METHOD FOR CONFIDENTIAL QUERY OF MULTIPLE HOLDERS WHEN A RECORD IS PRESENT IN A DATABASE

Description

Domaine technique

[0001] The present invention relates generally to the field of confidential querying of a database. It uses additive homomorphic encryption and querying by PIR protocol ( Private Information Retrieval). Etat de la technique antérieure

[0002] Confidential database querying allows a client to retrieve data from a database hosted by a remote server, without disclosing the purpose of the query and the result of the query to third parties or to the server itself.

[0003] Confidential query methods generally use homomorphic encryption processing of the queried database. We can distinguish those that use fully homomorphic encryption or FHE ( Full Homomorphic Encryption ) of the database and those that simply use additive homomorphic encryption.

[0004] The former allow a wide variety of query types but do not allow scaling in terms of database size, in other words they are not scalable to large database sizes, at least for latency times (i.e. response to a query) below an acceptable threshold value (typically a few minutes).

[0005] The latter only allows for constrained format queries but allows for easy scaling relative to the size of the database.

[0006] The PIR protocol ( Private Information Retrieval ) is a confidential database query method using additive homomorphic encryption processing using the Paillier cryptosystem.

[0007] For example, a description of a method for confidentially querying a database using the PIR protocol can be found in the article "EncryptedQuery scalable Private Information Retrieval", EnQuery, 29.11.2018.

[0008] This confidential query method, however, corresponds to a single-user use case. Indeed, the data stored in the database are hashed values ​​obtained using a private-key cryptographic hash function, the said private key belonging to the user.

[0009] Thus, if a second user wishes to query the database in question, the private key used in the hash function must be communicated to the second user, without going through the server, so as to preserve confidentiality with respect to the latter.

[0010] More generally, if different users each have a database (of the type considered above) and wish to share their access rights, they must exchange their private keys, which is not a satisfactory solution. Furthermore, we understand in this scenario that there are as many private keys as there are databases, which leads to a multiplication of the number of requests for the same query.

[0011] The aim of the present invention is to propose a method for multi-user querying of a database which does not have the drawbacks of the prior art, in particular which does not require an exchange of confidential information between said users when one user wishes to authorize another to access said database.

[0012] It is known from the state of the art the documents D1 "Practical personalized genomics in the encrypted domain" proposes a solution to the challenges of sharing genomic sequence data and querying genomic sequence data on a cloud server in personalized medicine scenarios. It develops a personalized medicine solution that preserves privacy, is secure and efficient. The proposed solution uses homomorphic transcryption based on stream cipher in a cloud server and shows the effectiveness of the transcryption solution in the personalized medicine scenario." proposes a solution to the challenges of sharing genomic sequence data and querying genomic sequence data on a cloud server in personalized medicine scenarios. It develops a personalized medicine solution that preserves privacy, is secure and efficient.The proposed solution uses homomorphic transcryption based on stream ciphers in a cloud server and demonstrates the effectiveness of the transcryption solution in the personalized medicine scenario. D2 "Practical personalized genomics in the encrypted domain". Présentation de l'invention

[0013] The present invention is defined by a method for confidentially querying the presence of a record in a database hosted by a server, said records being stored in the database in the form of digital fingerprints, each digital fingerprint being obtained by hashing a record using a public hash function and each row of the database containing the digital fingerprints sharing their m > 1 first bits, said confidential interrogation method being original in that: a first user has a symmetric stream cipher key and a second user has an at least additive homomorphic cryptosystem; the rows of the database are encrypted using said stream cipher by adding masks each having the size of a row of the database; the first user authorizes access to the database to the second user by encrypting the inverse masks using the public key of said homomorphic cryptosystem and by transmitting the inverse masks thus encrypted to the server; the rows of the database are transcrypted in the homomorphic domain by adding to said rows the inverse masks thus encrypted; the second user calculates the digital fingerprint of the record using said public hash function and deduces an integer value therefrom, q m , corresponding to the first m bits; the second user constructs a query in the form of a first vector of size 2 m< consisting of a homomorphic cipher of the value “1” in position q m and homomorphic ciphers of the value “0” at the other positions, the request being transmitted to the server; the server evaluates in the homomorphic domain the scalar product between the first vector and a second vector of size 2 m< consisting of the encrypted lines of the database, the result being transmitted as a response to the second user; the second user decrypts said response using the private key of his homomorphic cryptosystem and deduces the clear content of the line q m of the database; the second user searches if the digital fingerprint of the record is among the digital fingerprints of the line q m thus obtained.

