A method, device and computer equipment for finding intersection of private sets with conditional retrieval

Abstract

The present application relates to the field of information security, and in particular to a method, device and computer equipment for finding the intersection of privacy sets with conditional retrieval; the method includes the server encrypting the first condition parameter and the first data set respectively and sending them to the client; the client homomorphically encrypts the second condition parameter and the ciphertext of the first condition parameter, and encrypts the ciphertext of the first data set again to obtain the ciphertext of the second data set; the client confuses the ciphertext of the homomorphic condition parameter and the ciphertext of the second data set and returns them to the server, and encrypts the third data set and attaches the index value to the server; the server decrypts the ciphertext of the homomorphic condition parameter, and encrypts the ciphertext of the third data set again to obtain the ciphertext of the fourth data set; the server determines whether the decrypted homomorphic condition parameter meets the retrieval condition, and retrieves whether there is an intersection by comparing the two re-encrypted data set ciphertexts. The present invention can find the intersection of privacy sets under specific conditional retrieval.

Description

Technical Field

[0001] The present application relates to the field of information security, and in particular to a method, device and computer equipment for finding the intersection of privacy sets with conditional retrieval. Background Art

[0002] With the continuous development of information technology, data has become even more valuable. The premise of using data is to ensure the privacy of the data, otherwise it will lead to data leakage, resulting in more serious adverse effects.

[0003] Therefore, in order to make the private data sets of both parties play a role, researchers have proposed the Private Set Intersection (PSI) technology. PSI means that the two parties holding the data can calculate the intersection of their data sets without exposing any data set information outside the intersection. This technology allows the two parties holding their own data sets to jointly calculate the intersection of the two sets; at the end of the protocol interaction, one or both parties should obtain the correct intersection, and will not obtain any data information in the other party's set outside the intersection.

[0004] However, in the traditional research on private set intersection, conditional search is not considered when performing set intersection. This will require data demanders to perform conditional search locally after obtaining the intersection, thereby filtering out useless departmental data. However, this process will expose too many data sets and cause some private information to be leaked. If conditional search is performed in the server-side data set in advance and then the private set intersection is completed, the intention of the data demander will be exposed. Summary of the invention

[0005] In order to solve the above problems, the present invention proposes a privacy set intersection method, device and computer equipment with conditional retrieval, so that policy screening can be performed while privacy sets are intersected, which will neither leak too much privacy data nor expose the intentions of the data demander.

[0006] In a first aspect of the present invention, the present invention provides a privacy set intersection method with conditional retrieval, which is applied to a privacy intersection basic platform in a cloud storage system, wherein the privacy intersection basic platform includes a client and a server, and the method includes the following steps:

[0007] The server encrypts the first condition parameter μ1 and the first data set it knows and sends them to the client;

[0008] The client performs homomorphic encryption on the second conditional parameter μ2 it has and the received ciphertext of the first conditional parameter, and encrypts the ciphertext of the first data set again to obtain a double-encrypted ciphertext of the second data set;

[0009] The client confuses the homomorphic condition parameter ciphertext with the second data set ciphertext and returns it to the server, and encrypts its own third data set and attaches the index value before sending it to the server;

[0010] The server decrypts the received homomorphic condition parameter ciphertext and encrypts the third data set ciphertext again to obtain another double-encrypted fourth data set ciphertext;

[0011] The server determines whether the decrypted homomorphic condition parameters meet the retrieval condition. If the retrieval condition μ1+μ2=1 is met, it searches for intersection by comparing the ciphertexts of the two double-encrypted data sets.

[0012] In a second aspect of the present invention, the present invention further provides a privacy collection request device with conditional retrieval, the device is applied to a privacy request basic platform in a cloud storage system, the privacy request basic platform includes a client and a server, the device includes:

[0013] The first encryption module is mounted on the server side and is used to encrypt the first condition parameter μ1 and the first data set respectively.

