A single-server incremental anonymous query method and system with verifiable forward privacy

Abstract

The application discloses a single-server incremental anonymous query method and system with verifiable forward privacy, belongs to the field of information security and cryptography, and solves the problems of multi-server non-collusion assumption, high calculation cost, lack of update verifiability and forward privacy protection in incremental anonymous query in a continuously updated ciphertext database. The method comprises the following steps: a data owner performs padding, blocking and ciphertext initialization on an original database to obtain a ciphertext database; a single server constructs a tree according to the ciphertext database, a client verifies the root value of the tree, and a local preprocessing state is established in a streaming manner after verification; the data owner, the single server and the client perform dynamic updating and authenticated incremental synchronization on the ciphertext database according to the local preprocessing state; the client generates an online anonymous query based on the ciphertext database after the incremental synchronization, the single server calculates an aggregated response of the ciphertext data, the client restores target ciphertext, completes authentication decryption, refreshes a prompt and safely erases a consumed state.

Description

Technical Field

[0001] This invention belongs to the field of information security and cryptography, and particularly relates to a single-server incremental anonymous query method and system that can verify forward privacy. Background Technology

[0002] With the development of privacy-sensitive digital services such as enhanced search generation systems, browser security services, and dynamic certificate management, the underlying database has evolved from static storage to a dynamic and mutable form: it is constantly being written to, modified, and deleted as external data sources are continuously connected. In such scenarios, user queries often directly reflect their focus, access intent, or business needs. Therefore, under the condition of continuous database updates, how to simultaneously ensure query privacy, query efficiency, and state maintainability has become a key issue facing anonymous query technology.

[0003] Incremental Private Information Retrieval (IncrementalPIR) offers a solution to the aforementioned problems. Its core objective is to allow clients to fix their local state based on the actual updates after a database update, rather than re-executing the entire preprocessing procedure, and continue with subsequent private queries. IncrementalPIR aims to shift the maintenance cost of database updates from depending on the overall database size to primarily depending on the size of the updated content, while simultaneously ensuring user query privacy.

[0004] However, in scenarios involving continuous database updates, existing incremental anonymous query techniques still have the following limitations: 1. Existing solutions mainly target multi-server scenarios, requiring that multiple servers not collude with each other. For example, Chor et al. proposed a multi-server private information retrieval scheme in "Private Information Retrieval" (Chor B, Goldreich O, Kushilevitz E, et al. Private information retrieval[J]. Journal of the ACM, 1998, 45(6):965–981.). This scheme restores target data by storing database copies on multiple servers and having the client send queries to each server separately. This scheme requires that the servers participating in the query not collude with each other, thereby preventing the servers from jointly analyzing the query information and inferring the client's query target. However, in real-world deployment environments, multi-server scenarios not only suffer from high economic costs of collaborative deployment, but the assumption of non-collusion is also often difficult to maintain stably in the long term, thus limiting the practical application of the solution.

[0005] 2. One type of existing private information retrieval scheme uses homomorphic encryption to achieve query privacy. For example, Mughees et al. disclosed the OnionPIR scheme based on lattice homomorphic encryption (Mughees MH, Chen H, Ren L. OnionPIR: Response efficient single-server PIR[C]. Proceedings of the 2021 ACM SIGSACConference on Computer and Communications Security, 2021.). However, it usually requires a lot of ciphertext operations, and the computational overhead is high in large-scale databases or high-concurrency scenarios.

[0006] 3. In dynamically updated scenarios, existing privacy information retrieval solutions often focus on the computational overhead of queries after database updates, while neglecting the verifiability of server update behavior and the impact of the update process on the privacy of historical queries. For example, Ma et al.'s incremental Offline / Online PIR (Ma Y, Zhong K, Rabin T, Angel S. Incremental Offline / Online PIR[C]. Proceedings of the 31st USENIX Security Symposium, 2022.) mainly addresses the efficient maintenance of preprocessing results in dynamic databases, without considering verifiability and forward privacy. Summary of the Invention

[0007] To overcome the shortcomings of the prior art, the present invention aims to provide a single-server incremental anonymous query method and system with verifiable forward privacy. By constructing a collaborative processing framework involving data owners, a single server, and clients, incremental maintenance, authentication synchronization verification, and secure erasure after query are achieved in a single-server encrypted outsourcing environment. This enables efficient anonymous query, update consistency verification, and forward privacy protection simultaneously in a continuously updating database scenario.

[0008] To achieve the above objectives, the technical solution adopted by the present invention is as follows: A single-server incremental anonymous query method for verifying forward privacy includes the following steps: Step 1, Data Owner The original database is padded, segmented, and initialized with ciphertext to obtain a ciphertext database. Step 2, Single Server Built from a ciphertext database Tree, client verify After the root value of the tree is verified, a local preprocessing state is established in a streaming manner. Step 3, Data Owner Single server and client Dynamic updates and certified incremental synchronization of the encrypted database are performed based on the local preprocessing status; Step 4, Client Online anonymous queries are generated based on the incrementally synchronized encrypted database, single server. The client computes the aggregated response of the encrypted data. Recover the target ciphertext and complete authentication and decryption; Step 5, Client After completing authentication and decryption, refresh the prompt and securely erase the consumed state.

[0009] A single-server incremental anonymized query system with verifiable forward privacy includes: Initialization module, data owner The original database is padded, segmented, and initialized with ciphertext to obtain a ciphertext database. Verification module, single server Built from a ciphertext database Tree, client verify After the root value of the tree is verified, a local preprocessing state is established in a streaming manner. Update module, data owner Single server and client Dynamic updates and certified incremental synchronization of the encrypted database are performed based on the local preprocessing status; Decryption module, client Online anonymous queries are generated based on the incrementally synchronized encrypted database, single server. The client computes the aggregated response of the encrypted data. Recover the target ciphertext and complete authentication and decryption; Secure erase module, client After completing authentication and decryption, refresh the prompt and securely erase the consumed state.

[0010] This invention is applicable to privacy-preserving retrieval of continuously updated encrypted databases.

