Method and system for determining the number of shared data for protecting privacy data

Abstract

The embodiments of this specification provide a method and system for determining the number of shared data for protecting private data. The method includes: the first party maps the first private data set to a Bloom filter to obtain a first array; a single private data item corresponds to a position in the Bloom filter; homomorphic encryption is performed on each element in the first array, and the encrypted first ciphertext array is sent to the second party; the second party determines the target position corresponding to each private data in the second private data set in the Bloom filter, extracts the encrypted elements of each target position in the first ciphertext array, and obtains each encrypted value; a homomorphic function operation is performed on each encrypted value to obtain a result ciphertext; the homomorphic function operation is used to aggregate the element values ​​of each target position; the result ciphertext is sent to the first party; the first party decrypts the result ciphertext to obtain the number of shared data between the two parties. It can improve security.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to the field of computers, and more particularly, to a method and system for determining the number of shared data for protecting privacy data. Background Art

[0002] Many current scenarios involve determining the amount of shared data between two parties. Each party's data is considered private and cannot be shared externally. For example, two parties each hold a set and need to determine the size of their intersection without exposing their respective sets. This shared data count can be used to determine the degree of data matching, the number of shared customers, and other scenarios, providing an assessment for continued collaboration. It can also be used for correlation analysis, such as when social security agencies and the Ministry of Education jointly analyze the correlation between low-income families and school dropouts. Because of the need to protect private data, secure multi-party computation is required.

[0003] In the prior art, in the process of determining the number of shared data, some information of the party's private data may be leaked, which may allow the other party to infer the possible values ​​of its private data.

[0004] Therefore, it is hoped that there will be an improved solution that can enhance security in determining the number of shared data to protect private data. Summary of the Invention

[0005] One or more embodiments of this specification describe a method and system for determining the number of shared data for protecting privacy data, which can improve security in determining the number of shared data for protecting privacy data.

[0006] In a first aspect, a method for determining the number of shared data for protecting privacy data is provided, the method comprising:

[0007] The first party maps its first private data set to an m-bit Bloom filter to obtain an m-bit first array; wherein a single private data item corresponds to a position in the Bloom filter;

[0008] The first party performs homomorphic encryption on each element in the first array, and sends the encrypted first ciphertext array to the second party;

[0009] The second party determines a target position in the Bloom filter corresponding to each private data item in the second private data set, extracts the encrypted element at each target position in the first ciphertext array, and obtains each encrypted value;

[0010] The second party performs a homomorphic function operation on each encrypted value to obtain a result ciphertext corresponding to the number of data shared by both parties; the homomorphic function operation is used to aggregate the element values ​​at each target position;

[0011] The second party sends the result ciphertext to the first party;

[0012] The first party decrypts the result ciphertext to obtain the amount of data shared by both parties.

[0013] In a possible implementation, the first party maps the first private data set it has to an m-bit Bloom filter, including:

[0014] The first party calculates a hash value for any private data in the first private data set using a hash function, where the hash value corresponds to a first position in a Bloom filter; the Bloom filter includes elements in m positions, and the initial value of the element in each position is 0;

[0015] The value of an element at the first position corresponding to any private data in the Bloom filter is set to 1 to obtain a first array of m bits.

[0016] Furthermore, the second party determines a target position in the Bloom filter corresponding to each private data in the second private data set, including:

[0017] The second party calculates a hash value for any private data in the second private data set using the hash function, where the hash value corresponds to a target position in the Bloom filter.

[0018] In one possible implementation, the first party performs homomorphic encryption on each element in the first array, including:

[0019] The first party performs homomorphic encryption supporting additive homomorphism on each element in the first array;

[0020] The second party performs a homomorphic function operation on each encrypted value, including:

[0021] The second party performs homomorphic summation on each encrypted value to obtain the result ciphertext.

[0022] In a second aspect, a method for determining the number of shared data for protecting privacy data is provided, the method comprising:

[0023] The first party and the second party map their respective private data sets to an m-bit Bloom filter, obtaining a first array and a second array of m bits, respectively; wherein a single private data item corresponds to a position in the Bloom filter;

[0024] The first party performs obfuscation encryption processing on the elements at each position in the first array to obtain encrypted element groups corresponding to each position;

[0025] The second party obtains m target encryption elements from the first party according to the second array; wherein any target encryption element is an encryption element from the encryption element group at the corresponding position;

[0026] The second party performs aggregation processing on the m target encryption elements to obtain a result of the number of common data in the private data sets of both parties.

