WO2024066013A1 - Privacy information retrieval implementation - Google Patents

Abstract

Provided in one or more embodiments of the present description are a method, system, server and client for implementing privacy information retrieval. The method for implementing privacy information retrieval comprises: a server encrypting a database to obtain a query base, and sending the query base to a client; and the client and the server executing encryption/decryption on the same target by using an encryption/decryption algorithm capable of exchanging an order. In one retrieval process, the method comprises: the client sending to the server a sensitive field encrypted by the client itself, and obtaining, by means of interaction with the server, the same sensitive field encrypted by the server; the client performing retrieval in the query base according to the sensitive field encrypted by the server, so as to obtain an identifier matching a record, and returning the identifier to the server; and the server returning to the client a record corresponding to the identifier in the database/the value of a field of interest in the corresponding record.

Description

Implementing private information retrieval Technical Field

The embodiments of this specification belong to the field of privacy computing technology, and in particular, relate to a method, system, server, and client for implementing privacy information retrieval.

Background technique

Privacy-Preserving Computing is a collection of technologies that implement data analysis and computing on the premise of protecting the data itself from external disclosure, making the data available but invisible. Through privacy-preserving computing technology, the value of data can be transformed and released while fully protecting data and privacy security.

At present, the mainstream technologies for realizing privacy-preserving computing mainly include three directions: the first category is the privacy computing technology based on cryptography represented by Secure Multi-Party Computation (SMPC); the second category is the technology derived from the integration of artificial intelligence and privacy protection technology represented by Federated Learning (FL); the third category is the confidential computing (CC) technology based on trusted hardware represented by Trusted Execution Environment (Trust Execution Environment). In addition, it also includes Differential Privacy (DP) and so on. Differential Privacy (DP) actually protects the calculation results, not the calculation process; Federated Learning, Secure Multi-Party Computation and Confidential Computing protect the calculation process and the intermediate results of the calculation process.

The first type of multi-party secure computing includes four basic technologies, namely, Garbled Circuit (GC), Secret Sharing, Oblivious Transfer and Homomorphic Encryption (HE). Among them, homomorphic encryption is a special encryption algorithm that directly performs calculations based on ciphertext, and the calculation results are the same as those based on decrypted plaintext. It includes semi-homomorphic encryption (Partially Homomorphic Encryption, PHE) and fully homomorphic encryption (Fully Homomorphic Encryption, FHE).

Secure multi-party computing provides privacy protection for input secret data with its solid security theoretical foundation, thus achieving the security of the privacy-preserving computing process. At present, there are two main implementation technology routes for secure multi-party computing, including general secure multi-party computing and specific problem secure multi-party computing. The former can solve various computing problems, but this "universal" technology route usually has a large system and high overhead; the latter designs special protocols for specific problems, such as Private Set Intersection PSI (PSI), Privacy Information Retrieval (PIR), etc., which can often obtain computing results at a lower cost than general secure multi-party computing protocols, but requires domain experts to carefully design for application scenarios, and is generally not applicable to general scenarios and has a high design cost.

Private set intersection is a method for two parties to obtain the intersection of their data without revealing any additional information. Additional information refers to any information other than the intersection of the data of both parties. Private set intersection is very useful in real-world scenarios, such as data alignment in vertical federated learning, or friend discovery through address books in social software.

Privacy information retrieval is a method by which a client retrieves information from a database. During the retrieval process, the querying party hides the query target identifier, and the data service provider provides matching query results but cannot know the specific query object.

Summary of the invention

The purpose of this specification is to provide a method, system, server and client for implementing private information retrieval, including: a method for implementing private information retrieval, the server encrypts the database to obtain a query base, and sends the query base to the client; the encryption/decryption performed by the client and the server on the same target uses an encryption/decryption algorithm with interchangeable order. In a retrieval process, it includes: the client sends the sensitive field encrypted by itself to the server, and obtains the same sensitive field encrypted by the server through interaction with the server; the client searches the query base according to the sensitive field encrypted by the server, obtains the identifier of the matching record, and returns the identifier to the server; the server returns the record corresponding to the identifier in the database/the value of the field of interest in the corresponding record to the client.

A system for implementing private information retrieval includes a server and a client. The encryption/decryption performed by the client and the server on the same target adopts an encryption/decryption algorithm with interchangeable order, and the server is configured with a database, and obtains a query base after encrypting the database, and sends the query base to the client. In a retrieval process: the client sends a sensitive field encrypted by itself to the server, and obtains the same sensitive field encrypted by the server through interaction with the server; retrieves the sensitive field encrypted by the server in the query base, obtains the identifier of the matching record, and returns the identifier to the server; the server receives the sensitive field encrypted by itself sent by the client, encrypts it again, and returns it to the client; also receives the retrieval identifier sent by the client; and returns the value of the record corresponding to the identifier in the database/the field of interest in the corresponding record to the client.