[0011] Compared with the prior art, the beneficial effects of the present invention are as follows: 1. Deployment advantages: Single-server deployment, no need for non-collusion assumptions. This invention employs a single-server deployment in an anonymous query scenario involving continuously updated encrypted databases. It completes the entire process of database storage, updating, and anonymous querying through encrypted database initialization, single-server dynamic tree construction and client preprocessing, dynamic updates and authentication synchronization, single-server aggregated query response, and client-side post-query status refresh. Throughout this process, only one server is required for the storage, updating, and query response of the encrypted database, eliminating the need for multiple servers to collaboratively execute the query protocol. This avoids reliance on the assumption of non-cooperation between multiple servers and reduces the costs of multi-server deployment, data synchronization, and operation and maintenance.

[0012] 2. Efficiency advantage: Lightweight pseudo-random functions improve online performance.

[0013] This invention uses a lightweight preprocessing structure based on pseudo-random functions to replace the homomorphic encryption processing path of heavy cryptographic tools, which keeps the online query and client recovery process with low latency and is suitable for large-scale database scenarios.

[0014] 3. Security advantages: Verifiable synchronization and forward privacy mechanisms enhance dynamic security.

[0015] This invention verifies the continuity of root values, Merkle path consistency, and version continuity before and after an update through an authentication synchronization mechanism, enabling clients to identify update transcriptions that are inconsistent with or discontinuous with the current trusted state. Furthermore, through a query-based state refresh mechanism and secure erasure, it ensures that the current prompt state at subsequent times cannot directly restore the historical prompt associations that have already been erased, thereby simultaneously improving the state trustworthiness and query privacy protection capabilities in a dynamic database environment.

[0016] In summary, this invention reduces the overhead of online querying and update maintenance in a single-server continuous update environment by using encrypted block partitioning, one-time streaming preprocessing, certified incremental local patching, and post-query state refresh, while providing query privacy, verifiability of state evolution, and forward privacy protection. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of the overall framework of the present invention.

[0018] Figure 2 This is a schematic diagram of the overall process of the method of the present invention.

[0019] Figure 3 This is a schematic diagram of block data processing based on offset vectors in this invention. Detailed Implementation

[0020] The present invention will now be described in detail with reference to the accompanying drawings.

[0021] like Figure 1 As shown, this invention includes data owners. Single server and client Data owner Holds the original plaintext database and is responsible for its legitimate updates; single server. Only store encrypted databases and dynamic data. The tree does not hold the master key; the client Holding the master key and valid state mapping And verified local preprocessed state, used to generate stealth queries, restore target records, verify updates, and refresh local state. Figure 1 The term "untrusted single server" refers to a server that is not trusted in terms of query privacy, and its specific behavior follows the semi-honest server model described below.

[0022] This invention employs a semi-honest server threat model: single server The encrypted storage and dynamic updates shall be executed correctly in accordance with the protocol. The authentication path generation and aggregated query response process can be recorded and analyzed, including visible ciphertext, update information, query vectors, and responses during protocol execution, to attempt to infer the client's query target; single server. The system does not actively deviate from the protocol, forge legitimate updates from data owners, or intentionally tamper with encrypted databases, authentication paths, or query responses. Forward privacy, as referred to in this invention, means that after a client completes a query, it refreshes the current prompt state and securely erases consumed main prompts, backup prompts, and replacement entries, ensuring that subsequent client prompt states cannot directly restore erased historical prompt associations.

[0023] In terms of deployment structure, this invention uses a single server to store the encrypted database and execute database updates and anonymous query responses. The client maintains the verified preprocessed state locally, eliminating the need for multiple servers to collaboratively execute the query protocol. This avoids reliance on the assumption of non-cooperation between multiple servers and reduces the costs of multi-server deployment, data synchronization, and operation and maintenance.

[0024] In this invention, for any positive integer ,remember ; This represents the bitwise XOR operation of a string of equal length. This indicates string concatenation. Indicates uniform random sampling. and These represent rounding down and rounding up, respectively. Each plaintext record is encoded as a fixed length. Bits; The random number, ciphertext body, and authentication tag output by the symmetric encryption are concatenated in a fixed format to ensure that each ciphertext record is of equal length.

[0025] like Figure 2As shown, the specific steps of the verifiable forward privacy single-server incremental anonymous query method of the present invention are as follows: Step 1, Data Owner The original database is padded, segmented, and initialized with ciphertext to obtain the ciphertext database.

[0026] Step 1.1, Data Owner Obtain the original plaintext database ,in, To represent the actual number of records, For the true record index, Index for real records The length is Plaintext records of bits. For lengths less than... The plaintext record of bits is written to the actual length field and padded with zeros at the end; the record of bits longer than the specified length is written to the actual length field. A plaintext record of bits is split into multiple records of fixed length. If, after splitting, there are records of length less than... For plaintext records of bits, zeros are padded at the end.

[0027] Step 1.2, Data Owner Based on the actual number of records Calculate data block size Number of data blocks and the current capacity of the data block : .

[0028] in, This indicates rounding up to the nearest integer.

[0029] By the above definition, it is always true .when At that time, for each fill index Set fill index The length is plaintext record of bits , Indicates length is A string of all zero bits; when If the index set is empty, no filling is performed; if it does not exist... The situation is described. After completion, a plaintext database is obtained. , For index The length is Plaintext records of bits. Original plaintext database. It is a plaintext database Index 0 to The corresponding actual record portion, plaintext database Newly added indexes to Simply fill in the records. Set the current plaintext database. Number of allocated records And establish an effective state mapping. When index Time settings When index Time settings ; After each successful write operation, the number of allocated records will be recorded. Increase by 1 until... The delete operation does not reclaim the index but only removes the corresponding index. Set to 0.

[0030] Data owner Plaintext database By index The continuous interval is divided into A plaintext block of equal length, the first The plaintext blocks are: .

[0031] in, , Indicates rounding down and offset within the block. The global address mapping function is Therefore, each index With the only pair Corresponding, and Chunking is used for plaintext databases. The index is rearranged to represent the data without changing the content or order of the actual records.

[0032] Step 1.3, Data Owner Set security parameters ,Will Input the key generation algorithm, call the cryptographically secure random number generator, from Uniformly randomized sampling of master key : , .

[0033] In the formula, Indicates the key generation algorithm, A unary representation of the safety parameter λ. This indicates uniform random sampling. Data owner. For each index Establish version counting and set Then use fixed fields to separate tags Version count and index Export the encryption subkey: In the formula, Indicates using the master key A hash-based message authentication code function for the key. Indicates a field-separated label. Indicates index version count The encrypted subkey.

