The client performs a signal stripping operation: ;

[0134] If the equation is not true, that is... The client directly rejects the response, does not perform signal stripping, and does not need to re-execute the offline preprocessing steps.

[0135] Step 6 of this embodiment specifically includes: Data inverse mapping and application layer delivery.

[0136] Step 6.1, Scalar to Bitstream Inverse Projection Mapping: For each component in the recovered target data Perform bit-width-based binary decomposition to restore the modulus space values ​​to a binary bit sequence. ;

[0137] ;

[0138] ;

[0139] Step 6.2, Global Bitstream Concatenation and Reconstruction, i.e., Client-Side Serial Concatenation Operator By concatenating the bit sequences of all components in a preset topological order, the complete original entry bit stream is restored. ;

[0140] ;

[0141] Step 6.3, Data Semantic Recovery and Delivery: The original entry bitstream is processed according to a predefined metadata format. Decoding to recover semantic properties and deliver the data to the application layer;

[0142] ;

[0143] Step 6.4, memory-safe destruction, which involves synchronously executing memory scrambling instructions to destroy all temporary intermediate variables involved in this retrieval session. .

[0144] The aforementioned verifiable privacy retrieval system is deployed in a client-server architecture and includes a database modeling module, a client query construction module, a server response module, a client verification and stripping module, and a data delivery and destruction module.

[0145] The database modeling module is located on the server side, mapping the original database D to a lattice matrix and calculating the auxiliary index matrix H; the client query construction module is located on the client side, constructing query vectors and generating challenge vectors based on the lattice structure noise perturbation mechanism; the server response module is located on the server side, calculating the response vector v and proof tensor Z in the homomorphic ciphertext space, and generating compressed proof vectors based on the challenge vectors; the client verification and stripping module is located on the client side, performing consistency checks to determine the correctness of the server response, and performing signal stripping to recover the target data when the verification passes; the data delivery and destruction module is located on the client side, performing data inverse mapping, bitstream reconstruction, semantic recovery, result delivery, and memory-safe destruction of session temporary variables; the client-server architecture supports the coexistence of stateful clients and stateless clients; the stateless client completes verifiable privacy retrieval without persistently storing the auxiliary index matrix H by executing the hash digest storage and remote storage mechanism of the auxiliary index matrix in step 1.

[0146] This invention, at the storage model level, reduces the client storage required to access an 8 GB database from over 1 GB to 512 KB through algebraic dimensionality reduction of the verification metadata. This represents a physical storage reduction of approximately 2000 times, enabling verifiable privacy information retrieval to run on micro-embedded devices for the first time. Regarding security, this invention abandons the fragile random oracle assumption and is entirely built upon the standard lattice assumptions of ring fault-tolerant learning and the short integer solution problem.

[0147] This invention abandons the cumbersome step-by-step circuit verification method and proposes a highly efficient verification framework based on response consistency verification. During the server's execution of verifiable linear homomorphic encryption homomorphic operations, the computational trajectory is implicitly embedded into the response result using the properties of linear homomorphism. The client only needs to perform a single linear mapping comparison after decryption to complete the correctness verification. Simultaneously, this invention, combined with a query-level preprocessing optimization strategy, keeps the server-side throughput loss to an extremely low level, achieving online response latency similar to native privacy retrieval protocols while ensuring verifiability.

[0148] This invention introduces a covert and verifiable privacy retrieval security model, shifting the scope of security protection to an asymmetric camouflage mechanism. By achieving cryptographic indistinguishability between stateful and stateless queries at the protocol layer, this invention utilizes response decoupling and recovery techniques to prevent malicious servers from discerning the current visitor's verification capabilities. Based on this query state concealment, malicious servers face the potential risk of being caught and having their evidence exposed by stateful users, forcing them to remain honest with all clients in the system. This allows the invention to provide robust security and malicious response detection constraints for all users under heterogeneous resource constraints with extremely low system redundancy, significantly improving the inclusiveness and robustness of the privacy retrieval system.

[0149] The original database of this invention is any one of the following structured databases: a privacy identity database, a password leakage detection database, a blockchain account database, or an IoT device database; the database entries are hash values, public keys, ciphertext blocks, or feature vectors; the resource-constrained client is any one of the following devices: a mobile phone, an IoT device, or a stateless terminal, containing binary data.