[0014] The first transmission module is mounted on the server side and is used to send the encrypted first condition parameter μ1, i.e., the first condition parameter ciphertext and the first data set ciphertext to the client side;

[0015] The second encryption module is installed on the client and is used to homomorphically encrypt the second conditional parameter μ2 held by the client and the received first conditional parameter ciphertext, and to encrypt the first data set ciphertext again to obtain a doubly encrypted second data set ciphertext, and to encrypt its own third data set;

[0016] The data obfuscation module is installed on the client and is used to obfuscate the homomorphic condition parameter ciphertext and the second data set ciphertext;

[0017] The second transmission module is installed on the client and is used to send the obfuscated homomorphic condition parameter ciphertext and the second data set ciphertext, and the third data set to the server after attaching the index value;

[0018] The third encryption module is installed on the server side and is used to re-encrypt the ciphertext of the third data set to obtain another double-encrypted ciphertext of the fourth data set;

[0019] The data decryption module is installed on the server side and is used to decrypt the received homomorphic condition parameter ciphertext;

[0020] The data retrieval module is installed on the server side and is used to determine whether the decrypted homomorphic condition parameters meet the retrieval conditions. If the retrieval condition μ1+μ2=1 is met, the ciphertext of the two double-encrypted data sets is compared to determine whether there is an intersection.

[0021] In a third aspect of the present invention, the present invention further provides a computer device, the computer comprising:

[0022] processor;

[0023] a memory for storing processor-executable instructions;

[0024] The processor implements the method described in the first aspect of the present invention by running the executable instructions.

[0025] Beneficial effects of the present invention:

[0026] The present invention adds a screening strategy to the process of privacy set intersection, and can perform policy screening while performing privacy set intersection, thereby preventing excessive sensitive data from being leaked and reducing data risk; the present invention also implements policy hiding based on obfuscation technology, so that the server cannot infer the client's intention based on the client's screening strategy, thereby ensuring the client's privacy. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 A flowchart of a privacy set intersection method with conditional retrieval according to an embodiment of the present invention;

[0028] Figure 2 A flowchart of a privacy set intersection method with conditional retrieval according to a preferred embodiment of the present invention;

[0029] Figure 3 is a flowchart of the system initialization process in an embodiment of the present invention;

[0030] Figure 4 is a flowchart of conditional parameter generation in an embodiment of the present invention;

[0031] Figure 5 is a flowchart of the privacy set intersection process in an embodiment of the present invention;

[0032] Figure 6 It is a flow chart of returning intersection results with conditional retrieval in an embodiment of the present invention;

[0033] Figure 7 This is a structural diagram of a privacy collection requesting device with conditional retrieval according to an embodiment of the present invention;

[0034] Figure 8 It is a structural diagram of a privacy collection requesting device with conditional retrieval according to a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0035] The following describes the embodiments of the present invention by specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the illustrations provided in the following embodiments only illustrate the basic concept of the present invention in a schematic manner, and the following embodiments and features in the embodiments can be combined with each other without conflict.

[0036] As a type of protocol with a wide range of application scenarios in the field of secure multi-party computation, the privacy set intersection technology has been greatly optimized in recent years, reaching the same level of operational complexity (in terms of computation and communication) as the currently used non-secure intersection technology in some scenarios. The privacy-preserving set intersection protocol allows two parties holding their own sets to jointly calculate the intersection of two sets. At the end of the protocol interaction, one or both parties should obtain the correct intersection and will not obtain any information from the other party's set other than the intersection. Protecting the privacy of a set is a natural and even necessary requirement in many scenarios. For example, when the set is a user's address book or the genome of a user of a genetic diagnosis service, such input must be protected by cryptographic means; in traditional privacy set intersection technology, it is impossible to obtain the corresponding privacy-preserving set intersection based on the client's specific search conditions.

[0037] Based on this, the embodiment of the present invention provides a privacy set intersection method with conditional retrieval, such as Figure 1 As shown, the method is applied to a privacy-enforcing basic platform in a cloud storage system, and the privacy-enforcing basic platform includes a client and a server, specifically including:

[0038] 101. The server encrypts the first condition parameter μ1 and the first data set it knows and sends them to the client;

[0039] In the embodiment of the present invention, the first condition parameter is controlled by the server itself, and the first condition parameter is a specific parameter value obtained according to the condition policy of the client; the first data set is a data set owned by the server, wherein the data set may be an ID data set, that is, the data set owned by the server includes multiple ID data sets, each ID data set has an ID, assuming that the server holds the first data set U i, i∈[1,n], where n is the number of ID data sets, and each ID data set U i The ID can be represented by i.

[0040] In the embodiment of the present invention, the encryption method used for the first condition parameter and the first data set may be an encryption method based on EIGamal: E=(r·G,μ·G+r·pk), or Paillier homomorphic encryption may be used.