[0034] index This serves as the basis for authenticated symmetric encryption of associated data, preventing the ciphertext from being undetectedly swapped to other indexes. Data owner. According to the encryption subkey Calculate index The encrypted record at the location: , .

[0035] In the formula, This indicates symmetric encryption for authentication, recording the ciphertext. The encrypted database is constructed in index order. Data owner Ciphertext database By index The continuous interval is divided into A block of ciphertext of equal length, the first Each ciphertext block is Therefore, encrypted databases It is to complete the plaintext database. The encrypted results, one record at a time, have the same total number of records, index, and block relationship.

[0036] Step 1.4, Data Owner right A ciphertext record Calculate the hash of the ciphertext leaf node and calculate Number of merged levels required for a tree to grow from leaf node level to root node level Total number of leaf nodes .when At that time, the current number of leaf nodes Less than the total number of leaf nodes Data owner Using filled leaf node hash Fill in the missing leaf nodes to bring the total number of leaf nodes to [number]. .

[0037] Data owner After completing The leaf nodes are arranged in ascending order of their indices, and the leaf node level is denoted as the nth. Layer. Data owner Will The first in the tree The first in the layer The node is taken as the left node, and the node is... The first in the layer Each node is treated as the right node, and they are concatenated in the order of left node first, right node last, and the corresponding parent node hash is calculated: .in, And in the Layer node numbering ; Data owner Repeat the splicing operation on all adjacent nodes in the current layer, using the resulting parent node as the next layer node, until the ... The layer retains only one node, and this unique node is determined as the initial root of trust: .

[0038] in, Indicates the total number of leaf nodes; Indicates the first The first in the layer Node hash; Indicates bit string concatenation; This represents a collision-resistant hash function.

[0039] Step 1.5, Data Owner Ciphertext database Send to a single server in ciphertext block order. ; master key Initial Root of Trust Data block size Number of plaintext blocks Current capacity of data blocks , Number of actual records Number of records currently allocated Plain text record length Initial version count and effective state mapping Sent to authorized clients via a confidential and integrity-protected secure channel During initialization Single server Do not accept master key And plain text records.

[0040] Step 2, Single Server Built from a ciphertext database Tree, client verify After the root value of the tree is verified, a local preprocessing state is established in a streaming manner.

[0041] Step 2.1, Single Server right A ciphertext record Calculate the hash of the ciphertext leaf node and calculate Number of merged levels required for a tree to grow from leaf node level to root node level Total number of leaf nodes .when At that time, the current number of leaf nodes Less than the total number of leaf nodes Data owner Using filled leaf node hash Fill in the missing leaf nodes to bring the total number of leaf nodes to [number]. .

[0042] single server After completing The leaf nodes are arranged in ascending order of their indices, and the leaf node level is denoted as the nth. Layer. Single server Will The first in the tree The first in the layer The node is taken as the left node, and the node is... The first in the layer Each node is treated as the right node, and they are concatenated in the order of left node first, right node last, and the corresponding parent node hash is calculated: .in, And in the Layer node numbering ; single server Repeat the splicing operation on all adjacent nodes in the current layer, using the resulting parent node as the next layer node, until the ... The layer retains only one node, and this unique node is designated as the server root: .

[0043] in, Indicates the total number of leaf nodes; Indicates the first The first in the layer Node hash; Indicates bit string concatenation; This represents a collision-resistant hash function.

[0044] single server To the client Send server root Client Compare server root and the initial root of trust ;like If so, initialization is terminated and no local state is established; Then set the initial root of trust to the current root of trust. and for each index Configure the client Save Index Latest version number During initialization Simultaneously read the initial valid state mapping And using a pseudo-random function Generate key Based on key Define offset vector ,in, Indicates the data block size: , .

[0045] Step 2.2, Client This setting enables the client to find the number of main hints that match the offset within the target block during a query. The number of backup prompt entries and replacement entries configured for each data block. . , ,in, , A constant not less than 1. Indicates safety parameters, The function is a super-constant function. To reduce the computational overhead of the online query phase, this invention uses a pseudo-random function to determine the prompt selection position in each data block, and pre-constructs the main prompt and backup prompt accordingly, while pre-generating a replacement pool for each data block. By moving the main computational process forward to the preprocessing stage, subsequent online queries mainly perform pseudo-random function calculations, ciphertext reading, and XOR operations based on the preprocessed state, eliminating the need to perform a large number of homomorphic ciphertext operations during the online query phase, thereby reducing the computational overhead and response latency of online queries.

[0046] like Figure 3 As shown, step 2.3, client Independent sampling Master key and Backup prompt key ,in, Indicates the first The master prompt key used by each master prompt. Indicates the first The first data block corresponding to the The backup prompt key used by the backup prompt, and the local preprocessing state is established in a streaming manner; The local preprocessing state is: The main prompt table... Backup prompt table Initialize to a zero string of the same length as a single ciphertext.

[0047] The main prompt value The generation process is as follows: Client according to The order from a single server Streaming received ciphertext blocks Update the main prompt value and form a replacement pool. Then discard it; there is no need to store the encrypted database locally. A complete copy. The main hint value update is indicated as: .

[0048] in, Indicates the main prompt entry number. Indicates the first The main prompt is in the first The intra-block offset determined by a pseudo-random function within each data block. This represents the bitwise XOR operation of equal-length bit strings.

[0049] In the client Save the master key and main prompt value As the main prompt table ,satisfy: .

[0050] The replacement pool By starting from the address range Uniform random sampling replacement address And cache the ciphertext block at that address. To ciphertext cache Formation. Replacement address and its encrypted cache It is used only once in the query corresponding to the data block.

[0051] The backup prompt table The generation process is as follows: Client Generate a number for each data block. and each backup prompt number Backup prompt key And follow the backup prompts for the key. Calculate the number of divisions. Each data block other than the data blocks Inner offset vector Then, the ciphertext records corresponding to the offset vector are XORed sequentially to obtain the backup prompt: .

[0052] Client Based on the same backup prompt key Select the A ciphertext record is extracted from each data block, and this ciphertext record is saved separately as a completion value: .