[0150] To further verify the feasibility and outstanding technical effects of the present invention, it is applied here to an IoT device library. Since existing IoT terminals are often limited by extremely small Flash storage and narrowband communication environments, the present invention achieves security verification with ultra-low storage dependency through the following six specific steps.

[0151] Step 1: IoT device fingerprint modeling and remote hosting of storage payload

[0152] For large-scale IoT device databases (such as databases containing tens of millions of device public keys or firmware hashes), their features are first quantized into lattice matrices. By utilizing a remote hosting mechanism for verifying auxiliary states, an auxiliary index matrix is ​​generated in the cloud. IoT devices (such as microcontroller units, MCUs) only need to store a one-byte hash digest in their internal flash memory. The massive amount of original notification data was then physically deleted and remotely hosted in the cloud. This step technically resolved the storage bottleneck of resource-constrained terminals being unable to support large-scale security indexes.

[0153] Step 2: Masking the Intent of IoT Privacy Queries Across Trust Domains

[0154] When an IoT terminal (such as a smart sensor) needs to verify the identity of a specific device or retrieve a firmware update package, it first generates lightweight random noise that conforms to a discrete Gaussian distribution locally. The terminal encodes the query index (i.e., the logical location of the target device in the database) into a unit impulse vector, and synthesizes the encrypted query ciphertext by performing matrix-vector multiplication and addition operations. This step ensures that when an IoT device initiates a request via a public wireless network (such as NB-IoT or WiFi), its specific query intent (which device it is verifying) remains completely hidden from the cloud server.

[0155] Step 3: Homomorphic retrieval and computation trajectory locking of cloud edge nodes

[0156] The cloud server received the ciphertext query. Then, a linear projection calculation is performed directly on the IoT device database within the encrypted space to generate a preliminary response vector v. Simultaneously, the server must construct a proof tensor Z that records all retrieval paths. This tensor mathematically locks the server's processing details for each device feature point, preventing malicious actions such as false responses, data tampering, or selective discarding of device information during the retrieval process in the cloud.

[0157] Step 4: Random Challenge and Proof Compression in Narrowband IoT Environment

[0158] Considering the extremely narrow bandwidth of IoT communication environments (such as LoRa or ZigBee), which prevent the transmission of large original proof documents, the IoT terminal initiates a random challenge operator to the server. The server uses this operator to perform linear collapse and streaming dimensionality reduction on the high-dimensional proof tensor Z, reducing the communication overhead from matrix level to a miniature proof vector at the vector level. This operation significantly reduces the communication load on the downlink while ensuring the effectiveness of the verification.

[0159] Step 5: Lightweight Response Consistency Verification and Signal Stripping on the Terminal Side

[0160] The IoT terminal receives a miniature proof vector. Subsequently, based solely on a locally maintained constant-level space Collision-resistant hash digest With local private key A linear mapping comparison is performed, and the integrity of the remote auxiliary index matrix is ​​verified by determining whether the calculated residuals are within a preset safety envelope, thus extracting the actual device feature data. The entire process does not require complex proofs for terminal reconstruction, which aligns with the lightweight computing logic of stateless or resource-constrained terminals.

[0161] Step 6: Device semantic recovery and secure delivery of application layer

[0162] The terminal reverse-engineers the extracted numerical scalars using a binary decomposition operator, restoring them to the original target node metadata payload (including but not limited to node access control credentials, encrypted firmware segments, or attribute tag topology). After verification and retrieval, the edge stateless computing node immediately erases its memory. Finally, the restored metadata payload is delivered to the application layer for executing security control logic such as distributed node authentication and system upgrades.

[0163] This embodiment also deeply integrates verifiable privacy retrieval methods with technical issues such as feature vectors (binary data) and IoT devices (resource-constrained clients), solving the problems of "privacy leakage," "verification complexity," and "insufficient client resources" in existing technologies. It also clarifies the specific application scenarios and parameter settings of the technical solution. Through mechanisms such as noise masking and homomorphic encryption, the client's query intent and target data are hidden, preventing the server from obtaining any privacy information. Furthermore, temporary intermediate variables are promptly destroyed, ensuring the privacy and security of IoT device identity data. By using an auxiliary index matrix server for storage and a proof-based dimensionality reduction compression mechanism, the storage and computational burden on IoT devices (clients) is significantly reduced, adapting to the usage needs of resource-constrained devices and enabling widespread application in various IoT terminals.