[0041] 102. The client performs homomorphic encryption on the second conditional parameter μ2 it has and the received first conditional parameter ciphertext, and encrypts the first data set ciphertext again to obtain a doubly encrypted second data set ciphertext;

[0042] In an embodiment of the present invention, the second condition parameter is controlled by the client itself, and the second condition parameter is a specific parameter value obtained according to the client's condition policy; the sum of the first condition parameter and the second condition parameter will represent the client's condition policy result value; considering that the first condition parameter has been encrypted, and the second condition parameter has not been encrypted, homomorphic encryption is a cryptographic technology based on the computational complexity theory of mathematical problems. The data that has been homomorphically encrypted is processed to obtain an output, and this output is decrypted, and the result is the same as the output result obtained by processing the unencrypted original data in the same way. Therefore, in an embodiment of the present invention, the encrypted first condition parameter and the unencrypted second condition parameter are processed in a homomorphic encryption manner to obtain a homomorphic condition parameter ciphertext, which can reflect the client's condition policy and can be used as a conditional retrieval.

[0043] In the embodiment of the present invention, the second data set ciphertext is a doubly encrypted ciphertext, the first encryption is performed by the server to encrypt the first data set, and the second encryption is performed by the client on the basis of the first data set ciphertext.

[0044] 103. The client confuses the homomorphic condition parameter ciphertext and the second data set ciphertext and returns the result to the server, and encrypts its own third data set and attaches the index value and sends the result to the server;

[0045] In the embodiment of the present invention, the homomorphic condition parameter ciphertext is confused with the second data set ciphertext; it can be expressed as π:{0,1} k ×{1,2,...,n}→{1,2,...,n}.

[0046] In an embodiment of the present invention, the homomorphic condition parameter ciphertext and the second data set ciphertext are disrupted in an obfuscation manner, and a pseudo-random arrangement can be used; this obfuscation method can ensure that the server cannot determine the sequence of the previously stored data set, nor can it infer what the specific intersection is. For example, suppose that the server has the following data in its originally stored database: the first data is Zhang San, the second data is Li Si, the third data is Wang Wu, the fourth data is Tian Qi, and the other data are in turn. After this sequence is disrupted, the server cannot determine the specific data at the first position. That is to say, when the server performs the intersection operation, it will know that the first position and the fifth position are the intersection, but because the original position sequence is disrupted, the server will not know what data the first position and the fifth position are.

[0047] It should be noted that, in the embodiment of the present invention, the obfuscation method can ensure that the server does not know which IDs in its own data set meet the policy, thereby protecting the privacy of the client.

[0048] In the embodiment of the present invention, the third data set is a data set owned by the client, wherein the data set may be an ID data set, that is, the data set owned by the client includes multiple ID data sets, each ID data set has an ID. Assuming that the server holds the third data set U j , j∈[1,m], where m is the number of ID data sets, and each ID data set U j The ID can be represented by j.

[0049] In an embodiment of the present invention, since each ID data set in the third data set contains an ID value, which can reflect the corresponding data set, an index value is used in the embodiment of the present invention to correspond to each ID data set, and the third data set with the index value attached is encrypted and sent to the server. The server can know the index value, but cannot know the specific ID data set in the client.

[0050] 104. The server decrypts the received homomorphic condition parameter ciphertext and encrypts the third data set ciphertext again to obtain another double-encrypted fourth data set ciphertext;

[0051] In an embodiment of the present invention, after the server decrypts the received homomorphic condition parameter ciphertext, it can obtain the client's condition policy value, and can determine whether the client's conditional retrieval is met based on the policy value.

[0052] In the embodiment of the present invention, the fourth data set ciphertext is also a double-encrypted ciphertext, the first encryption is performed by the client to encrypt the third data set, and the second encryption is performed by the server on the basis of the third data set ciphertext.

[0053] 105. The server determines whether the decrypted homomorphic condition parameters meet the retrieval condition. If the retrieval condition μ1+μ2=1 is met, it searches for intersection by comparing the ciphertexts of the two double-encrypted data sets.