[0053] therefore, To cover A complete hint for each data block. (Client) Based on this, a backup prompt table is created: .

[0054] Step 3, Data Owner Single server and client Dynamic updates and certified incremental synchronization of the ciphertext database are performed based on the local preprocessing state. This step verifies the continuity of the server's state before and after the update by verifying the update transcription, and uses the difference between the old and new ciphertext at the update location to patch only the actually affected local hints and replace the cache, thereby avoiding the need to rescan the entire ciphertext database and rebuild the preprocessing state every time the database is updated.

[0055] Data owner Receive update type And read the number of currently allocated records. and current capacity ;in, Indicates writing. Indicates modification. Indicates deletion. When the operation type... To modify Or delete hour, and When the operation type For writing At that time, based on the number of records currently allocated. and current capacity Determine whether capacity expansion needs to be triggered and write the new plaintext. .

[0056] The capacity expansion trigger determination process is as follows: when and At that time, to the plaintext database The index is Plain text records Write new plaintext .because This write does not change the data block size. Number of data blocks and the current capacity of the data block Continue performing location updates and partial repairs.

[0057] when and At this point, the current capacity has been exhausted, and this write operation triggers a capacity expansion. (Data owner) Record the capacity before expansion first. Then calculate the expanded number of allocated records. Size of the expanded data block Number of expanded data blocks and the expanded capacity : .

[0058] Due to the triggering of capacity expansion The index of the new record is Data owner Set index Plain text records For New Script , represented as and make the index place and indexes within each extended range Set up populate records and Next, set the initial version count within the extended space. Calculate the encryption subkey and ciphertext record within the extended space: , ; in, Indicates the index within the extended range In version The encrypted subkey, Indicates the index within the extended range The encrypted record at index 0 to... The original ciphertext remains unchanged, and the original ciphertext and the newly added ciphertext together form the extended ciphertext database. Data owner Expand the ciphertext database Send to a single server in ciphertext block order. .

[0059] Then the data owner right A ciphertext record Calculate the extended ciphertext leaf node hash and calculate The number of expansion and merging layers required for the tree to grow from the leaf node level to the root node level and the total number of expanded leaf nodes ;when At that time, the current number of expanded leaf nodes Less than the total number of expanded leaf nodes Data owner Using filled leaf node hash Fill in the missing leaf nodes to expand the number of leaf nodes to reach the required number. .

[0060] Data owner After completing The leaf nodes are arranged in ascending order of their indices, and the leaf node level is denoted as the nth. Layer; Data Owner Will The first in the tree The first in the layer The node is taken as the left node, and the node is... The first in the layer Each node is treated as the right node, and they are concatenated in the order of left node first, right node last, and the corresponding parent node hash is calculated: ;in, And in the Layer node numbering ; Data owner Repeat the splicing operation on all adjacent nodes in the current layer, using the resulting parent node as the next layer node, until the ... The layer retains only one node and determines this unique node as the initial trusted root for the expansion: ; in, This represents the total number of leaf nodes after completion; Indicates the first The first in the layer Node hash; Indicates bit string concatenation; Represents a collision-resistant hash function; And extend the root of trust via a secure channel. Size of the expanded data block Number of expanded data blocks Expanded capacity The expanded number of allocated records and the effective state mapping corresponding to the extended interval Send to the client .

[0061] single server right A ciphertext record Calculate the hash of the extended leaf node Build extensions for leaf nodes Tree ; single server right A ciphertext record Calculate the extended ciphertext leaf node hash and calculate The number of expansion and merging layers required for the tree to grow from the leaf node level to the root node level and the total number of expanded leaf nodes ; when At that time, the current number of expanded leaf nodes Less than the total number of expanded leaf nodes Single server Using filled leaf node hash Fill in the missing leaf nodes to expand the number of leaf nodes to reach the required number. ; single server After completing The leaf nodes are arranged in ascending order of their indices, and the leaf node level is denoted as the nth. Layer; Single server Will The first in the tree The first in the layer The node is taken as the left node, and the node is... The first in the layer Each node is treated as the right node, and they are concatenated in the order of left node first, right node last, and the corresponding parent node hash is calculated: ;in, And in the Layer node numbering ; single server Repeat the splicing operation on all adjacent nodes in the current layer, using the resulting parent node as the next layer node, until the ... The layer retains only one node, and this single node is designated as the root of the extended server: ; in, This represents the total number of leaf nodes after completion; Indicates the first The first in the layer Node hash; Indicates bit string concatenation; Represents a collision-resistant hash function; single server To the client Send extended server root ; Client Verify extended server root With the extended initial root of trust Are they equal? ​​If If so, the expansion will be rejected and the state before expansion will be retained; if Then first index within the extended range Set the index within the extended range. Latest version number And synchronously expand the effective state mapping of the interval Then change the data block size Number of data blocks Current capacity of data blocks Number of records currently allocated and the current root of trust Set to the expanded data block size respectively Number of expanded data blocks and the expanded capacity and the expanded number of allocated records Extended initial root of trust The client follows the extended... For each ciphertext block, re-execute steps 2.2 and 2.3, sample the new hint key and replacement address, and rebuild the master hint table. Backup prompt table and replacement pool , will the In each data block, the next unused replacement entry number And the next unused backup prompt entry number Reset to 0.

[0062] The specific process of location update and local repair is as follows: When the update does not trigger capacity expansion, the data owner Let the initial version count Add 1. If updating type For writing Or modify Then based on the new plaintext Calculate index Updated encrypted text at the location: , .

[0063] In the formula, Indicates index Updated version count The encrypted subkey, Indicates index The updated encrypted text. If To delete Then, a new ciphertext is updated by uniformly and randomly sampling from the digits 0 and 1, with the same length as the original ciphertext and independent of the original ciphertext. The original ciphertext is overwritten; however, due to the increased version count, subsequent subkeys derived by the client based on the new version cannot decrypt the random string into valid plaintext. (Data owner) Authentication channel to single server Send update type ,index ,index Updated encrypted text and the updated version count .

[0064] single server Read index Old cipher text and the server root before the update and from Tree index The authentication path consists of the hash of the sibling node and its left and right directions. Then the index will be used. encrypted records at the location Rewrite as an index Updated encrypted text , put the first Hash of each ciphertext leaf node Depend on Change to The hash of the ciphertext leaf node is recalculated layer by layer upwards to the root node to obtain the updated root. Single server To the client Send authentication update transcription : .