[0014] The stream cipher may use an encryption primitive chosen, for example, from AES-CTR, Trivium, and Grain.

[0015] The public cryptographic hash function may be SHA-3.

[0016] According to an advantageous embodiment, the homomorphic cryptosystem is an additive homomorphic encryption without being FHE.

[0017] Additive homomorphic encryption may preferably use a public key Paillier cryptosystem ( g, n ) with n = pq Or p, q are two prime numbers.

[0018] In this case, the server returns as a response a first and a second cipher stored on the line q m , the second user performing a decryption of each of the first and second ciphers using the private key of his homomorphic cryptosystem, then performing a decryption using this same private key of the results thus obtained after having concatenated them.

[0019] Alternatively, additive homomorphic encryption uses a plurality N of “0” ciphers by a Pallier cipher, h i , i = 1,.., N , the additive homomorphic encryption of an integer µ being obtained by: c = g μ ∏ i = 1 N max 1 , u i h i mod n 2 Or u i , i = 1,.., N are random bits selecting said ciphers of “0”.

[0020] Advantageously, the "0" numbers are calculated once and for all and stored by the second user.

[0021] The transcryption of database rows can be performed once and for all by the server when the second user has been authorized to query the database by the first user. Alternatively, the transcryption of database rows is performed dynamically by the server each time the second user queries. Brève description des dessins

[0022] Other characteristics and advantages of the invention will appear on reading a preferred embodiment of the invention, made with reference to the attached figures among which: [ Fig. 1 ] schematically represents the context of application of the present invention; [ Fig. 2 ] schematically represents the structure of the database used in the Fig. 1 ; [ Fig. 3 ] schematically represents a method of querying a database according to an embodiment of the present invention; Description des modes de réalisation

[0023] We first consider a use case representative of the application context of the present invention. In this context, a client (also called a user) can query a database hosted by a remote server. To do this, the client sends a query having as an argument a record likely to be present in the database and receives in return information indicating whether this record is actually present or not. More generally, several clients are likely to query the database and receive in return an indicator of the presence of the records sought. One or more administrators can also add or delete records in the database. The client workstations and the administrator workstations collectively form the client domain.Since the remote server can itself call upon clusters of distributed servers in the Cloud, the servers that host the database collectively form the server domain.

[0024] In the considered use case, the database, although hosted in the server domain, remains the property of the client domain. In other words, the confidentiality of the data present in the database must be guaranteed vis-à-vis the server while allowing clients in the client domain to query it confidentially. The confidentiality constraints to be respected between the client domain and the server domain can be stated as follows: confidentiality of records stored in the database hosted in the server domain vis-à-vis the server; confidentiality of requests from the client domain vis-à-vis the server; confidentiality of responses (indicators of the presence of records) returned to clients, vis-à-vis the server.

[0025] There Fig. 1 schematically represents a use case illustrating the context of application of the present invention.

[0026] In this use case, a first user A with a terminal 110 wishes to allow a second user B, with a terminal 120, to confidentially query a database, 130, hosted by a remote server, 140. We will assume that the different actors (users and server) are curious but semi-honest, that is to say follow the protocol imposed on them.

[0027] The records may comprise a plurality of fields, and are composed for example of alphanumeric data. For example, each record may include the surname, first name, gender, date and place of birth, and address of a person. It is essential to note that this information is not, however, stored as such in the database but only in the form of digital fingerprints. Unlike the prior art, these fingerprints are obtained by a public cryptographic hash function, for example the SHA-3 hash function. A public hash function is understood to mean a hash function that does not use a confidential element such as a secret key.

[0028] User A or an administrator of the client domain will be able to calculate the digital fingerprints of the records to be stored. The digital fingerprints all have the same size. T, for example 256 or 512 bits. We may keep only a part of the bits of the digital fingerprint provided by the hash function, for example 64 bits. For the sake of simplification, we will assimilate these reduced fingerprints to digital fingerprints in the previous sense, the reduction in size of the fingerprint can be taken into account in the hash function.