A server for implementing private information retrieval, wherein the encryption/decryption performed by the server and the client on the same target adopts an encryption/decryption algorithm with interchangeable order, and the server is configured with a database, and obtains a query base after encrypting the database, and sends the query base to the client. During a retrieval process: the server receives the sensitive field encrypted by itself sent by the client, encrypts it again and returns it to the client; it also receives the retrieval identifier sent by the client; and returns the record corresponding to the identifier in the database/the value of the field of interest in the corresponding record to the client.

A client for implementing private information retrieval, the encryption/decryption performed by the client and the server on the same target adopts an encryption/decryption algorithm with interchangeable order, and the client is configured with a query base, which is obtained by the server after encrypting the database. In a retrieval process: the client sends a sensitive field encrypted by itself to the server, and obtains the same sensitive field encrypted by the server through interaction with the server; the query base is searched according to the sensitive field encrypted by the server, the identification of the matching record is obtained, and the identification is returned to the server.

In the above embodiment, by pre-configuring the query base to the client, the client can interact with the server and the query base to locate the identifier of the field to be queried in the query base without exposing the plain text of the database, and further initiate a query to the server based on the identifier, thereby ensuring the privacy protection of the database by the server and supporting structured query statements.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the technical solutions of the embodiments of this specification, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

FIG. 1 is a schematic diagram of a flow chart of an embodiment.

Detailed ways

In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

As mentioned above, PIR is a method for clients to retrieve information from a database. The PIR scheme was proposed by Chor B et al. in 1995 to protect the privacy of user queries. The main purpose of the PIR scheme is to ensure that the query request submitted by the query user to the database on the server is completed without leaking the user's private information, that is, during the retrieval process, the server does not know the user's specific query information and the retrieved data items.

The application scenarios of privacy information retrieval include: patients want to query the treatment drugs for their diseases through the medical system. If the disease name is used as the query condition, the medical system will know that the patient may have such a disease, and the patient's privacy will be leaked. Such leakage problems can be avoided through privacy information query.

During the domain name and trademark application process, users need to submit their applied domain name or trademark information to the relevant database to check whether it already exists, but they do not want the service provider to know their applied name so that they can register it first.

In the securities market, a user wants to query the information of a certain stock, but cannot disclose the stock he is interested in to the service provider so as to affect the stock price and his own preferences.

A simple implementation is that the database sends all data to the client, but it cannot protect the database security, that is, it cannot guarantee the privacy of the server. PIR that can guarantee the privacy security of both the client and the database is called symmetric PIR (SPIR), and PIR that guarantees the privacy security of either the client or the database is called asymmetrical PIR (APIR). According to the number of database copies, it is divided into multi-copy PIR and single-copy PIR. The multi-copy PIR protocol requires that multiple database copies cannot collude, which is difficult to meet in real scenarios, so single-copy PIR is more considered. Single-copy PIR can only achieve computational security (CPIR). In most PIR schemes, it is always assumed that the client knows which bit of the database it wants to retrieve (single bit). However, in real scenarios, the client often searches based on keywords (without knowing the specific location of the keyword in the database), and hopes to retrieve a string (multiple bits). In short, a practical PIR usually needs to meet multiple conditions such as symmetry, single copy, keyword search, and string return at the same time, and achieve a balance between computational efficiency and communication efficiency. The above conditions can be met or partially met through cryptographic techniques such as homomorphic encryption, oblivious transfer (OT), and one-way trapdoor function.

This specification provides an embodiment of a method for implementing private information retrieval.

In this embodiment, the server may encrypt the database in advance to obtain a query base, and send the query base to the client.

Generally, the server has a local database that can be queried by the client. For example, the local database of the server is as follows:

ID	Name	Job_number	Age	Native_place
id_0	A	263158	twenty four	anhui
id_1	B	223700	25	shanghai
id_2	C	193267	30	anhui
id_3	D	183456	46	henan
id_4	E	193345	34	shandong
id_5	F	271156	54	shanghai
id_6	G	223455	twenty four	beijing

id_7	H	274500	25	zhejiang
id_8	I	805591	42	guangdong
id_9	J	708947	56	zhejiang

Table 1. Databases available on the server

In the example of Table 1 above, there are five fields including ID, Name, Job_number, Age, and Native_place. For example, there are 10 records, id_0, ..., id_9, and each row is a record. Among them, id_0, ..., id_9 are the identifiers of each row of records.