[0065] A single-leaf update does not change sibling nodes on the authentication path; therefore, the same authentication path... Can be respectively with and Reconstruct the server root before the update With the updated root The authentication path before and after the update is denoted as follows: and .

[0066] Client Verify the following steps before modifying any local state: ; ; ;as well as In the formula, express The tree path verification process returns 1 if the verification is successful. If any condition is false, the client... Output rejection, retain the original current trusted root. Latest version number Effective state mapping Main prompt table Backup prompt table and replacement pool Unchanged. When all conditions are met, the client... Calculate position Ciphertext Differential ,Location Data block number and location Offset within this data block : , , .

[0067] and utilize Repair only the actual included indexes Local entries: when At that time, the main prompt value will be displayed. Updated to ;when Backup prompt value Updated to ;when and When, the value will be completed. Updated to ;when At that time, cache the ciphertext. Updated to No index included. The data remains unchanged.

[0068] Next, set up , ;when Map the effective state at that time Set to 1, and increase the capacity. Add 1, when Map the effective state at that time Set to 0, when Maintaining valid state mapping Unchanged. Any affected entry could be written as before the update. ,in, This indicates the position within the entry. Pre-update encrypted text Other than the XOR values ​​of the ciphertext; the patch operation satisfies Therefore, the patch will Replace with Therefore, each live master hint, backup hint, completion value, and replacement pool cache remains consistent with the current ciphertext state of the server, eliminating the need to rescan the entire ciphertext database.

[0069] Step 4, Client Online anonymous queries are generated based on the incrementally synchronized encrypted database, single server. The client computes the aggregated response of the encrypted data. Recover the target ciphertext and complete authentication and decryption.

[0070] Client Based on known valid target indexes , and Calculate the target block number and offset within the target block Client Check the next unused replacement entry number in the target block. And the next unused backup prompt entry number for the target block. And in the main prompt table Searching for offsets within blocks in sequence satisfy Valid main prompt entry number ;when or Or no satisfaction found Valid main prompt entries or At that time, no query is generated.

[0071] when , Find satisfaction Valid main prompt entries and At that time, the client make Read replacement entries And calculate the replacement offset. Client First let the query vector Then query vector target block coordinates Replace with replacement offset : .

[0072] Client To a single server Send the replaced query vector Meanwhile, metadata is stored locally. Do not send the target index Target block number Or match the main prompt number .

[0073] single server According to the replaced query vector Read one ciphertext record from each ciphertext block and calculate the aggregate response. and aggregate response Return to client .

[0074] Client Read the main prompt value and Replacement Pool Cache Recover the target ciphertext: .

[0075] The reason is and In non-target blocks, identical records are selected and XORed to cancel each other out; in the target block... Contains replacement ciphertext , Contains target ciphertext XOR Only retain .

[0076] Client Read target version number And calculate the target encryption subkey Then perform the decryption operation. Obtain the target plaintext In the formula, Indicates the current synchronization version at the target location. This indicates symmetric decryption after authentication. This indicates the recovered target ciphertext. Indicates the target index In the current synchronized version The encryption subkey.

[0077] Step 5, Client After completing authentication and decryption, refresh the prompt and securely erase the consumed state.

[0078] Client First, read the main prompt table that has been used. The next unused backup prompt entry number will be displayed. Read the unused backup prompt table And the backup prompts in the backup prompt table and completion value Perform an XOR operation, then combine it with the backup key. Replace the previously used main prompt table: .

[0079] Due to backup prompt Including except the first Complete the selected ciphertext outside the block. Including the Selected ciphertext of the block, Since the complete master prompt invariant is satisfied, the new master prompt can be used for subsequent queries.

[0080] Then check the backup prompt table Main prompt and the replacement entries used in this round Perform secure erasure item by item: first, overwrite the stored content with a random string of the same length, then delete references and mark them as invalid; then assign a number to the next unused replacement entry. Add 1, the next unused backup entry number. Increment by 1. The consumed key, hint value, and replacement ciphertext will no longer be used for querying or updating patches.

[0081] A single query does not change a single server On the encrypted database and The root. After the query, the old master hint is replaced with the new key and the new hint value, and the old master hint, used backup hints and replacement entries are erased. This ensures that subsequent update synchronization only patches the currently valid local state and cannot reverse the hint associations used in this round of query from an erased state.

[0082] A single-server incremental anonymized query system with verifiable forward privacy includes: Initialization module, data owner The original database is padded, segmented, and initialized with ciphertext to obtain a ciphertext database, which is used to implement step 1 of the method described in this invention; Verification module, single server Built from a ciphertext database Tree, client verify After the root value of the tree is verified, a local preprocessing state is established in a streaming manner to implement step 2 of the method described in this invention; Update module, data owner Single server and client Dynamic updates and authenticated incremental synchronization of the encrypted database are performed based on the local preprocessing state to implement step 3 of the method described in this invention; Decryption module, client Online anonymous queries are generated based on the incrementally synchronized encrypted database, single server. The client computes the aggregated response of the encrypted data. Recover the target ciphertext and complete authentication and decryption, which is used to implement step 4 of the method described in this invention; Secure erase module, client After completing authentication and decryption, refresh the prompt and securely erase the consumed state to implement step 5 of the method described in this invention.

[0083] Example Setting parameters: Retrieve actual number of records Length of a single record Bits and security parameters This parameter example uses... accomplish and offset pseudo-random function, to To achieve symmetric encryption for authentication, accomplish ; The random number is 96 bits, and the authentication tag is 128 bits. The first 128 bits of the output are used as Subkey. Take ,but .Depend on , , To complete the plaintext database The index ranges of the three plaintext blocks are respectively... and After encrypting each line, three ciphertext blocks with identical indices are obtained. Tree picking , and with 4 The leaf nodes are used to complete the binary tree.

[0084] Client Generate query: Assume a master hint key produce ,but The client needs to query hour, , Therefore, the main prompt meets the matching condition. Let's further assume the current replacement address for the first block... ,but , The client sends .

[0085] single server Returns the XOR value: .