[0164] Further supplementary charging parameters are provided for the above embodiments.

[0165] In a preferred embodiment of the present invention, to ensure constant-level communication overhead at 128-bit security strength, the system parameters are set as follows:

[0166] Spatial Scale and Grid Dimension Parameters: Grid Dimension Preferably between 1024 and 2048. Number of database entries. for to .

[0167] Number of entries Depending on the size of a single data entry, it is preferable to map each block to... After that, satisfied .

[0168] Module and scaling factor: Large module for to prime numbers between (e.g.) ).

[0169] Plaintext Modulus for to Adjustments are made based on the bit density of the original data. Scaling factor Set as .

[0170] Noise distribution and safety threshold: Gaussian standard deviation Sampling distribution The preferred standard deviation is 3.2. Error boundary conditions. Set as .

[0171] Based on the Gaussian distribution characteristics, the probability of noise overflow occurring at this time is less than Validation threshold The preferred calculation formula is: .

[0172] In actual deployment, Typically preset as Within a safe range to ensure the indication function The accuracy rate of the judgment is Random challenge operator distribution: Challenge domain For binary fields Challenge the vector dimension With database matrix The number of rows must be kept consistent. In the interactive proof, the probability of a forged proof passing can be reduced to [value missing] through 128 recursive iterations. .

Claims

1. A verifiable privacy retrieval method, characterized in that: Perform the following steps based on the novel verifiable linear homomorphic encryption architecture: Step 1: Database structured modeling and physical separation of storage burden: The server maps the original database D containing N entries into a lattice matrix. Where m is the dimension of each data entry; then the auxiliary index matrix is ​​calculated. A is a random benchmark matrix. ; The client generates an auxiliary index matrix using a collision-resistant hash function. constant space hash digest Then the auxiliary index matrix Physically stripped from the client's local memory and transferred to the server for persistent storage; Step 2, Constructing a privacy-preserving query based on noise masking: that is, the client constructs the query based on the query index. Generate a query vector containing random perturbation parameters. The query vector is then sent to the server. Step 3: Homomorphic response calculation and linear proof trajectory generation, i.e., receiving the ciphertext query. Then, the server performs linear response calculations in the encrypted space to generate a response vector. Simultaneously construct the proof tensor ; Step 4: Proof Dimensionality Reduction and Compression Driven by Random Challenges: The client first generates the challenge vector. The server determines the challenge vector. Linear dimensionality reduction mapping is performed on the proof tensor Z to generate a compressed proof vector. ; Step 5: Explicitly separate the response consistency verification logic from the target masking signal. That is, the client performs a consistency verification. If the verification passes, the server response is confirmed to be correct, and the client performs a signal stripping operation to restore the target data. If the verification fails, the client refuses to respond and triggers a malicious alarm mechanism. Step 6: Data Reverse Mapping and Application Layer Delivery The client reverse maps the recovered target data from the modulus space values ​​to a binary bit sequence, reconstructs the original entry through concatenation and splicing, and delivers it to the application layer interface.

2. The verifiable privacy retrieval method according to claim 1, characterized in that: In step 1, the original database D is mapped to a lattice matrix. The specific method includes: slicing the bitstream of each entry j into a mapping operator. The expression is as follows: ； Thus constructing a database matrix ; Where m represents each database entry, which is divided into m independent bit segments, corresponding to the row dimension of the database matrix D, and k represents the binary bit weight index. This represents the binary bit value of the k-th bit in the i-th row of data.

3. The verifiable privacy retrieval method according to claim 1, characterized in that: Step 2 involves constructing the query ciphertext, including the following methods: Step 2.1, secret sampling; The client obtains the n-dimensional secret vector by sampling using a hardware random number generator. and from discrete Gaussian distribution Extract N noise values ​​to form a noise vector ; ； Among them, the hard random number generator obtains a high-entropy seed, and in the model... Perform uniform distribution sampling within the integer field Discrete Gaussian distribution Center 0 and standard deviation is ; The above noise direction From discrete Gaussian distribution Independent and identically distributed sampling It consists of a series of tiny noise values, expressed as: ; ; Step 2.2, Linear Encoding; Using unit impulse vector Capture the target location of the query and compare it with the scaling factor. Multiply, where ; Step 2.3: Ciphertext synthesis; Perform matrix-vector multiplication and addition operations This method uses grid noise to mask the user's specific query index, hiding the query intent within the grid noise.