In order to allow the client to search without exposing the privacy and security of the server, the server can encrypt the database to obtain the query base. The encryption method can use RSA (a widely used asymmetric encryption algorithm proposed by Ronald Rivest, Adi Shamir and Leonard Adleman in 1977) or ECC (Elliptical Curve Cryptography) encryption. Specifically, the server can use RSA private key/ECC private key α to encrypt the data, that is, use RSA private key/ECC private key α to encrypt each field except the ID column (that is, the data in each cell).

When the ECC encryption and decryption algorithm is used, specifically, the server can generate a secret value α and properly store it. The secret value α is also the ECC private key. In addition, the server can convert the value of the name field into a point on the elliptic curve through a hash function, which can be expressed as Hash(C) or H(C).

According to the operational properties of scalar multiplication on elliptic curves, it is easy to calculate Q=kP for a point P and an integer k on the elliptic curve, and the result Q is also a point on the elliptic curve; conversely, if a point pair P and Q on the elliptic curve is known, it is difficult to find the value of k that makes the equation valid in Q=kP.

Here, α·H(C) is easy to calculate based on the scalar multiplication operation on the elliptic curve, but it is difficult to deduce the value of α by knowing the result of α·H(C) and H(C). When it is difficult to get the value of α, it is also difficult to know the value of H(C) by knowing the result of α·H(C).

Furthermore, the database encrypted by the server using the secret value α is as follows:

ID	Name	Job_number	Age	Native_place
id_0	α·H(A)	α·H(263158)	α·H(24)	α·H(anhui)
id_1	α·H(B)	α·H(223700)	α·H(25)	α·H(shanghai)
id_2	α·H(C)	α·H(193267)	α·H(30)	α·H(anhui)
id_3	α·H(D)	α·H(183456)	α·H(46)	α·H(henan)
id_4	α·H(E)	α·H(193345)	α·H(34)	α·H(shandong)
id_5	α·H(F)	α·H(271156)	α·H(54)	α·H(shanghai)

id_6	α·H(G)	α·H(223455)	α·H(24)	α·H(beijing)
id_7	α·H(H)	α·H(274500)	α·H(25)	α·H(zhejiang)
id_8	α·H(I)	α·H(805591)	α·H(42)	α·H(guangdong)
id_9	α·H(J)	α·H(708947)	α·H(56)	α·H(zhejiang)

Table 2. Query base encrypted by ECC private key on the server

It should be noted that the above hash function can not only convert the original input into an output of fixed length and format, but also convert the output into the x-axis coordinate of a point on the elliptic curve. For example, using an elliptic curve such as curve25519, any 256-bit data can be used as a legal x-axis coordinate on this elliptic curve. Correspondingly, sha256 or sha3-256 can be used, or 256 bits can be intercepted from the results of sha384, sha512, or sha3-384, sha3-512. More broadly speaking, any hash value (not limited to hash results of 256 bits) can be modulo the order of the elliptic curve, and the product of the modulo result and the generator point multiplication (scalar multiplication) is a point on the elliptic curve.

Then, the server can send the query base to the client that needs to perform the search. In one way, the server can directly send the query base to the client, such as directly to the client's device, or to the client's proxy server; in another way, the server can publish the query base on a Uniform Resource Locator (URL), and then the client can obtain the query base from the URL.

Correspondingly, the client can receive the query base and save the received query base locally.

Similarly, when using RSA, the server can generate a secret value α and store it properly. This secret value is the RSA private key. In addition, the server can convert the value of the name field into a point on the elliptic curve through a hash function, which can be expressed as Hash(C) or H(C).

According to the properties of modular exponentiation, if the secret value α is known, it is easy to calculate p = g ^α mod q for a large prime number q and base g; conversely, if p, q and base g are known, it is difficult to solve the value of α that makes the equation true in p = g ^α mod q. The base g is also called the primitive root.

Here, it is easy to calculate (H(C)) ^α mod q by simulation operation, but it is difficult to infer the value of α when the result of (H(C)) ^α mod q and H(C) and q are known. When it is difficult to obtain the value of α, it is also difficult to obtain the value of H(C) when the result of (H(C)) ^α mod q is known. Subsequently, expressions such as (H(C)) ^α mod q are abbreviated to (H(C)) ^α by omitting mod q.