[0027] In a possible implementation, the first party and the second party map their respective private data sets to an m-bit Bloom filter, including:

[0028] The first policy calculates a hash value for any private data in the first private data set using a hash function, where the hash value corresponds to a first position in a Bloom filter; the Bloom filter includes elements in m positions, and the initial value of the element in each position is 0;

[0029] The first party sets the value of an element at the first position corresponding to any private data in the Bloom filter to 1, to obtain a first array of m bits;

[0030] The second policy calculates a hash value for any private data in the second private data set using the hash function, where the hash value corresponds to a second position in the Bloom filter; the Bloom filter includes elements in m positions, and the initial value of the element in each position is 0;

[0031] The second party sets the value of an element at a second position corresponding to any private data in the Bloom filter to 1, to obtain a second array of m bits.

[0032] In a possible implementation, the first party performs obfuscation encryption processing on elements at respective positions in the first array, including:

[0033] The first party generates, for any position in the first array, an encryption element group consisting of a first candidate value and a second candidate value, where the first candidate value is the difference between 0 and the first random number, and the second candidate value is the difference between the element value at the position and the first random number;

[0034] The second party obtains m target encryption elements from the first party according to the second array, including:

[0035] The first party transmits the first candidate value or the second candidate value as the target encryption element to the second party for any position in the first array by executing an oblivious transfer protocol with the second party; wherein the second party inputs a selection value, when the selection value is 1, the second party obtains the second candidate value, and when the selection value is 0, the second party obtains the first candidate value, and the selection value is the value of the element at the corresponding position in the second array.

[0036] Furthermore, the second party obtains in advance from the first party the first random number corresponding to each position in the first array, which is a first value;

[0037] The second party performs aggregation processing on the m target encryption elements, including:

[0038] The second party sums the m target encryption elements to obtain a first summation result;

[0039] The second party adds the first summation result to the first value to obtain a second summation result as the number result of the shared data.

[0040] Furthermore, the first party predetermines that the sum of the first random numbers corresponding to the elements in the first array is a first value;

[0041] The second party performs aggregation processing on the m target encryption elements, including:

[0042] The second party sums the m target encryption elements to obtain a first summation result;

[0043] The method further comprises:

[0044] The second party sends the first summation result to the first party;

[0045] The first party adds the first summation result to the first value to obtain a second summation result as the number result of the shared data.

[0046] Furthermore, the second party obtains in advance from the first party the sum of the first random numbers corresponding to the elements in the first array, which is 0;

[0047] The second party performs aggregation processing on the m target encryption elements, including:

[0048] The second party sums the m target encryption elements and obtains a first summation result as the number result of the shared data.

[0049] In a third aspect, a system for determining the number of shared data for protecting privacy data is provided, the system comprising:

[0050] The first party maps its first private data set to an m-bit Bloom filter to obtain an m-bit first array, where a single private data item corresponds to a position in the Bloom filter; performs homomorphic encryption on each element in the first array, and sends the encrypted first ciphertext array to the second party;

[0051] The second party determines a target location in the Bloom filter corresponding to each private data item in the second private data set, extracts the encrypted elements at each target location in the first ciphertext array, and obtains each encrypted value; performs a homomorphic function operation on each encrypted value to obtain a resultant ciphertext corresponding to the number of shared data items; the homomorphic function operation is used to aggregate the element values ​​at each target location; and sends the resultant ciphertext to the first party;

[0052] The first party is further configured to decrypt the result ciphertext to obtain the amount of data shared by both parties.

[0053] In a fourth aspect, a system for determining the number of shared data for protecting privacy data is provided, the system comprising:

[0054] The first party and the second party are configured to map their respective private data sets to an m-bit Bloom filter, thereby obtaining a first array and a second array of m bits, respectively; wherein a single item of private data corresponds to a position in the Bloom filter;

[0055] The first party is further configured to perform obfuscation encryption processing on the elements at each position in the first array to obtain encrypted element groups corresponding to each position;

[0056] The second party is further used to obtain m target encryption elements from the first party based on the second array; wherein any target encryption element comes from an encryption element in the encryption element group at the corresponding position; and the m target encryption elements are aggregated to obtain the number of common data in the private data sets of both parties.