[0054] In an embodiment of the present invention, after decrypting the homomorphic conditional parameter ciphertext, the value of μ1+μ2 can be obtained. In the embodiment of the present invention, μ1+μ2=0 is defined to indicate that the index value ID does not meet the retrieval condition, and μ1+μ2=1 indicates that the index value ID meets the retrieval condition. Therefore, when μ1+μ2=1 is satisfied, it is possible to continue to determine whether the two doubly encrypted data set ciphertexts have an intersection; if the server does not find an intersection in the two doubly encrypted ID data sets; or the server finds that the homomorphic decrypted ciphertexts corresponding to the index value IDs in these intersections are all zero. This means that there is no data in the client and server that satisfies both the intersection and the conditional strategy. At this time, the server will not return the index value index to the client. In addition to the above situation, as long as there is data that satisfies both the intersection and the conditional strategy, the server will return the corresponding index value index to the client.

[0055] Figure 2 is a flow chart of a privacy set intersection method with conditional retrieval in a preferred embodiment of the present invention. Figure 2 As shown, the method is applied to a privacy-enforcing basic platform in a cloud storage system, and the privacy-enforcing basic platform includes a client and a server, specifically including:

[0056] 201. Define system-related public parameters to generate the public and private key pairs of the server, and define the data sets of the client and server respectively;

[0057] Figure 3 is a flowchart of the system initialization process in an embodiment of the present invention, such as Figure 3 As shown, in this embodiment of the present invention, the process of system initialization includes:

[0058] 2011. Input security parameters;

[0059] The security parameter may include taking a large prime number p, and p>2 160 . Then take any a,b∈Z p And 4a 3 +27b 2 ≠ 0. Define E p (a,b):y2 ≡x 3 +ax+b(modp), all points of this equation form an elliptic curve.

[0060] 2012. Generate system public parameters and server-side public and private key pairs;

[0061] The server selects a point G on the elliptic curve. Define a random function f, as follows: Among them, k represents the system security parameter, n represents the size of the random number space, and l represents the number of bits of the random number. The server obtains a random number r through the random function f, and uses it as its private key sk, and then publishes its public key pk=r·G.

[0062] 2013. The client and server define their own ID data sets;

[0063] Assume that the client has an ID set A and a corresponding first data set, and the server has an ID set B and a corresponding second data set; and the client and the server do not know each other's ID data sets.

[0064] 2014. Output system public parameters;

[0065] After the above definition, the public parameters params = {p, a, b, G, pk} are output.

[0066] 202. The client defines a conditional policy, and uses this policy to allow the client and the server to determine whether each ID in the server satisfies the first conditional parameter μ1 and the second conditional parameter μ2 of the policy by executing an interactive size comparison protocol.

[0067] Figure 4 is a flowchart of the conditional parameter generation process in an embodiment of the present invention, such as Figure 4 As shown, in this embodiment of the present invention, the process of generating the conditional parameters includes:

[0068] 2021: The client defines conditional policies based on demand;

[0069] In the embodiment of the present invention, the client determines the conditional strategy that needs to be satisfied based on its own demand for the data set, that is, a conditional value.

[0070] 2022: The client performs a size comparison protocol on the conditional strategy and the ID data set on the server one by one;

[0071] In the embodiment of the present invention, the client and the server take the ID data set of the server as the object and perform condition screening on it one by one, but the client and the server do not know whether each ID therein satisfies the condition.

[0072] In an embodiment of the present invention, the screening process may include the client first defining a threshold value, which corresponds to the attribute value in the ID data set; assuming that the threshold value is 8, and the ID data set includes multiple ID data, some of which have attribute values ​​less than 8, and some of which have attribute values ​​greater than 8, we assume that the ID data with attribute values ​​less than 8 meet the screening strategy; at this time, the client first needs to ask the server which data set IDs have intersections between the data set in the server and the data set in the client and meet the corresponding strategy. Then, during the specific screening, the client will not tell the server the specific strategy, but will let the client and server each hold a condition parameter through the comparison size protocol, so that the server can know whether the ID meets the condition, but will not know the specific strategy.

[0073] 2023: Obtain respective conditional parameters by interactively executing the size comparison protocol;

[0074] In the embodiment of the present invention, the client and the server perform an interactive size comparison protocol to obtain conditional parameters μ1 and μ2, wherein μ1 is controlled by the server and μ2 is controlled by the client.

