| 摘要: |
| 现实生活中,代理为具有特定属性的人群提供服务,云存储的发展使得代理能够从云端获取丰富的数据以提高服务效率。在社交网络图中,具有特定属性的人群的邻居节点集很可能具有相同的属性,为代理获取数据提供了潜在机会。随着社交网络图规模的持续增长,本地维护这些数据已变得越来越困难。云计算的快速发展为解决这一问题提供了有效的途径:通过将社交网络图数据上传至云服务器,可以显著节省本地资源,但与此同时也带来了数据安全问题。结构化加密(Structured Encryption,STE)技术为这一问题提供了一种可行的解决方案。STE能够对社交网络图进行加密,并通过构建关联性的加密索引,支持对加密图的复杂查询操作。然而,结构化加密在查询效率和实用性上仍然存在一定的局限性。隐私集合并集(Private Set Union,PSU)协议能够在保护两方交集不被泄露的前提下求出两方集合的并集,使得代理从云端获取数据的过程中返回必要的数据并确保数据的安全性,我们提出了基于结构化加密的隐私集合并集协议(Private Set Union for Structured Encryption,STE-PSU),实现了服务器与代理两方的隐私集合并集操作,降低了查询过程中的计算和通信开销。方案引入一种不经意键值存储(ObliviousKey-Value Stores,OKVS)构造,即基于三个哈希函数的混淆布谷鸟哈希表(3-Hash Garbled Cuckoo Table,3H-GCT),在保证隐私的基础上实现了两方高效的PSU协议。同时云服务器上的社交网络图通过结构化加密技术加密后存储,保证了数据的安全性。理论分析与实验结果表明,尽管我们提出的代理与服务器两方的PSU协议需要首先搜索加密索引再进行并集操作,但仍然比已有的PSU协议效率更优。安全性分析证明,本文方案满足自适应选择查询攻击(Adaptive Chosen Query Attacks,CQA2)安全性。 |
| 关键词: 结构化加密 云存储 隐私集合并集协议 不经意键值存储 |
| DOI：10.19363/J.cnki.cn10-1380/tn.2026.05.05 |
| 投稿时间：2024-12-02修订日期：2025-02-14 |
| 基金项目:本课题得到国家自然科学基金(No.62072105)、福建省自然科学基金(No.2024J01068)项目资助。 |
|
| Private Set Union Protocol for Structured Encryption |
|
JIANG Peng1, CHEN Lanxiang1,2
|
| (1.Fujian Provincial Key Laboratory of Network Security and Cryptology, College of Computer and Cyber Security, Fujian Normal University, Fuzhou 350117, China;2.School of Information Science and Engineering, Zhejiang Sci-Tech University, Hangzhou 310018, China) |
| Abstract: |
| In practical scenarios, proxies provide services to individuals with specific requirements. The development of cloud storage enables proxies to access abundant data from the cloud, thereby enhancing service efficiency. In a social network, neighbors of individuals with specific attributes often have similar attributes, presenting potential opportunities for proxies to acquire data. With the continuous growth of social network graph scales, maintaining these data locally has become increasingly challenging. The rapid development of cloud computing provides an effective solution to this issue by uploading social network graph data to cloud servers can significantly save local resources. However, this approach also introduces data security concerns. Structured Encryption offers a viable solution to this problem. STE enables the encryption of social network graphs and supports complex query operations on encrypted graphs by constructing associative encrypted indexes. Nevertheless, structured encryption still has certain limitations in terms of query efficiency and practicality. The Private Set Union (PSU) protocol enables the computation of the union of two sets while ensuring that the intersection of the two sets remains confidential. To allow the proxy to retrieve necessary data from the cloud while ensuring data security, we propose the Structured Encryption based Private Set Union Protocol (STE-PSU). This protocol achieves private set union operations between the server and the proxy, reducing both computational and communication overhead during the query process. The scheme introduces an Oblivious Key-Value Stores (OKVS) construction, i.e., a 3-Hash Garbled Cuckoo Table (3H-GCT), which achieves efficient PSU operation while preserving privacy. Additionally, the social network graph on the cloud server is stored securely through structured encryption. Theoretical analysis and experimental results show that, although the proposed PSU protocol requires an initial search of the encrypted index before performing the union operation, it is still more efficient than existing two-party PSU protocols. Security analysis verifies that the proposed scheme satisfies Adaptive Chosen Query Attacks (CQA2) security. |
| Key words: structured encryption cloud storage Private Set Union Protocol(PSUP) Oblivious Key-Value Stores(OKVS) |