[0057] In a fifth aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute the method of the first aspect or the second aspect.

[0058] In a sixth aspect, a computing device is provided, comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method of the first aspect or the second aspect is implemented.

[0059] According to a method and system provided by an embodiment of this specification, a first party maps its first private data set to an m-bit Bloom filter to obtain an m-bit first array; wherein a single private data item corresponds to a position in the Bloom filter; then the first party performs homomorphic encryption on each element in the first array and sends the encrypted first ciphertext array to the second party; then the second party determines the target position in the Bloom filter corresponding to each private data item in its second private data set, extracts the encrypted elements of each target position in the first ciphertext array, and obtains each encrypted value; then the second party performs a homomorphic function operation on each encrypted value to obtain a result ciphertext corresponding to the number of shared data between the two parties; the homomorphic function operation is used to aggregate the element values ​​of each target position; the second party sends the result ciphertext to the first party; finally, the first party decrypts the result ciphertext to obtain the number of shared data between the two parties. As can be seen from the above, the embodiment of this specification utilizes a Bloom filter with a specific mapping method, under which a single private data item corresponds to a position in the Bloom filter. On this basis, the first party performs homomorphic encryption on each element in the first array, and the second party uses homomorphic function operations to aggregate the element values ​​​​at each target position of the Bloom filter. The decryption result can be the number of shared data between the two parties, avoiding the leakage of additional information, thereby improving security in determining the number of shared data for protecting private data.

[0060] According to another method and system provided by an embodiment of this specification, the first party and the second party first map their respective private data sets to an m-bit Bloom filter, obtaining a first array and a second array of m bits, respectively; wherein a single private data item corresponds to one position in the Bloom filter; then the first party performs obfuscation encryption processing on the elements at each position in the first array, obtaining a group of encrypted elements corresponding to each position; then the second party obtains m target encrypted elements from the first party based on the second array; wherein any target encrypted element comes from an encrypted element in the group of encrypted elements at the corresponding position; finally, the second party performs aggregation processing on the m target encrypted elements to obtain the number of shared data in the private data sets of both parties. As can be seen from the above, the embodiment of this specification utilizes a Bloom filter with a specific mapping method, under which a single private data item corresponds to one position in the Bloom filter. On this basis, the first party performs obfuscation encryption processing on each element in the first array, and the second party selectively obtains m target encryption elements from the first party and aggregates the m target encryption elements. This allows the aggregation result to directly correspond to the number of shared data between the two parties, avoiding the leakage of additional information, thereby improving security in determining the number of shared data for protecting privacy data. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0062] Figure 1 A schematic diagram of an implementation scenario of an embodiment disclosed in this specification;

[0063] Figure 2 An interactive diagram illustrating a method for determining the number of shared data for protecting privacy data according to one embodiment;

[0064] Figure 3 A schematic diagram illustrating a mapping of a Bloom filter according to an embodiment is shown;

[0065] Figure 4 An interactive schematic diagram illustrating a method for determining the number of shared data for protecting privacy data according to another embodiment;

[0066] Figure 5 A schematic block diagram shows a system for determining the number of shared data for protecting privacy data according to one embodiment. DETAILED DESCRIPTION

[0067] The solution provided in this specification is described below in conjunction with the accompanying drawings.

[0068] Figure 1 This is a schematic diagram of an implementation scenario of an embodiment disclosed in this specification. This implementation scenario involves determining the number of shared data for protecting private data, and is used to determine the number of shared data between a first private data set owned by a first party and a second private data set owned by a second party. Figure 1 As shown, the scenario where two parties determine the amount of shared data involves parties A and B, also referred to as the first and second parties, or parties A and B. Each party can be implemented as any device, platform, server, or device cluster with computing and processing capabilities. Both parties must jointly determine the amount of shared data while protecting data privacy.

[0069] Party A holds a set X = {x1, x2...} of n1 private data items, and Party B holds a set Y = {y1, y2...} of n2 private data items. Without exposing each set, the size of the intersection of X and Y is calculated, thereby jointly determining the number of shared data items. For example, if set X = {Xiaoming, Xiaohong, Xiaogang} and set Y = {Xiaoming, Xiaohong, Xiaoyun, Xiaolan}, the size of their intersection is 2.