Furthermore, the database encrypted by the server using the secret value α is as follows:

ID	Name	Job_number	Age	Native_place
id_0	(H(A)) α	(H(263158)) α	(H(24)) α	(H(anhui)) α

id_1	(H(B)) α	(H(223700)) α	(H(25)) α	(H(shanghai)) α
id_2	(H(C)) α	(H(193267)) α	(H(30)) α	(H(anhui)) α
id_3	(H(D)) α	(H(183456)) α	(H(46)) α	(H(henan)) α
id_4	(H(E)) α	(H(193345)) α	(H(34)) α	(H(shandong)) α
id_5	(H(F)) α	(H(271156)) α	(H(54)) α	(H(shanghai)) α
id_6	(H(G)) α	(H(223455)) α	(H(24)) α	(H(beijing)) α
id_7	(H(H)) α	(H(274500)) α	(H(25)) α	(H(zhejiang)) α
id_8	(H(I)) α	(H(805591)) α	(H(42)) α	(H(guangdong)) α
id_9	(H(J)) α	(H(708947)) α	(H(56)) α	(H(zhejiang)) α

Table 3. Query base encrypted by RSA private key on the server

Then, the server can send the query base to the client that needs to perform the search. Similarly, the server can directly send the query base to the client, such as directly to the client's device, or to the client's proxy server; in another way, the server can publish the query base on a Uniform Resource Locator (URL), and then the client can obtain the query base from the URL.

Correspondingly, the client can receive the query base and save the received query base locally.

S110: The client sends the sensitive field encrypted by itself to the server, and obtains the same sensitive field encrypted by the server through interaction with the server.

For example, the client's search condition is that the value of the Age field is 24, but 24 is a sensitive field, that is, the client does not want to let the other party know. In order to prevent the server from knowing that the client's search condition is the value of the Age field 24, the client can encrypt the 24. For example, RSA/ECC private key encryption is used, and the encryption algorithm used by the client is the same as the encryption algorithm used by the server to generate the query base.

Specifically, when RSA private key encryption is used, the client generates a secret β by itself and keeps it properly. Then, the client can encrypt 24 with its own private key β. Specifically, 24 or the hash value of 24 can be encrypted. Here, the hash encryption of 24 is taken as an example. The direct encryption of 24 is similar, and the client and the server use the same hash algorithm. For example, the client uses the same large prime number q as the server as the modulus. The client can perform RSA encryption on the hash value of 24 using β to obtain (H(24)) ^β . Then the sensitive field sent by the client to the server can be (H(24)) ^β , where (H(24)) ^β represents the ciphertext of the value 24 of the sensitive field.

On the other hand, the client can also construct a search statement, encrypt the sensitive fields in the search statement to obtain the private fields, replace the sensitive fields with the private fields, and send the replaced private search statement to the server.

For example, the query statement constructed by the client is select Name where Age=24.

In order to protect privacy, the server is not allowed to obtain the condition Age=24. For example, the privacy of 24 is protected. The result is as follows:

select Name where Age=?

Among them, ? represents the search statement after replacement.

Specifically, the client can encrypt 24 with an RSA private key. For example, the client can use the same hash function as the server to perform hash calculation on 24, and then use β to perform RSA encryption on the hash value of 24 to obtain (H(24)) ^β . Then the query statement sent by the client to the server is, for example, as follows:

select Name where Age＝(H(24)) ^β

As mentioned above, (H(24)) ^β is the ciphertext, which is the content represented by “?” in the above search statement. After obtaining it, the server cannot know β and 24.

When using ECC private key encryption, the client uses the same elliptic curve as the server, that is, it has the same elliptic curve parameters and generators. The client generates the secret β itself and keeps it properly. Then, the client can use its own private key β to encrypt 24. Specifically, the hash value of 24 can be encrypted, and the client and the server use the same hash algorithm. For example, the client can use β to perform ECC encryption on the hash value of 24 to obtain β·H(24). Then the sensitive field sent by the client to the server can be β·H(24), where β·H(24) represents the ciphertext of the value 24 of the sensitive field.

On the other hand, the client can also construct a search statement, encrypt the sensitive fields in the search statement to obtain the privacy fields, replace the sensitive fields with the privacy fields, and send the replaced privacy search statement to the server.

For example, the query statement constructed by the client is select Name where Age=24.

In order to protect privacy, the server is not allowed to obtain the condition Age=24. For example, the privacy of 24 is protected. The result is as follows:

select Name where Age=?

Among them, ? represents the search statement after replacement.