[0086] Client Calculate the target ciphertext: .

[0087] Client Reuse The corresponding subkey and associated data 5 complete the authentication and decryption.

[0088] Position update: If position 5 is subsequently updated by... Updated to Then the client In passing , , Calculate after verification with the new version number Due to the above Select offset 1 in the first block, client make All backup values, complete values, or cache replacements selected at position 5 should also be patched using the same method. After patching, query position 5 again according to step 4; the restored result should be... Instead .

[0089] Continue using the parameters already set, initial number of allocated records , The first write uses index 10 and sets... , The second write uses index 11 and sets... , Both methods employ localized repair. If a certain location has already been processed... Then only the corresponding Setting the position to 0 prevents the index from being reclaimed and does not reduce its size. The third write This triggers capacity expansion and calculates: , , , .

[0090] In the formula, index 12 writes the thirteenth real record, and indices 13 to 15 write zero-padded records with a length of 1024 bits. Data Owner Generate ciphertext with indices 12 to 15 and calculate... Single server Construct an extended dynamic with 16 ciphertext leaf nodes. Tree; Client After verifying the extended root, the hint table and replacement pool are reconstructed using four ciphertext blocks, and the current parameters are updated. , , , The next three writes can use indices 13, 14, and 15 in sequence; the capacity expansion will be triggered again on the next write.

[0091] Through the above steps, the data owner Single server and client It can complete initialization, single-location dynamic updates, authentication synchronization, stealth query, record recovery, and post-query state evolution without the client storing the complete encrypted database. This is relevant for cryptographically secure random number generators. The authentication symmetric encryption, collision-resistant hashing, and pseudo-random function can be implemented using equivalent methods that satisfy the corresponding security properties and whose output length is adapted to the parameters.

Claims

1. A single-server incremental anonymous query method with verifiable forward privacy, characterized in that, Includes the following steps: Step 1, Data Owner The original database is padded, segmented, and initialized with ciphertext to obtain a ciphertext database. Step 2, Single Server Built from ciphertext database Tree, client verify After the root value of the tree is verified, a local preprocessing state is established in a streaming manner. Step 3, Data Owner Single server and client Dynamic updates and certified incremental synchronization of the encrypted database are performed based on the local preprocessing status; Step 4, Client Online anonymous queries are generated based on the incrementally synchronized encrypted database, single server. The client computes the aggregated response of the encrypted data. Recover the target ciphertext and complete authentication and decryption; Step 5, Client After completing authentication and decryption, refresh the prompt and securely erase the consumed state.

2. The method according to claim 1, characterized in that, The specific steps of step 1 include: Step 1.1, Data Owner Obtain the original plaintext database ,in, To represent the actual number of records, For the true record index, Index for real records The length is Plaintext recording of bits; to length less than The plaintext record of bits is written to the actual length field and padded with zeros at the end; the record of bits longer than the specified length is written to the actual length field. A plaintext record of bits is split into multiple records of fixed length. If, after splitting, there are records of length less than... For plaintext records of bits, zeros are padded at the end; Step 1.2, Data Owner Based on the actual number of records Calculate data block size Number of data blocks and the current capacity of the data block : ； in, Indicates rounding up; when At that time, for each fill index Set fill index The length is plaintext record of bits , Indicates length is A string of all zero bits; when At that time, padding is not performed; after padding, the plaintext database is obtained. , For index The length is Bit plaintext record; raw plaintext database It is a plaintext database Index 0 to The corresponding actual record portion, plaintext database Newly added indexes to Simply fill in the records; set the current plaintext database. Number of allocated records And establish an effective state mapping. When index Time settings When index Time settings ; After each successful write operation, the number of allocated records will be recorded. Increase by 1 until... The deletion operation will correspond to Set to 0; Data owner Plaintext database By index The continuous interval is divided into A plaintext block of equal length, the first The plaintext blocks are: ； in, , Indicates rounding down and offset within the block. The global address mapping function is ; ; Step 1.3, Data Owner Set security parameters ,Will Input key generation algorithm, call cryptographically secure random number generator, from Uniformly randomized sampling of master key : ， ； In the formula, Indicates the key generation algorithm, A unary representation of the safety parameter λ. Indicates uniform random sampling; data owner For each index Establish version counting and set Then use fixed fields to separate tags Version count and index Export the encryption subkey: In the formula, Indicates using the master key A hash-based message authentication code function for the key. Indicates a domain-separated label. Indicates index version count The encrypted subkey; Data owner According to the encryption subkey Calculate index The encrypted record at the location: ， ； In the formula, This indicates symmetric encryption for authentication, recording the ciphertext. The encrypted database is constructed in index order. Data owner Ciphertext database By index The continuous interval is divided into A block of ciphertext of equal length, the first Each ciphertext block is ; Step 1.4, Data Owner right A ciphertext record Calculate the hash of the ciphertext leaf node and calculate Number of merged levels required for a tree to grow from leaf node level to root node level Total number of leaf nodes ;when At that time, the current number of leaf nodes Less than the total number of leaf nodes Data owner Using filled leaf node hash Fill in the missing leaf nodes to bring the total number of leaf nodes to [number]. ; Data owner After completing The leaf nodes are arranged in ascending order of their indices, and the leaf node level is denoted as the nth. Layer; Data Owner Will The first in the tree The first in the layer The node is taken as the left node, and the node is... The first in the layer Each node is treated as the right node, and they are concatenated in the order of left node first, right node last, and the corresponding parent node hash is calculated: ;in, And in the Layer node numbering ; Data owner Repeat the splicing operation on all adjacent nodes in the current layer, using the resulting parent node as the next layer node, until the ... The layer retains only one node, and this unique node is determined as the initial root of trust: ; in, Indicates the total number of leaf nodes; Indicates the first The first in the layer Node hash; Indicates bit string concatenation; Represents a collision-resistant hash function; Step 1.5, Data Owner Ciphertext database Send to a single server in ciphertext block order. ; master key Initial Root of Trust Data block size Number of plaintext blocks Current capacity of data blocks , Number of actual records Number of records currently allocated Plain text record length Initial version count and effective state mapping Sent to authorized clients via a confidential and integrity-protected secure channel .