[0070] In this embodiment, secure multi-party computation is used to determine the amount of shared data that protects private data. This solution is used by two parties, each of which has a private set as input, denoted as X and Y. The two parties want to calculate the size of the intersection of their sets, X∩Y, without revealing the private data contained in their respective sets. In other words, the private data outside the intersection of either party's sets is not disclosed.

[0071] It is understandable that private data can be any data that is not convenient to be made public, including but not limited to data representing the user's personal information, or business secrets, etc.

[0072] Secure multi-party computation, also known as multi-party secure computing, is a method in which multiple parties jointly calculate the result of a function without disclosing the input data of each party in the function, and the result of the calculation is made public to one or more of the parties.

[0073] The embodiments of this specification provide solutions for improving security in determining the number of shared data for protecting private data.

[0074] Figure 2 A schematic diagram illustrating an interactive method for determining the number of shared data for protecting privacy data according to an embodiment of the present invention is shown. The method can be based on Figure 1 In the implementation scenario shown in the figure, the element values ​​at each target position of the Bloom filter are aggregated using homomorphic function operations, thus avoiding the leakage of additional information. Figure 2 As shown, the method for determining the number of shared data for protecting private data in this embodiment includes the following steps: Step 21: The first party maps its first private data set to an m-bit Bloom filter to obtain an m-bit first array; wherein a single private data item corresponds to a position in the Bloom filter; Step 22: The first party performs homomorphic encryption on each element in the first array and sends the encrypted first ciphertext array to the second party; Step 23: The second party determines the target position in the Bloom filter corresponding to each private data item in its second private data set, extracts the encrypted elements of each target position in the first ciphertext array, and obtains each encrypted value; Step 24: The second party performs a homomorphic function operation on each encrypted value to obtain a result ciphertext corresponding to the number of shared data between the two parties; the homomorphic function operation is used to aggregate the element values ​​of each target position; Step 25: The second party sends the result ciphertext to the first party; Step 26: The first party decrypts the result ciphertext to obtain the number of shared data between the two parties. The specific execution methods of each of the above steps are described below.

[0075] First, in step 21, the first party maps its first private data set to an m-bit Bloom filter, resulting in an m-bit first array. Each private data item corresponds to a position in the Bloom filter. It should be understood that a Bloom filter is used to represent the entire set, not just one item within it.

[0076] In one example, the first party maps a first private data set to an m-bit Bloom filter, including:

[0077] The first party calculates a hash value for any private data in the first private data set using a hash function, where the hash value corresponds to a first position in a Bloom filter; the Bloom filter includes elements in m positions, and the initial value of the element in each position is 0;

[0078] The value of an element at the first position corresponding to any private data in the Bloom filter is set to 1 to obtain a first array of m bits.

[0079] Figure 3 FIG. 4 shows a schematic diagram of a Bloom filter mapping according to an embodiment. Figure 3 Private data 1 represents any private data in the first private data set. A hash function is denoted as hash function 1. A Bloom filter is an array consisting of m elements, all of which have an initial value of 0. Data in the set can be mapped sequentially to the Bloom filter using the same mapping method. Taking private data 1 as an example, the position obtained by the above hash function 1 is position 6. The value of the element at this position is set to 1. This is the mapping process for private data 1. The same method can be used to map other private data in the set to the Bloom filter. After the mapping is completed, the Bloom filter can represent the entire set. Whether a piece of data exists in the set can be determined by checking whether the value of the element at the corresponding position in the Bloom filter is 1.

[0080] Then, in step 22, the first party performs homomorphic encryption on each element in the first array and sends the encrypted first ciphertext array to the second party. It is understood that the first party can directly perform homomorphic encryption on each element in the first array, or first perform a predetermined process on each element in the first array and then perform homomorphic encryption on the obtained processed value.

[0081] Homomorphic encryption: Compared to conventional encryption, homomorphic encryption possesses the property of being homomorphic, meaning that calculations can be performed on encrypted data. For example, performing a calculation on the homomorphically encrypted ciphertext E(a) of a and the homomorphically encrypted ciphertext E(b) of b yields the ciphertext E(a+b) of a+b. This calculation does not reveal a, b, or a+b, and does not require a decryption key. This operation is called a homomorphic addition.