Specifically, the client can encrypt 24 with an ECC private key. For example, the client uses the same elliptic curve as the server, that is, it has the same elliptic curve parameters and generators. The client can replace the sensitive fields in the search statement with its own ECC private key and send the replaced privacy search statement to the server. For example, the client generates a secret β and saves it properly. In addition, the client can use the same hash function as the server to perform hash calculation on 24, and then use β to perform ECC encryption on the hash value of 24 to obtain β·H(24). Then the query statement sent by the client to the server is, for example, as follows:

select Name where Age＝β·H(24)

As mentioned above, β·H(24) is the ciphertext, which is the content represented by “?” in the above search statement. After obtaining it, the server cannot know β and 24.

The client obtains the same sensitive field encrypted by the server through interaction with the server, which may include the server using its own key to re-encrypt the sensitive field encrypted by the client and then sending it to the client, and the client using its own key to decrypt the sensitive field encrypted twice to obtain the sensitive field encrypted by the server. The core of this content is to find an encryption algorithm that can exchange the order of decryption for two consecutive encryption operations (two parties encrypt successively). According to the cryptographic properties of ECC, the two parties agree to use the same elliptic curve, that is, have the same elliptic curve parameters and generators, each holding keys α and β, and the encryption operation is to perform scalar multiplication with α (or β). Regardless of whether it is encrypted with α first and then β or encrypted with β first and then α, it can be decrypted in the same or different order, that is, the encryption results can be decrypted in different orders. Similarly, according to the cryptographic properties of RSA encryption, both parties agree to use the same large prime number q and primitive root g, each holding private keys α and β. The encryption operation is to use α (or β) to exponentiate and modulo q. No matter whether α is used for encryption first and β is used for encryption or β is used for encryption first and α is used for encryption, the encryption results can be decrypted in the same or different order. In general, the encryption/decryption performed by the client and the server on the same target uses an encryption/decryption algorithm with interchangeable order.

Specifically, after receiving the privacy search statement, the server may encrypt the privacy field again and return it to the client, or after receiving the sensitive field sent by the client and encrypted by the client itself, the server may encrypt the encrypted sensitive field again with the server's own key and return it to the client. Then, the client uses its own key to decrypt the twice encrypted sensitive field to obtain the sensitive field encrypted by the server.

For example, case 1: the server can receive (H(24)) ^β sent by the client.

The server can re-encrypt the encrypted sensitive field (ie, the private field) and return the re-encrypted sensitive field to the client. Specifically, the server can re-encrypt the private field (H(24)) ^β using its own RSA private key α to obtain ((H(24)) ^β ) ^α .

For example, in case 1': the server may receive the privacy search statement select Name where Age＝(H(24)) ^β sent by the client. In this way, the server may obtain the privacy field (H(24)) ^β in the privacy search statement.

The server can encrypt the private field again and return the re-encrypted private field to the client.

Specifically, the server can re-encrypt the privacy field (H(24)) ^β using its own RSA private key α to obtain ((H(24)) ^β ) ^α . The specific process is similar to the above and will not be repeated here.

For example, case 2: the server can receive β·H(24) sent by the client.

The server can re-encrypt the private field and return the re-encrypted private field to the client. Specifically, the server can re-encrypt the private field β·H(24) using its own ECC private key α to obtain α·β·H(24).

For example, in case 2': the server can receive the privacy search statement select Name where Age＝β·H(24) sent by the client. In this way, the server can obtain the privacy field β·H(24) in the privacy search statement.

The server can encrypt the private field again and return the re-encrypted private field to the client.

Specifically, the server can re-encrypt the privacy field β·H(24) using its own ECC private key α to obtain α·β·H(24). The specific process is similar to the above and will not be repeated here.

After the server uses its own key to re-encrypt the sensitive field (i.e., the privacy field) encrypted by the client and sends it to the client, the client can use its own key to decrypt the twice-encrypted privacy field to obtain the sensitive field encrypted by the server.

For example, corresponding to the above cases 1 and 1', the client receives ((H(24)) ^β ) ^α sent by the server, where the power operation has the following property: ((H(24)) ^β ) ^α ＝(H(24)) ^βα ＝(H(24)) ^αβ ＝((H(24)) ^α ) ^β . Furthermore, the client can use the inverse element of its own key β

Decrypt the twice encrypted sensitive fields as follows:

In this way, the client obtains the same sensitive field encrypted by the server, namely (H(24)) ^α .

Corresponding to the above cases 2 and 2', the client receives α·β·H(24) sent by the server, where the scalar multiplication operation has the following property: α·β·H(24)＝β·α·H(24). Furthermore, the client can use the inverse element β ^-1 of its own key β to decrypt the twice encrypted sensitive field, as follows: β ^-1 ·α·β·H(24)＝β ^-1 ·β·α·H(24)＝α·H(24). In this way, the client also obtains the same sensitive field encrypted by the server, namely α·H(24).