[0029] The database is "row-oriented" and the digital fingerprints are conveniently grouped by rows. The different rows are of size L , in other words each line can include up to L fingerprints. If necessary, padding bits may be provided to complete an incomplete line. The grouping of fingerprints is carried out so that the fingerprints of the same line have the same first m (or alternatively last m) bits, in other words the fingerprints represent hashed values ​​which collide on their mfirst bits, that is, equivalently; that they belong to the same collision class on these m first bits.

[0030] We preferably choose the value m such that K > 2 m< (or even K >> 2 m< ) And K < 2 m< L Or K is the total number of records in the database. The first condition allows for collision classes that are not reduced to singletons, in other words, to obtain a value of L sufficiently large. The second condition allows all the prints in the database to be classified.

[0031] The database consists of 2 m< lines (some of which may be empty), the contents of each line i = 1,..,2 m< can be represented by an integer ℓ i of ℤ n = ℤ / nℤ with log 2 n ≥ LT. For reasons explained later, it will be advantageous to choose n = pq Or p And q are prime numbers. The rows can be considered as integers taking their values ​​from the set {0,..., n - 1}.

[0032] In an original way, each integer ℓ i is encrypted using a stream cipher ( stream cipher ) using a symmetric key belonging to user A. We recall that a stream cipher is a cipher in which the message to be encrypted is simply added to a sequence of bits generated from a symmetric key, noted here s k A . For this purpose, encryption primitives known to those skilled in the art such as AES-CTR ( Advanced Encryption Standard in Counter Mode ), Grain, Trivium, etc.

[0033] Regardless of the stream cipher algorithm chosen, the words ℓ i lines i = 1,..,2 m< are encrypted (or hidden) by user A by calculating the sums (ℓ i + b i ) mod n, i = 1,..,2 m< where the integers b i are extracted from the bit sequence generated by s k A . It should be noted that the sequence of words b i , also called key stream, does not need to be stored by user A since it can be regenerated at any time from the symmetric key s k A . The integers b i are also called masks because they make the contents of the database confidential to the server.

[0034] There Fig. 2 schematically illustrates the structure of the database used in the Fig. 1 .

[0035] The structure of the database before stream encryption is represented in 210. Each of the lines i = 1,..,2 m< is formed by a word ℓ i of size log 2 nbits and includes at most L digital fingerprints E ij ,j = 1,.., L of size T.

[0036] The structure of the database after stream encryption is represented in 220. It includes the same number of lines, each line i = 1,..,2 m< being of size log 2 n and formed by the hidden word (ℓ i + b i ) mod n.

[0037] The idea behind the present invention is to transcipher the lines thus encrypted by means of an additive homomorphic cryptosystem (at least).

[0038] It is recalled that a homomorphic encryption allows operations (in practice arithmetic operations of addition or multiplication) to be performed on data without ever revealing them. More precisely, an additive homomorphic encryption is an asymmetric key encryption Enc pk_H (public key pk_H ) verifying the following property: Enc pk _ H : Ω → Γ Dec sk _ H Enc pk _ H a ⊕ Enc pk _ H b = a + b Or Ω is the space of clear messages (more simply called the space of clears) and Γ is the space of encrypted messages (more simply called the space of ciphertexts), + an additive operation in the space of cleartexts conferring on Ω a group structure, ⊕ an internal addition operation in the space of ciphers conferring on Γ a group structure. We thus understand that the application of ( Ω , +) in ( Γ ,⊕) is a group homomorphism. Dec sk_H is the decryption function corresponding to Enc pk _ H (Or sk_H is the user's secret key).

[0039] It follows from expression (1) that it is possible to perform an additive operation between two clears ( a , b ) from a corresponding operation between their ciphers ( Enc pk _ H ( a ), Enc pk _ H ( b )) .

[0040] An additive homomorphic cipher has an external multiplication operation of Ω × Γ In Γ , noted ⊗ ext , such as Dec sk _ H a ⊗ ext Enc pk _ H b = ab

[0041] This internal addition operation is nothing other than a consequence of expression (1) insofar as a ⊗ ext means that the internal addition is applied a times.

[0042] In other words, the external multiplication operation allows us to multiply a plaintext by a ciphertext to obtain a ciphertext. Note that this operation performs an absorption in the homomorphic domain.