[0075] In an embodiment of the present invention, the client and the server each perform addition secret sharing of all their own digital attribute values ​​[x]=x1+x2 and [y]=y1+y2; the client and the server respectively calculate the subtraction values ​​d1=x1-y1 and d2=x2-y2 of the corresponding numbers; the client and the server jointly execute the shared redefinition protocol according to the two subtraction values ​​to obtain the first conditional parameter and the second conditional parameter.

[0076] The digital attribute value is the attribute value corresponding to a certain ID in the ID data set. For example, assume that user A and user B in the server have their own ID data sets, and these IDs have some characteristic values; user A has {ID: 1, annual salary: 22W, age: 22 years old}, {ID: 2, annual salary: 24W, age: 22 years old}, {ID: 7, annual salary: 18W, age: 26 years old}. User B has {ID: 2, gender: male, marital status: single}, {ID: 4, gender: female, marital status: married}, {ID: 7, gender: male, marital status: married}. There is an intersection of IDs in these two data sets, but the characteristic values ​​in these two data sets may be different. At this time, if the client wants to perform a conditional search, assuming that the conditional search requirement at this time is that the annual salary meets 200,000 and the IDs intersect; then whether the annual salary meets 200,000 needs to be selected by executing an interactive size comparison protocol. If you want to determine whether the IDs intersect, you need to compare the ciphertexts of the two heavily encrypted data sets to achieve this.

[0077] Specifically, the embodiment of the present invention is implemented in the following manner:

[0078] 2023A: The client and server add all their numbers to a secret and share them. For example, [x] = x1 + x2 and [y] = y1 + y2. That is, the client has x1 and y1, and the server has x2 and y2.

[0079] In some embodiments, the present invention is implemented as follows:

[0080] First, a Beaver triplet (a, b, [c] = c1 + c2) is defined, where the client has (a, c1) and the server has (b, c2); the definition process can be defined by a third-party server and then shared with the client and server, or it can be defined by the client or server and then shared.

[0081] The client calculates e=(d1-c1) / a and sends e to the server.

[0082] The server calculates the second conditional parameter μ2=e+b, f=(d2-c2) / μ2 based on e, and sends f to the client.

[0083] The client then calculates the first conditional parameter μ1=f+a based on f.

[0084] 2023B: The client and server calculate d1=x1-y1 and d2=x2-y2 respectively.

[0085] 2023C: The client and server jointly execute the shared redefinition protocol to obtain μ1 and μ2 respectively.

[0086] Among them, x1 represents the first number owned by the client, y1 represents the second number owned by the client; x2 represents the first number owned by the server, y2 represents the second number owned by the server; [x] represents the first added digital value after sharing; [y] represents the second added digital value after sharing.

[0087] 2024: Define the role of conditional parameters based on the characteristics of the comparison size protocol.

[0088] In the embodiment of the present invention, according to the characteristics of the size comparison protocol, the client and the server can define the role of the conditional parameters. Among them, μ1 and μ2 can represent the results of the conditional search, that is, μ1+μ2=0 means that the ID of the server does not meet the search condition, and μ1+μ2=1 means that the ID of the server meets the search condition.

[0089] It is understandable that the size comparison protocol stipulates that the sum of μ1+μ2 can only be 0 and 1, so the conditional search can be completed in the above way.

[0090] 203. The server encrypts the first condition parameter μ1 and the first data set it knows and sends them to the client;

[0091] 204. The client performs homomorphic encryption on the second conditional parameter μ2 it has and the received first conditional parameter ciphertext, and encrypts the first data set ciphertext again to obtain a doubly encrypted second data set ciphertext;

[0092] 205. The client confuses the homomorphic condition parameter ciphertext and the second data set ciphertext and returns the ciphertext to the server, and encrypts its own third data set and attaches the index value and sends it to the server;

[0093] 206. The server decrypts the received homomorphic condition parameter ciphertext and encrypts the third data set ciphertext again to obtain another double-encrypted fourth data set ciphertext;

[0094] 207. The server determines whether the decrypted homomorphic condition parameters meet the search condition. If the search condition μ1+μ2=1 is met, it searches for intersection by comparing the ciphertexts of the two double-encrypted data sets.

[0095] Figure 5 is a flowchart of the privacy set intersection process in an embodiment of the present invention, such as Figure 5 As shown, in this embodiment of the present invention, the process of finding the intersection of the privacy sets includes:

[0096] S31: The server randomly selects two random numbers (r, a). Then it encrypts the condition parameter μ1 with its own public key, in the form of (r·G,μ1·G+r·pk). At the same time, it encrypts its own ID data set in the form of (a·ID), ID∈B. Then, it sends all of them to the client.