It should be noted that in RSA, according to Euler's theorem, pk·sk＝1mod(p-1)·(q-1), where p and q are two large prime numbers, so pk and sk are inverses of each other. Similarly, in ECC, pk＝sk*G, G is a generator on the ECC selected curve, so pk and sk are also inverses of each other.

S120: The client searches the query base according to the sensitive field encrypted by the server, obtains the identifier of the matching record, and returns the identifier to the server.

After S110 is executed, the client can obtain the same sensitive field encrypted by the server.

The client can query in the query base based on the sensitive field encrypted by the server. For example, after decryption, the client obtains the privacy field α·H(24) or (H(24)) ^α encrypted by the server, so that the client queries in the query base based on the privacy field, for example, querying in Table 2 or Table 3 respectively, and can obtain two records with ID=d_0 and ID=id_6 containing the privacy field in Age, where ID is the identifier of the two records. In this way, the client queries in the query base based on the privacy field encrypted by the server, and can locate the identifier of the matching record after matching the record.

The client returns the identifier of the matching record to the server, which may include two situations.

One is that in S110, the client constructs a search statement, encrypts the sensitive fields in the search statement to obtain the private fields, replaces the sensitive fields with the private fields, and sends the replaced private search statement to the server. In this case, the client can directly return the identifier of the matching record to the server.

Another case is that in S110, the client sends the value of the sensitive field encrypted by itself to the server. In this case, in S120, the client can construct a search statement, for example, the search statement is:

select Name where ID＝id_0 or ID＝id_6

Thus, in S120, the client may send the constructed search formula to the server, where the search formula includes the identifier of the matching record and indicates that the field of interest is Name, that is, the field name immediately following select.

In other words, in the two steps S110 and S120, you can choose to send a search formula in one of the steps, and the search formula contains the field of interest.

S130: The server returns the value of the field of interest in the record corresponding to the identifier in the database to the client.

Still according to the above example, after receiving the identifier sent by the client, the server can search the database for the record corresponding to the identifier, and extract the corresponding value in the found record according to the field of interest in S110 or S120, and return the extracted value of the field of interest to the client. For example, return Name=A in the record corresponding to id_0 and Name=G in the record corresponding to id_6, that is, return A and G to the client.

In the above embodiment, by pre-configuring the query base to the client, the client can locate the identifier of the field to be queried in the query base through interaction with the server and the query base without exposing the plain text of the database, and further initiate a query to the server according to the identifier to obtain the value of the field of interest in the record corresponding to the identifier. Compared with the traditional multi-copy PIR, it is obviously not necessary to assume that multiple copy databases cannot collude, and the practicality is better. Compared with the situation that only bit retrieval can be achieved in the traditional single-copy PIR, this embodiment does not need to pay attention to the specific position (bit position) of the keyword to be retrieved in the database, can realize the query of the string, and can support structured query language (Structured Query Language, SQL). In this embodiment, the database is still kept on the server, and the query base obtained by encrypting the database is configured to the client, so that the client can locate the data based on the query base to obtain the identifier of the record when searching. At the same time, the encryption characteristics of the query base prevent the client from obtaining the content of the database, ensuring the privacy protection of the database by the server. In general, the form of the database and query base in this embodiment can be called "asymmetric dual copies" when a database is configured on a server and a query base is configured on a client, and can be called "asymmetric multiple copies" when query bases are configured on multiple clients.

In the above embodiment, through the SQL query statement, the client can initiate a query on the field of interest, such as the Name field to be queried in the above select Name... This exposes the client's fields of interest to a certain extent. In another way, you can query the records that meet the conditions, that is, the entire row of data that meets the conditions, which can protect the privacy of the client, but requires the server to return the entire record, which exposes the entire row of data on the server to a certain extent. For example, in S110/S120, through the search statement such as "select*where Age=?" or "select*where ID=id_0 or ID=id_6". In this way, the result returned by the server can be the records of the two rows of id_0 and id_6, for example as follows:

id_0A26315824anhui

id_6G22345524beijing

In addition, in order to ensure the security of the transmission process, the server can encrypt and return the record corresponding to the identifier in the database/the value of the field of interest in the corresponding record to the client. For example, the server can use the symmetric key negotiated with the client to encrypt the record corresponding to the identifier in the database/the value of the field of interest in the corresponding record and return it to the client, or use the public key in the asymmetric key of the client to encrypt the record corresponding to the identifier in the database/the value of the field of interest in the corresponding record and return it to the client, so that the client can decrypt it with its own private key, and use a digital envelope method, etc.