[0043] Similarly, one can always define an external addition operation of Ω × Γ In Γ , noted ⊗ ext , by means of: a ⊕ ext Enc pk _ H b = Enc pk _ H a ⊕ Enc pk _ H b in which case: Dec sk _ H a ⊕ ext Enc pk _ H b = a + b

[0044] In some cases, the cryptosystem natively has an external addition operation. This is notably and advantageously the case for the Pallier cryptosystem.

[0045] Without loss of generality, we will assume in the following that the additive homomorphic cryptosystem is a Paillier cryptosystem.

[0046] We assume in the following that each user has his own additive homomorphic cryptosystem. We note ( sk A< _H, pk A< _H ) the private key - public key pair of the homomorphic cryptosystem of user A and ( sk B< _H,pk B< _H ) that of B.

[0047] Transcryption is a cryptographic technique allowing the transfer of data encrypted by a first cryptosystem to the same data encrypted by a second cryptosystem (necessarily homomorphic), without going through an intermediate decryption step in the cleartext space.

[0048] In this case, the transcryption operation allows us to move from a stream cipher to a cipher in the homomorphic domain. More precisely, if we note [ x ] B the homomorphic cipher of x using the public key pk B< _H, we obtain: l i + b i ⊕ ext − b i B = l i + b i − b i B = l i B that is, the homomorphic cipher of the line in question.

[0049] In practice, when user A wants to allow user B to query his database, he encrypts the reverse masks, i.e. the words -b i i = 1,..,2 m< (the masks b i being from the key stream), using the public key of B's ​​additive homomorphic cryptosystem and then transmits them to the server which performs the unmasking operation (3) on the rows of the database. This unmasking operation in the homomorphic domain can be performed once and for all in "offline" mode or, on the contrary, on the fly, each time user B asks user A to access the database (held by A). Note that operation (3) protects the confidentiality of the data with respect to the server because the latter has access neither to the first term of the expression (due to masking) nor to the second due to homomorphic encryption.

[0050] According to an alternative embodiment, instead of operation (3), the server can over-encrypt the values ​​( ℓ i + b i ) from the database using the public key pk B< _H to obtain the homomorphic cipher [ℓ i + b i ] B . The homomorphic cipher of the line i can then be obtained by means of the internal addition operation: l i + b i ⊕ ext − b i B = l i + b i − b i B = l i B

[0051] Returning to the Fig. 2 , we have represented in 230 the structure of the base after transciphering. We note that the base is always made up of lines i = 1,..,2 m< but these are here of double size (the ciphers have a size double that of the clear ones) and contain respectively [ℓ i ] B , i = 1,..,2 m< . Each cipher [ℓ i ] B is therefore made up of two words of log 2 ( n), noted β i 1 And β i 2 , stored in line i.

[0052] User B can then send a query to the server regarding the presence of a given record, using a PIR-type protocol. To do this, user B calculates the digital fingerprint of the record sought using the public hash function used to construct the database. We note q the integer value associated with the digital fingerprint and q m the integer value associated with the m first bits of this fingerprint. The query is formed by a vector u of 2 m< encrypted with a cipher of the value "1" in position qm, the rest being made up of ciphers of the value "0". In other words: Dec sk B _ H u i = δ i , q m Or u i is the i th< element of the vector u And δ is Kronecker's symbol.

[0053] For everything i = 1,..,2 m< , the server calculates u i ⊗ ext β i 1 And u i ⊗ ext β i 2 ,without taking into account the fact that the values β i 1 And β i 2 are portions of ciphertexts, then calculates the following sums in the homomorphic space: ⊕ 2 m i = 1 u i ⊗ ext β i 1 = β q m 1 B ⊕ 2 m i = 1 u i ⊗ ext β i 2 = β q m 2 B in application of expressions (1) and (2). Note that these expressions correspond to an evaluation in the homomorphic domain of a scalar product in the domain of clears.

[0054] Homomorphic ciphers β q m 1 B And β q m 2 B form the response that is returned to user B. It will be understood that the server cannot determine in any case the line ( q m ) who responded nor a fortiori the content of the response.

[0055] User B then decrypts β q m 1 B And β q m 2 B using his private key, sk B< _H, then concatenates the obtained values β q m 1 And β q m 2 to form the line cipher: l q m B = β q m 1 β q m 2 which is, in turn, decrypted with the private key sk B< _H to provide the list of fingerprints E qmj , j = 1,.., L initially stored in the line q m< from the base.