3. The method according to claim 2, characterized in that, The specific steps of step 2 include: Step 2.1, Single Server right A ciphertext record Calculate the hash of the ciphertext leaf node and calculate Number of merged levels required for a tree to grow from leaf node level to root node level Total number of leaf nodes ;when At that time, the current number of leaf nodes Less than the total number of leaf nodes Data owner Using filled leaf node hash Fill in the missing leaf nodes to bring the total number of leaf nodes to [number]. ; single server After completing The leaf nodes are arranged in ascending order of their indices, and the leaf node level is denoted as the nth. Layer; Single server Will The first in the tree The first in the layer The node is taken as the left node, and the node is... The first in the layer Each node is treated as the right node, and they are concatenated in the order of left node first, right node last, and the corresponding parent node hash is calculated: ;in, And in the Layer node numbering ; single server Repeat the splicing operation on all adjacent nodes in the current layer, using the resulting parent node as the next layer node, until the ... The layer retains only one node, and this unique node is designated as the server root: ; in, Indicates the total number of leaf nodes; Indicates the first The first in the layer Node hash; Indicates bit string concatenation; Represents a collision-resistant hash function; single server To the client Send server root Client Compare server root and the initial root of trust ;like If, then the initialization terminates; if Then set the initial root of trust to the current root of trust. and for each index Configure the client Save Index Latest version number During initialization Simultaneously read the initial valid state mapping And using a pseudo-random function Generate key Based on key Define offset vector ,in, Indicates the size of the data block: ， ； Step 2.2, Client This setting enables the client to find the number of main hints that match the offset within the target block during a query. The number of backup prompt entries and replacement entries configured for each data block. ; , ,in, , A constant not less than 1. Indicates safety parameters, It is a superconstant function; Step 2.3, Client Independent sampling Master key and Backup prompt key ,in, Indicates the first The master prompt key used by each master prompt. Indicates the first The corresponding data block The backup prompt key used by the backup prompt is used to stream the local preprocessing state.

4. The method according to claim 3, characterized in that, In step 2.3, the local preprocessing state is: the main prompt table... Backup prompt table Initialize to a zero string of the same length as a single ciphertext; The main prompt value The generation process is as follows: Client according to The order from a single server Streaming received ciphertext blocks Update the main prompt value and form a replacement pool. Then discard it; there is no need to store the encrypted database locally. A complete copy; the main hint value update is indicated as: ； in, Indicates the main prompt item number. Indicates the first The main prompt is in the first The intra-block offset determined by a pseudo-random function within each data block. This represents the bitwise XOR operation of a string of equal length. In the client Save the master key and main prompt value As the main prompt table ,satisfy: ； The replacement pool By starting from the address range Uniform random sampling replacement address And cache the ciphertext block at that address. To ciphertext cache form; The backup prompt table The generation process is as follows: Client Generate a number for each data block. and each backup prompt number Backup prompt key And according to the backup prompt key Calculate the number of divisions. Each data block other than the data blocks Inner offset vector Then, the ciphertext records corresponding to the offset vector are XORed sequentially to obtain the backup prompt: ； Client Based on the same backup prompt key Select the A ciphertext record is extracted from each data block, and this ciphertext record is saved separately as a completion value: ； Client Create a backup prompt table: .

5. The method according to claim 4, characterized in that, The specific steps of step 3 include: Data owner Receive update type And read the number of currently allocated records. and current capacity ;in, Indicates writing. Indicates modification. Indicates deletion; when the operation type To modify Or delete hour, and When the operation type For writing At that time, based on the number of records currently allocated. and current capacity Determine whether capacity expansion needs to be triggered and write the new plaintext. .

6. The method according to claim 5, characterized in that, The capacity expansion trigger determination process is as follows: when and At that time, to the plaintext database The index is Plain text records Write new plaintext Continue performing location updates and partial repairs; when and At this time, the current capacity has been exhausted, and this write operation triggers capacity expansion; data owner Record the capacity before expansion. Then calculate the expanded number of allocated records. Size of the expanded data block Number of expanded data blocks and the expanded capacity : ； The index of the new record is Data owner Set index Plain text records For New Plain Text , represented as and make the index place and indexes within each extended range. Set up fill records and Next, set the initial version count within the extended space. Calculate the encryption subkey and ciphertext record within the extended space: ， ； in, Indicates the index within the extended range In version The encrypted subkey, Indicates the index within the extended range Ciphertext records at location; index 0 to The original ciphertext remains unchanged, and the original ciphertext and the newly added ciphertext together form the extended ciphertext database. Data owner Ciphertext database Send to a single server in ciphertext block order. ; Then the data owner right A ciphertext record Calculate the extended ciphertext leaf node hash and calculate The number of expansion and merging layers required for the tree to grow from the leaf node level to the root node level and the total number of expanded leaf nodes ;when At that time, the current number of expanded leaf nodes Less than the total number of expanded leaf nodes Data owner Using filled leaf node hash Fill in the missing leaf nodes to expand the number of leaf nodes to reach the required number. ; Data owner After completing The leaf nodes are arranged in ascending order of their indices, and the leaf node level is denoted as the nth. Layer; Data Owner Will The first in the tree The first in the layer The node is taken as the left node, and the node is... The first in the layer Each node is treated as the right node, and they are concatenated in the order of left node first, right node last, and the corresponding parent node hash is calculated: ;in, And in the Layer node numbering ; Data owner Repeat the splicing operation on all adjacent nodes in the current layer, using the resulting parent node as the next layer node, until the ... The layer retains only one node and determines this unique node as the initial trusted root for the expansion: ; in, This represents the total number of leaf nodes after completion; Indicates the first The first in the layer Node hash; Indicates bit string concatenation; Represents a collision-resistant hash function; And extend the root of trust via a secure channel. Size of the expanded data block Number of expanded data blocks Expanded capacity The expanded number of allocated records and the effective state mapping corresponding to the extended interval Send to the client ; single server right A ciphertext record Calculate the hash of the extended leaf node Build extensions for leaf nodes Tree ; single server right A ciphertext record Calculate the extended ciphertext leaf node hash and calculate The number of expansion and merging layers required for the tree to grow from the leaf node level to the root node level and the total number of expanded leaf nodes ; when At that time, the current number of expanded leaf nodes Less than the total number of expanded leaf nodes Single server Using filled leaf node hash Fill in the missing leaf nodes to expand the number of leaf nodes to reach the required number. ; single server After completing The leaf nodes are arranged in ascending order of their indices, and the leaf node level is denoted as the nth. Layer; Single server Will The first in the tree The first in the layer The node is taken as the left node, and the node is... The first in the layer Each node is treated as the right node, and they are concatenated in the order of left node first, right node last, and the corresponding parent node hash is calculated: ;in, And in the Layer node numbering ; single server Repeat the splicing operation on all adjacent nodes in the current layer, using the resulting parent node as the next layer node, until the ... The layer retains only one node, and this single node is designated as the root of the extended server: ; in, This represents the total number of leaf nodes after completion; Indicates the first The first in the layer Node hash; Indicates bit string concatenation; Represents a collision-resistant hash function; single server To the client Send extended server root ; Client Verify extended server root With the extended initial root of trust Are they equal? ​​If If so, the expansion will be rejected and the state before expansion will be retained; if Then first index within the extended range Set the index within the extended range. Latest version number And synchronously expand the effective state mapping of the interval Then change the data block size Number of data blocks Current capacity of data blocks Number of records currently allocated and the current root of trust Set to the expanded data block size respectively Number of expanded data blocks and the expanded capacity and the expanded number of allocated records Extended initial root of trust The client follows the extended... For each ciphertext block, re-execute steps 2.2 and 2.3, sample the new hint key and replacement address, and rebuild the master hint table. Backup prompt table and replacement pool , will the In each data block, the next unused replacement entry number And the next unused backup prompt entry number Reset to 0.