The following introduces a system embodiment of the present specification for implementing privacy information retrieval, including a server and a client, wherein the encryption/decryption performed by the client and the server on the same target adopts an encryption/decryption algorithm with an interchangeable order, and: the server is configured with a database, and obtains a query base after encrypting the database, and sends the query base to the client; in a retrieval process: the client sends a sensitive field encrypted by itself to the server, and obtains the same sensitive field encrypted by the server through interaction with the server; retrieves the sensitive field encrypted by the server in the query base, obtains the identifier of the matching record, and returns the identifier to the server; the server receives the sensitive field encrypted by itself sent by the client, encrypts it again and returns it to the client; also receives a retrieval identifier sent by the client; and returns the record corresponding to the identifier in the database/the value of the field of interest in the corresponding record to the client.

The following introduces a server embodiment of the present specification for implementing private information retrieval, in which the encryption/decryption performed by the server and the client on the same target adopts an encryption/decryption algorithm with an interchangeable order, and: the server is configured with a database, and encrypts the database to obtain a query base, and sends the query base to the client; during a retrieval process: the server receives the sensitive field encrypted by itself sent by the client, encrypts it again and returns it to the client; it also receives the retrieval identifier sent by the client; and returns the record corresponding to the identifier in the database/the value of the field of interest in the corresponding record to the client.

The following introduces a client embodiment of the present specification for implementing privacy information retrieval, in which the encryption/decryption performed by the client and the server on the same target adopts an encryption/decryption algorithm with an interchangeable order, and: the client is configured with a query base, and the query base is obtained by the server after encrypting the database; in a retrieval process: the client sends the sensitive field encrypted by itself to the server, and obtains the same sensitive field encrypted by the server through interaction with the server; the query base is searched according to the sensitive field encrypted by the server, the identification of the matching record is obtained, and the identification is returned to the server.

In the 1990s, it was very clear whether the improvement of a technology was hardware improvement (for example, improvement of the circuit structure of diodes, transistors, switches, etc.) or software improvement (improvement of the method flow). However, with the development of technology, many of the improvements of the method flow today can be regarded as direct improvements of the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that the improvement of a method flow cannot be implemented with hardware entity modules. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming themselves, without having to ask chip manufacturers to design and make dedicated integrated circuit chips. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing programs. The original code before compilation must also be written in a specific programming language, which is called Hardware Description Language (HDL). There is not only one kind of HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc., and the most commonly used ones are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that realizes the logic method flow.

The controller may be implemented in any suitable manner, for example, the controller may take the form of a microprocessor or processor and a computer readable medium storing a computer readable program code (e.g., software or firmware) executable by the (micro)processor, a logic gate, a switch, an application specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller, examples of which include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320, and the memory controller may also be implemented as part of the control logic of the memory. It is also known to those skilled in the art that in addition to implementing the controller in a purely computer readable program code manner, the controller may be implemented in the form of a logic gate, a switch, an application specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, such a controller may be considered as a hardware component, and the means for implementing various functions included therein may also be considered as a structure within the hardware component. Or even, the means for implementing various functions may be considered as both a software module for implementing the method and a structure within the hardware component.

The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, this specification does not exclude that with the development of computer technology in the future, the computer that implements the functions of the above embodiments may be, for example, a personal computer, a laptop computer, a vehicle-mounted human-computer interaction device, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

Although one or more embodiments of the present specification provide method operation steps as described in the embodiments or flow charts, more or less operation steps may be included based on conventional or non-creative means. The order of steps listed in the embodiments is only one way of executing the order of many steps, and does not represent the only execution order. When the device or terminal product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiments or the drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The term "include", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or equipment including a series of elements includes not only those elements, but also includes other elements that are not explicitly listed, or also includes elements inherent to such process, method, product or equipment. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or equipment including the elements. For example, if the words first, second, etc. are used to represent the name, they do not represent any specific order.

For the convenience of description, the above devices are described in various modules according to their functions. Of course, when implementing one or more of the present specification, the functions of each module can be implemented in the same or more software and/or hardware, or the module implementing the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

This specification is described with reference to the flowchart and/or block diagram of the method, device (system), and computer program product according to the embodiment of this specification. It should be understood that each process and/or box in the flowchart and/or block diagram, as well as the combination of the process and/or box in the flowchart and/or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the functions specified in one process or multiple processes in the flowchart and/or one box or multiple boxes in the block diagram.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

These computer program instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

In a typical configuration, a computing device includes one or more processors (CPU), input/output interfaces, network interfaces, and memory.