[0097] S32: The client also randomly selects two random numbers (r′, b). After receiving the ciphertext of μ2, it homomorphically encrypts its own conditional parameter μ2, as shown in E ID =((r+r′)·G,(μ1+μ2)·G+(r+r′)·pk). At the same time, the received server-side ID data set ciphertext is encrypted again, in the form of (a·b·ID), ID∈B.

[0098] S33: The client confuses the homomorphic ciphertext and the double-encrypted data set and scrambles the order before sending them to the server.

[0099] S34: At the same time, the client also encrypts its own ID data set, in the form of (b·ID), ID∈A. Then it attaches the index value index of its own data set and sends it to the server.

[0100] S35: The server encrypts the received client ID data set ciphertext again, in the form of (a·b·ID), ID∈A. At the same time, it decrypts the E returned by the client. ID , and obtain the value of (μ1+μ2).

[0101] S36: The server retrieves the two double-encrypted ID data sets to check whether there is an intersection, and at the same time checks whether the decrypted ciphertext of the corresponding ID is zero, that is, whether μ1+μ2 is zero.

[0102] Figure 6 is a flowchart of the intersection result return process with conditional search in an embodiment of the present invention, such as Figure 6 As shown, in an embodiment of the present invention, the process includes:

[0103] The server checks the two double-encrypted ID data sets;

[0104] Determine whether two ID data sets have intersection;

[0105] If the two ID data sets have no intersection, the server does not return the index value to the client;

[0106] If the two ID data sets have an intersection, the server checks the decrypted homomorphic ciphertext;

[0107] When the decrypted ciphertext value is 0, it indicates that the intersection of the client and the server does not meet the condition, and the server does not return the index value to the client;

[0108] When the value of the decrypted ciphertext is not 0, the server can return the index value to the client.

[0109] Figure 7 is a privacy collection request device with conditional retrieval according to an embodiment of the present invention, such as Figure 7 As shown, the device is applied to a privacy intersection basic platform in a cloud storage system, the privacy intersection basic platform includes a client 310 and a server 300, and the device includes:

[0110] The first encryption module 301 is mounted on the server side and is used to encrypt the first condition parameter μ1 and the first data set respectively controlled by the server;

[0111] The first transmission module 302 is mounted on the server side and is used to send the encrypted first condition parameter μ1, i.e., the first condition parameter ciphertext and the first data set ciphertext to the client side;

[0112] The second encryption module 303 is mounted on the client and is used to homomorphically encrypt the second conditional parameter μ2 held by the client and the received first conditional parameter ciphertext, and to encrypt the first data set ciphertext again to obtain a doubly encrypted second data set ciphertext, and to encrypt its own third data set;

[0113] The data obfuscation module 304 is installed on the client and is used to obfuscate the homomorphic condition parameter ciphertext and the second data set ciphertext;

[0114] The second transmission module 305 is mounted on the client and is used to send the obfuscated homomorphic condition parameter ciphertext and the second data set ciphertext, and the third data set to the server after attaching the index value;

[0115] The third encryption module 306 is installed on the server side and is used to re-encrypt the third data set ciphertext to obtain another double-encrypted fourth data set ciphertext;

[0116] The data decryption module 307 is installed on the server side and is used to decrypt the received homomorphic condition parameter ciphertext;

[0117] The data retrieval module 308 is installed on the server side and is used to determine whether the decrypted homomorphic condition parameters meet the retrieval conditions. If the retrieval condition μ1+μ2=1 is met, whether there is an intersection is retrieved by comparing the ciphertexts of the two double-encrypted data sets.