7. The method according to claim 6, characterized in that, The specific process of location update and local repair is as follows: When the update does not trigger capacity expansion, the data owner Let the initial version count Increase by 1; if updating type For writing Or modify Then based on the new plaintext Calculate index Updated encrypted text at the location: ， ； In the formula, Indicates index Updated version count The encrypted subkey, Indicates index The updated encrypted text at the location; if To delete Then, a new ciphertext is updated by uniformly and randomly sampling from the digits 0 and 1, with the same length as the original ciphertext and independent of the original ciphertext. and overwrite the original encrypted text; data owner Authentication channel to single server Send update type ,index ,index Updated encrypted text and the updated version count ; single server Read index Old cipher text and the server root before the update and from Tree index The authentication path consists of the hash of the sibling node and its left and right directions. ; then index encrypted records at the location Rewrite as an index Updated encrypted text , put the first Hash of each ciphertext leaf node Depend on Change to The hash of the ciphertext leaf node is recalculated layer by layer upwards to the root node to obtain the updated root. ; single server To the client Send authentication update transcription : ； Same authentication path respectively with and Reconstruct the server root before the update With the updated root The authentication path before and after the update is denoted as follows: and ; Client Verify the following steps before modifying any local state: ; ; ;as well as In the formula, express The tree path verification process returns 1 if the verification is successful; if any condition is not met, the client... Output rejection, retain the original current trusted root. Latest version number Effective state mapping Main prompt table Backup prompt table and replacement pool Unchanged; when all conditions are met, the client... Calculate position Ciphertext Differential ,Location Data block number and location Offset within this data block : ， ， ； and utilize Repair only the actual included indexes Local entries: when At that time, the main prompt value will be displayed. Updated to ;when Backup prompt value Updated to ;when and When, the value will be completed. Updated to ;when At that time, cache the ciphertext. Updated to No index included. The data remains unchanged; Next, set up , ;when Map the effective state at that time Set to 1, and increase the capacity. Add 1, when Map the effective state at that time Set to 0, when Maintaining valid state mapping constant.

8. The method according to claim 7, characterized in that, The specific steps of step 4 include: Client Based on known valid target indexes , and Calculate the target block number and offset within the target block Client Check the next unused replacement entry number in the target block. And the next unused backup prompt entry number for the target block. And in the main prompt table Searching for offsets within blocks in sequence satisfy Valid main prompt entry number ;when or Or no satisfaction found Valid main prompt entries or At this time, no query is generated; when , Find satisfaction Valid main prompt entries and At that time, the client make Read replacement entries And calculate the replacement offset. Client First let the query vector Then query vector target block coordinates Replace with replacement offset : ； Client To a single server Send the replaced query vector Meanwhile, metadata is stored locally. ; single server According to the replaced query vector Read one ciphertext record from each ciphertext block and calculate the aggregate response. and aggregate response Return to client ; Client Read the main prompt value and Replacement Pool Cache Recover the target ciphertext: ； Client Read target version number And calculate the target encryption subkey Then perform the decryption operation. Obtain the target plaintext In the formula, Indicates the current synchronization version at the target location. This indicates symmetric decryption after authentication. This indicates the recovered target ciphertext. Indicates the target index In the current synchronized version The encryption subkey.

9. The method according to claim 8, characterized in that, The specific steps of step 5 include: Client First, read the main prompt table that has been used. The next unused backup prompt entry number will be displayed. Read the unused backup prompt table And the backup prompts in the backup prompt table and completion value Perform an XOR operation, then combine it with the backup key. Replace the previously used main prompt table: ； Then check the backup prompt table Main prompt and the replacement entries used in this round Perform secure erasure item by item: first, overwrite the stored content with a random string of the same length, then delete references and mark them as invalid; then assign a number to the next unused replacement entry. Add 1, the next unused backup entry number. Increment by 1; the consumed key, hint value, and replacement ciphertext will no longer be used for querying or updating patches.

10. A single-server incremental anonymous query system capable of verifying forward privacy, implemented using the method described in any one of claims 1-9, characterized in that, include: Initialization module, data owner The original database is padded, segmented, and initialized with ciphertext to obtain a ciphertext database. Verification module, single server Built from ciphertext database Tree, client verify After the root value of the tree is verified, a local preprocessing state is established in a streaming manner. Update module, data owner Single server and client Dynamic updates and certified incremental synchronization of the encrypted database are performed based on the local preprocessing status; Decryption module, client Online anonymous queries are generated based on the incrementally synchronized encrypted database, single server. The client computes the aggregated response of the encrypted data. Recover the target ciphertext and complete authentication and decryption; Secure erase module, client After completing authentication and decryption, refresh the prompt and securely erase the consumed state.

Images