Memory may include non-permanent storage in a computer-readable medium, in the form of random access memory (RAM) and/or non-volatile memory, such as read-only memory (ROM) or flash memory (flash RAM). Memory is an example of a computer-readable medium.

Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage, graphene storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined in this article, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

It should be understood by those skilled in the art that one or more embodiments of the present specification may be provided as a method, system or computer program product. Therefore, one or more embodiments of the present specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, one or more embodiments of the present specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

One or more embodiments of this specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. One or more embodiments of this specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. In the description of this specification, the description of the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of this specification. In this specification, the schematic representation of the above terms does not necessarily target the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples without contradiction.

The above description is only an example of one or more embodiments of this specification and is not intended to limit one or more embodiments of this specification. For those skilled in the art, one or more embodiments of this specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this specification should be included in the scope of the claims.

Claims (10)

1. A method for realizing private information retrieval, wherein a server obtains a query base after encrypting a database, and sends the query base to a client; encryption/decryption performed by the client and the server on the same target adopts an encryption/decryption algorithm with interchangeable order;

   In a search process, including:

   The client sends the sensitive field encrypted by itself to the server, and obtains the same sensitive field encrypted by the server through interaction with the server;

   The client searches the query base according to the sensitive field encrypted by the server, obtains the identifier of the matching record, and returns the identifier to the server;

   The server returns the record corresponding to the identifier in the database/the value of the field of interest in the corresponding record to the client.
2. The method according to claim 1, wherein the client sends the sensitive field encrypted by itself to the server, comprising:

   The client sends the value of the sensitive field encrypted by itself to the server.
3. The method according to claim 1, wherein the client sends the sensitive field encrypted by itself to the server, comprising:

   The client constructs a search statement, encrypts the sensitive fields in the search statement to obtain a privacy field, replaces the sensitive field with the privacy field, and sends the replaced privacy search statement to the server.
4. The method as claimed in claim 1, wherein the client obtains the same sensitive field encrypted by the server through interaction with the server, comprising:

   The server uses its own key to encrypt the sensitive field encrypted by the client again and sends it to the client. The client uses its own key to decrypt the sensitive field encrypted twice to obtain the sensitive field encrypted by the server.
5. The method according to claim 2, wherein the client returns the identifier to the server, comprising:

   The client constructs a search statement and sends the constructed search statement to the server, wherein the search statement includes an identifier of a matching record.
6. According to the method of claim 3 or 5, the search statement includes or does not include the field of interest.
7. The method according to any one of claims 1 to 6, wherein the server returns the record corresponding to the identifier in the database/the value of the field of interest in the corresponding record to the client, comprising:

   The server encrypts and returns the record corresponding to the identifier in the database/the value of the field of interest in the corresponding record to the client.
8. A system for realizing private information retrieval includes a server and a client. The encryption/decryption performed by the client and the server on the same target adopts an encryption/decryption algorithm with an interchangeable order, and:

   The server is configured with a database, and obtains a query base after encrypting the database, and sends the query base to the client;

   During a search:

   The client sends the sensitive field encrypted by itself to the server, and obtains the same sensitive field encrypted by the server through interaction with the server; retrieves the sensitive field encrypted by the server in the query base, obtains the identifier of the matching record, and returns the identifier to the server;

   The server receives the sensitive fields encrypted by itself sent by the client, encrypts them again and returns them to the client; it also receives the search identifier sent by the client; and returns the record corresponding to the identifier/the value of the field of interest in the corresponding record in the database to the client.
9. A server for implementing private information retrieval, wherein the server and the client use encryption/decryption algorithms with interchangeable sequences for encryption/decryption of the same target, and:

   The server is configured with a database, and obtains a query base after encrypting the database, and sends the query base to the client;

   During a search:

   The server receives the sensitive fields encrypted by itself sent by the client, encrypts them again and returns them to the client; it also receives the search identifier sent by the client; and returns the record corresponding to the identifier/the value of the field of interest in the corresponding record in the database to the client.
10. A client for implementing private information retrieval, wherein the encryption/decryption performed by the client and the server on the same target adopts an encryption/decryption algorithm with an interchangeable order, and:

    The client is configured with a query base, and the query base is obtained by the server after encrypting the database;

    During a search:

    The client sends the sensitive field encrypted by itself to the server, and obtains the same sensitive field encrypted by the server through interaction with the server; retrieves the sensitive field encrypted by the server in the query base, obtains the identifier of the matching record, and returns the identifier to the server.

Images