[0118] In some preferred embodiments, Figure 8 is a privacy collection request device with conditional retrieval in a preferred embodiment of the present invention, such as Figure 8 As shown, the privacy-enforcing basic platform includes a client 410 and a server 400, and the device may also include:

[0119] The first encryption module 401 is mounted on the server side and is used to encrypt the first condition parameter μ1 and the first data set controlled by the server itself;

[0120] The first transmission module 402 is mounted on the server side and is used to send the encrypted first condition parameter μ1, i.e., the first condition parameter ciphertext and the first data set ciphertext to the client side;

[0121] The second encryption module 403 is mounted on the client and is used to homomorphically encrypt the second conditional parameter μ2 held by the client and the received first conditional parameter ciphertext, and to encrypt the first data set ciphertext again to obtain a doubly encrypted second data set ciphertext, and to encrypt its own third data set;

[0122] The data obfuscation module 404 is installed on the client and is used to obfuscate the homomorphic condition parameter ciphertext and the second data set ciphertext;

[0123] The second transmission module 405 is mounted on the client and is used to send the obfuscated homomorphic condition parameter ciphertext and the second data set ciphertext, and the third data set to the server after attaching the index value;

[0124] The third encryption module 406 is installed on the server side and is used to re-encrypt the third data set ciphertext to obtain another double-encrypted fourth data set ciphertext;

[0125] The data decryption module 407 is installed on the server side and is used to decrypt the received homomorphic condition parameter ciphertext;

[0126] The data retrieval module 408 is installed on the server side and is used to determine whether the decrypted homomorphic condition parameters meet the retrieval condition. If the retrieval condition μ1+μ2=1 is met, the ciphertext of the two double-encrypted data sets is compared to determine whether there is an intersection.

[0127] The third transmission module 409 is installed on the server side and is used to return the corresponding index value to the client side according to the search result of the data search module when the ciphertexts of the two double-encrypted data sets have an intersection.

[0128] The implementation process of the functions and effects of each module in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, which will not be repeated here.

[0129] In some preferred embodiments, the computer device of the present invention includes: a processor and a memory; the memory is used to store a computer program; the processor is connected to the memory and is used to execute the computer program stored in the memory, so that the privacy set intersection device performs any of the privacy set intersection methods.

[0130] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this specification. A person of ordinary skill in the art can understand and implement it without paying creative labor.

[0131] It should be noted that it should be understood that the division of the various ends of the above device is only a division of logical functions. In actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. And these ends can all be implemented in the form of software calling through processing elements; they can also be all implemented in the form of hardware; some ends can also be implemented in the form of software calling through processing elements, and some ends can be implemented in the form of hardware. For example, the x end can be a separately established processing element, or it can be integrated in a chip of the above device. In addition, it can also be stored in the memory of the above device in the form of program code, and called and executed by a processing element of the above device. The implementation of other ends is similar. In addition, all or part of these ends can be integrated together, or they can be implemented independently. The processing element described here can be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method or each of the above ends can be completed by an integrated logic circuit of hardware in the processor element or instructions in the form of software.

[0132] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0133] In summary, the privacy set intersection method, device and computer of the present invention can achieve the privacy set intersection under specific condition retrieval while protecting the privacy of the data sets at both ends. Therefore, the present invention effectively overcomes various shortcomings in the prior art and has high industrial utilization value.

[0134] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A privacy set intersection method with conditional retrieval, applied to a privacy intersection basic platform of a cloud storage system, the privacy intersection basic platform includes a client and a server, characterized in that: The method comprises the following steps: The server encrypts the first condition parameter μ1 and the first data set it has, respectively, to obtain the first condition parameter ciphertext and the first data set ciphertext, and sends them to the client; The client performs homomorphic encryption on the second conditional parameter μ2 it has and the received first conditional parameter ciphertext to obtain a homomorphic conditional parameter ciphertext; and encrypts the received first data set ciphertext again to obtain a doubly encrypted second data set ciphertext; The client confuses the homomorphic condition parameter ciphertext with the second data set ciphertext and returns it to the server. It also encrypts its own third data set and attaches the index value to generate the third data set ciphertext and sends it to the server. The server decrypts the received homomorphic condition parameter ciphertext and encrypts the third data set ciphertext again to obtain another double-encrypted fourth data set ciphertext; The server determines whether the decrypted homomorphic condition parameters meet the retrieval condition. If the retrieval condition μ1+μ2=1 is met, the server compares the ciphertexts of the two double-encrypted data sets to determine whether there is an intersection. Among them, the first condition parameter and the second condition parameter are generated in the following way: the client determines the condition strategy that needs to be met according to the demand for the data set; the client and the server jointly take the first data set of the server as the object and perform condition screening on it one by one; the client and the server execute an interactive size comparison protocol to obtain the first condition parameter mastered by the server and the second condition parameter mastered by the client.