[0056] The user can finally check if the digital fingerprint of the searched record is part of the fingerprint list E qmj , j = 1,.., L thus obtained.

[0057] There Fig. 3 schematically represents a method of querying a database according to a first embodiment of the present invention.

[0058] The left part of the figure corresponds to the terminal of user B, and the right part to the server hosting the database. We assume that the database has been previously encrypted using a key stream generated from a symmetric key of A, s k A . More precisely, each line i of the base has been previously encrypted using a word b i from this key stream.

[0059] Terminal B has an additive homomorphic cryptosystem ( sk B< _H,pk B< _H ) in 310 and the server hosting the database received from user A, in 315, the homomorphic ciphers [ -b i ] B obtained by encryption from B's public key, pk B< _H.

[0060] At step 325, the server performs a transcryption of the database rows using (ℓ i + b i ) ⊗ ext [ -b i ] B = [ℓ i ] B , i = 1,.., 2 m< This transcipherment transforms the lines encrypted by a symmetric key cipher s k A in lines encrypted by additive homomorphic encryption using the public key pk B< _H.

[0061] In step 330, user B searching the database for a given record, calculates his digital fingerprint using the public hash function used to create the database, and deduces the entire value q m associated with the first m bits of this fingerprint.

[0062] At step 340, user B constructs a query R ( q m ) in the form of a vector u of 2 m< encrypted with a homomorphic cipher of the value “1” in position q m , the other elements of this vector being homomorphic ciphers of the value “0”: u = 0 B , … , 0 B , 1 B , 0 B , … , 0 B

[0063] The request R ( q m ) is then transmitted to the server.

[0064] At step 345, the server evaluates in the homomorphic domain the scalar product between the vector u and the vector d size 2 m< consisting of the numbered lines [ℓ i ] B , i = 1,..,2 m< : d = l 1 B , … , l 2 m B and returns the result S ( q m ) to user B. In the case where the additive homomorphic cryptosystem is a Paillier cryptosystem, the result may be composed of two homomorphic ciphers stored on line q m , β q m 1 B And β q m 2 B , as explained above.

[0065] In step 350, user B decrypts the received response using his private key. sk B< _H to get the contents of the line q m in plain language, either ℓ qm . It is recalled that, in the case of a Paillier cryptosystem, this step includes three decryption steps: decryption of the ciphertexts β q m 1 B And β q m 2 B , then decryption of the concatenated results l q m B = β q m 1 β q m 2 . In the case of a fully homomorphic or FHE cryptosystem ( Fully Homomorphic Encryption ), only one decryption operation is necessary for user B, the first operation being able to be carried out in the homomorphic domain by the server using a technique called bootstrapping.

[0066] Finally, in step 360, user B determines whether the searched digital fingerprint is among the fingerprints E qmj , j = 1,.., L of the line ℓ qm .

[0067] Although the present invention has been described in the case of an additive homomorphic cryptosystem, those skilled in the art will understand that it applies a fortiori in the case of an FHE cryptosystem. We recall that an FHE cipher is a group homomorphism with respect to both an internal addition law and an internal multiplication law. Homomorphic ciphering (additive or FHE) can be based on an LWE scheme ( Learning With Errors ), in a manner known per se.

[0068] Generally speaking, an additive homomorphic cryptosystem will be preferred, as it leads to simpler calculations than in the case of an FHE cryptosystem.

[0069] According to a first example of realization already mentioned, the additive homomorphic cryptosystem could be a Paillier cryptosystem.

[0070] We recall that the public key of a Paillier cryptosystem is defined by a pair of integers ( g, n ) and that the cipher of a message μ ∈ ℤ n µ is given by: c = g μ r n mod n 2 où r ∈ ℤ n est un aléa

[0071] It should be noted that the calculation of the scalar product in step 345 only uses ciphers of “1” and “0” and that consequently the cost of the encryption is essentially dominated by the calculation of the term r n< mod n 2< , and is therefore generally high due to large values ​​of the exponent n . We remind you that n = pq Or p,q are two large prime numbers.