4. The verifiable privacy retrieval method according to claim 1, characterized in that: In step 3, the server receives the query ciphertext. Then, without performing any decryption operations, linear projection calculation is directly performed on the ciphertext space. The specific method is as follows: Step 3.1: Homomorphic projection, the server calculates the response vector. : modq); For the target data column; Step 3.2: Calculate the trajectory correlation proof; the server synchronously constructs a high-dimensional proof matrix. The server constructs a proof tensor to lock the computation path. , its first OK The elements of a column are represented as the locus of the product of database elements and query components: ； The above construction ensures .

5. The verifiable privacy retrieval method according to claim 1, characterized in that, Challenge vector in step 4 Each of its components Taken from a predefined short integer challenge space or The client invokes a pseudo-random number generator, using the temporary timestamp of the current retrieval session and the private key derivation value as the seed. Generate m independent and identically distributed random components to construct the challenge vector. ; The server receives the challenge vector. Then, the principle of linear superposition was used to prove the matrix. Perform dimensionality reduction mapping to generate compressed proof vectors ; ； in for The Each row vector, compressed proof vector The downlink communication overhead is collapsed from matrix level to vector level.

6. The verifiable privacy retrieval method according to claim 1, characterized in that, The security boundary in step 5 is set as follows: Consistency verification is used to perform inverse lattice space mapping on the compressed proof returned by the server, restoring the verification baseline value related to the current query noise e. When the verification fails, the client directly rejects the response without needing to re-execute offline preprocessing. The specific verification method is as follows: Step 5.1, Consistency Verification; The client uses private parameters Execute decoding and verification logic : ； The verification judgment expression is ; in For indicator functions, It is an infinite norm. ; When the judgment condition is met, output a verification pass signal. ; Conversely, if the condition is not met, a verification failure signal is output. This triggers the system's malicious alert mechanism; Step 5.2, signal stripping: If the equation holds true, meaning the server did not cheat, The client performs a signal stripping operation: ; If the equation is not true, that is... The client directly rejects the response, does not perform signal stripping, and does not need to re-execute the offline preprocessing steps.

7. The verifiable privacy retrieval method according to claim 1, characterized in that, Step 6, data inverse mapping and application layer delivery, specifically includes: Step 6.1, Scalar to Bitstream Inverse Projection Mapping: For each component in the recovered target data Perform bit-width-based binary decomposition to restore the modulus space values ​​to a binary bit sequence. ; ； ； Step 6.2, Global Bitstream Concatenation and Reconstruction: The client utilizes the serial concatenation operator. The bit sequences of all components are concatenated and spliced ​​according to a preset topological order to restore the complete original entry bit stream. ; ； Step 6.3, Data Semantic Recovery and Delivery: The original entry bitstream is processed according to a predefined metadata format. Decoding to recover semantic properties and deliver the data to the application layer; ； Step 6.4, memory-safe destruction, which involves synchronously executing memory scrambling instructions to destroy all temporary intermediate variables involved in this retrieval session. .

8. A system for implementing the verifiable privacy retrieval method as described in any one of claims 1 to 7, characterized in that, Deployed in a client-server architecture, it includes a database modeling module, a client query construction module, a server response module, a client verification and stripping module, and a data delivery and destruction module; The database modeling module is located on the server side, which maps the original database D into a lattice matrix and calculates the auxiliary index matrix H. The client-side query construction module is located on the client side and constructs query vectors and generates challenge vectors based on the lattice structure noise perturbation mechanism. The server response module is located on the server side. It calculates the response vector v and the proof tensor Z in the homomorphic ciphertext space and generates a compressed proof vector based on the challenge vector. The client-side verification and stripping module is located on the client side. It performs consistency checks to determine the correctness of the server response, and performs signal stripping to restore the target data when the verification passes. The data delivery and destruction module is located on the client side and performs data inverse mapping, bitstream reconstruction, semantic recovery, result delivery, and memory-safe destruction of session temporary variables. The client-server architecture supports the coexistence of stateful and stateless clients. The stateless client performs verifiable privacy retrieval without persistently storing the auxiliary index matrix H by executing the hash digest storage and remote storage mechanism of the auxiliary index matrix in step 1.

Images