2. A method for finding intersection of private sets with conditional retrieval according to claim 1, characterized in that: The client and the server execute an interactive size comparison protocol, including the client and the server each performing addition secret sharing of all their own digital attribute values ​​[x]=x1+x2 and [y]=y1+y2; the client and the server respectively calculate the subtraction values ​​d1=x1-y1 and d2=x2-y2 of the corresponding numbers; the client and the server jointly execute the sharing redefinition protocol according to the two subtraction values ​​to obtain the first condition parameter and the second condition parameter, wherein x1 represents the first number owned by the client, and y1 represents the second number owned by the client; x2 represents the first number owned by the server, and y2 represents the second number owned by the server; [x] represents the first addition digital value after sharing; and [y] represents the second addition digital value after sharing.

3. A method for finding intersection of private sets with conditional retrieval according to claim 2, characterized in that: The joint execution of the shared redefinition protocol to obtain the first conditional parameter and the second conditional parameter includes defining a Beaver triplet (a, b, [c] = c1 + c2), in which the client has (a, c1) and the server has (b, c2); the client calculates e = (d1-c1) / a, and sends e to the server; the server calculates the second conditional parameter μ2 = e+b, f = (d2-c2) / μ2 based on e, and sends f to the client; the client then calculates the first conditional parameter μ1 = f+a based on f.

4. The method for finding intersection of private sets with conditional retrieval according to claim 1, characterized in that: When the ciphertexts of two double-encrypted data sets intersect, the server returns the corresponding index value to the client.

5. The method for finding intersection of private sets with conditional retrieval according to claim 1, characterized in that: The method further includes initializing the system, that is, after inputting security parameters, generating system public parameters and a public-private key pair of the server, and defining respective ID data sets for the client and the server, so that the client has an ID set A and a corresponding first data set, and the server has an ID set B and a corresponding second data set; Output system public parameters.

6. A privacy collection request device with conditional retrieval, characterized in that: The device is applied to a privacy-seeking basic platform in a cloud storage system, and the privacy-seeking basic platform includes a client and a server, and is characterized in that the device includes: The first encryption module is mounted on the server side and is used to encrypt the first condition parameter μ1 and the first data set known by the server to obtain the first condition parameter ciphertext and the first data set ciphertext; The first transmission module is mounted on the server side and is used to send the encrypted first condition parameter μ1, i.e., the first condition parameter ciphertext and the first data set ciphertext to the client side; The second encryption module is mounted on the client and is used to homomorphically encrypt the second conditional parameter μ2 held by the client and the received first conditional parameter ciphertext to obtain the homomorphic conditional parameter ciphertext; and to encrypt the received first data set ciphertext again to obtain a doubly encrypted second data set ciphertext, and also to encrypt its own third data set; The data obfuscation module is installed on the client and is used to obfuscate the homomorphic condition parameter ciphertext and the second data set ciphertext; The second transmission module is mounted on the client and is used to encrypt the obfuscated homomorphic condition parameter ciphertext and the second data set ciphertext, attach the index value to the third data set, and generate the third data set ciphertext and send it to the server; The third encryption module is installed on the server side and is used to re-encrypt the ciphertext of the third data set to obtain another double-encrypted ciphertext of the fourth data set; The data decryption module is installed on the server side and is used to decrypt the received homomorphic condition parameter ciphertext; The data retrieval module is installed on the server side and is used to determine whether the decrypted homomorphic condition parameters meet the retrieval conditions. If the retrieval condition μ1+μ2=1 is met, the ciphertext of the two double-encrypted data sets is compared to determine whether there is an intersection. Among them, the first condition parameter and the second condition parameter are generated in the following way: the client determines the condition strategy that needs to be met according to the demand for the data set; the client and the server jointly take the first data set of the server as the object and perform condition screening on it one by one; the client and the server execute an interactive size comparison protocol to obtain the first condition parameter mastered by the server and the second condition parameter mastered by the client.

7. The privacy collection request device with conditional retrieval according to claim 6, characterized in that: The device also includes: The third transmission module is installed on the server side and is used to return the corresponding index value to the client side according to the search result of the data search module when the ciphertexts of the two double-encrypted data sets have an intersection.

8. A computer device, characterized in that: The computer comprises: processor; a memory for storing processor-executable instructions; The processor implements the method according to any one of claims 1 to 5 by running the executable instructions.

Images