[0072] Advantageously, we can alternatively opt for a simpler encryption, by precalculating ciphers of "0" with N different random values, namely: h 1 = r 1 mod n 2 ⋮ h N = r N mod n 2 the cipher of a message μ ∈ ℤ n given by: c = g μ ∏ i = 1 N max 1 u i h i mod n 2 Or u i , i = 1,.., N are random bits intended to select ciphers of "0". It will be understood that the expression max (1, u i h i ) leaves the product invariant when the cipher of “0”, h i , is not selected. Operation (13) is therefore the equivalent in the homomorphic domain to addition to the message µ of a random number v = ∑ i = 1 N u i of "0". The values h i , i = 1,..., N can be calculated once and stored by the second user. These values h i can even be public. In any case, additive homomorphic encryption simply consists of selecting bits u i and to perform the calculation of expression (13), the latter not requiring modular exponentiation. Of course, the bits u i can be single-use and therefore do not need to be stored by the second user.

Claims

1. A method for confidentially querying the presence of a record in a database hosted by a server, said records being stored in the database in the form of digital fingerprints, each digital fingerprint being obtained by hashing a record using a public hash function and each row of the database containing the digital fingerprints sharing their first m > 1 bits, characterised in that: - a first user has a symmetric stream cipher key and a second user has an at least additive homomorphic cryptosystem (310); - the rows of the database are encrypted using said stream cipher by adding masks each having the size of a row of the database; - the first user authorises access to the database to the second user by encrypting the inverse masks using the public key of said homomorphic cryptosystem and by transmitting the inverse masks thus encrypted to the server (315); - the rows of the database are transcrypted (325) in the homomorphic domain by adding to said rows the inverse masks thus encrypted; - the second user calculates the digital fingerprint of the record using said public hash function and deduces therefrom an integer value, qm, corresponding to the first m bits (330); - the second user constructs a query in the form of a first vector of size 2m consisting of a homomorphic cipher of the value "1" in position qm and homomorphic ciphers of the value "0" in the other positions, the query being transmitted to the server (340); - the server evaluates in the homomorphic domain the scalar product between the first vector and a second vector of size 2m consisting of the encrypted rows of the database, the result being transmitted as a response to the second user (345); - the second user decrypts said response using the private key of his homomorphic cryptosystem and deduces therefrom the clear content of the row qm of the database (350); - the second user searches whether the digital fingerprint of the record is among the digital fingerprints of the row qm thus obtained (360).

2. The method for confidentially querying the presence of a record in a database according to claim 1, characterised in that the stream cipher uses an encryption primitive selected from AES-CTR, Trivium and Grain.

3. The method for confidentially querying the presence of a record in a database according to claim 1 or 2, characterised in that the public cryptographic hash function is SHA-3.

4. The method for confidentially querying the presence of a record in a database according to one of the preceding claims, characterised in that the homomorphic cryptosystem is an additive homomorphic encryption without being FHE.

5. The method for confidentially querying the presence of a record in a database according to claim 4, characterised in that the additive homomorphic encryption uses a public key Paillier cryptosystem (g, n) with n = pq where p, q are two prime numbers.

6. The method for confidentially querying the presence of a record in a database according to claim 5, characterised in that the server returns as a response a first and a second ciphers stored in row qm, the second user performing a decryption of each of the first and second ciphers using the private key of his homomorphic cryptosystem, then performs a decryption using this same private key of the results thus obtained after having concatenated them.

7. The method for confidentially querying the presence of a record in a database according to claim 5, characterised in that the additive homomorphic encryption uses a plurality N of ciphers of "0" by a Pallier encryption, hi, i = 1,..,N, the additive homomorphic encryption of an integer µ being obtained by: c = g μ ∏ i = 1 N max 1 u i h i mod n 2 where ui, i = 1,..,N are random bits selecting said ciphers of "0".

8. The method for confidentially querying the presence of a record in a database according to claim 7, characterised in that the ciphers of "0" are calculated once and for all and stored by the second user.

9. The method for confidentially querying the presence of a record in a database according to one of the preceding claims, characterised in that the transcryption of the rows of the database is carried out once and for all by the server when the second user has been authorised to query the database by the first user.

10. The method for confidentially querying the presence of a record in a database according to one of claims 1 to 8, characterised in that the transcryption of the rows of the database is carried out dynamically by the server at each query of the second user.