[0082] In one example, the first party performs homomorphic encryption on each element in the first array, including:

[0083] The first party performs homomorphic encryption supporting additive homomorphism on each element in the first array;

[0084] In this example, a homomorphic addition operation can be performed on the ciphertext obtained by homomorphic encryption to achieve the aggregation of element values.

[0085] Next, in step 23, the second party determines the target location in the Bloom filter corresponding to each private data item in its second private data set, extracts the encrypted elements at each target location in the first ciphertext array, and obtains the encrypted values. It is understood that the second party can use the same mapping method as the first party to determine the target location.

[0086] In one example, the second party determines a target location in the Bloom filter corresponding to each private data item in the second private data set, including:

[0087] The second party calculates a hash value for any private data in the second private data set using the hash function, where the hash value corresponds to a target position in the Bloom filter.

[0088] It can be understood that the second party and the first party use the same hash function to determine the above-mentioned target positions; after obtaining each target position, the second party does not need to reset the element value of the corresponding position in the Bloom filter, but only uses it to extract the encrypted elements of each target position in the first ciphertext array to obtain each encrypted value.

[0089] Then, in step 24, the second party performs a homomorphic function on each encrypted value to obtain a ciphertext corresponding to the number of shared data points between the two parties. This homomorphic function is used to aggregate the element values ​​at each target position. It is understood that the aggregated result directly corresponds to the number of shared data points between the two parties, thus preventing the leakage of additional information.

[0090] In the embodiments of this specification, the specific operation content of the above-mentioned homomorphic function operation is also related to the meaning represented by the encrypted value. That is, does the first party directly perform homomorphic encryption that supports additive homomorphism on each element in the first array to obtain the encrypted value, or does it perform preset processing on each element in the first array and then perform homomorphic encryption that supports additive homomorphism on the processed value to obtain the encrypted value. Among them, the above-mentioned preset processing method is not unique. The preset processing performed by the first party is an operation on plaintext, and the homomorphic function operation performed by the second party is an operation on ciphertext. The two together achieve an overall operation goal. Part of the total operation can be implemented through plaintext operation, and the other part of the total operation can be implemented through ciphertext operation. There are many possible ways to split the total operation.

[0091] In one example, the first party performs homomorphic encryption supporting additive homomorphism on each element in the first array;

[0092] The second party performs a homomorphic function operation on each encrypted value, including:

[0093] The second party performs homomorphic summation on each encrypted value to obtain the result ciphertext.

[0094] Then, in step 25, the second party sends the result ciphertext to the first party. It can be understood that there is only one result ciphertext, which is independent of the number of private data contained in the second private data set.

[0095] For example, the second private data set includes private data 1, private data 2, and private data 3. Private data 1, private data 2, and private data 3 are used to obtain respective encryption values ​​in step 23, but only one result ciphertext is determined.

[0096] Finally, in step 26, the first party decrypts the result ciphertext to obtain the amount of data shared by both parties. It is understandable that the decryption result directly reflects the amount of data shared by both parties and does not disclose additional information.

[0097] For example, if the number of data shared by both parties is 3, the decryption result is 3; if the number of data shared by both parties is 100, the decryption result is 100. In other words, the number of data shared by both parties can be determined without further statistics on the decryption results.

[0098] According to the method provided in the embodiment of this specification, the first party first maps its first private data set to an m-bit Bloom filter to obtain an m-bit first array; wherein, a single private data corresponds to a position in the Bloom filter; then the first party performs homomorphic encryption on each element in the first array and sends the encrypted first ciphertext array to the second party; then the second party determines the target position corresponding to each private data in its second private data set in the Bloom filter, extracts the encrypted elements of each target position in the first ciphertext array, and obtains each encrypted value; then the second party performs a homomorphic function operation on each encrypted value to obtain a result ciphertext corresponding to the number of shared data between the two parties; the homomorphic function operation is used to aggregate the element values ​​of each target position; the second party sends the result ciphertext to the first party; finally, the first party decrypts the result ciphertext to obtain the number of shared data between the two parties. As can be seen from the above, the embodiment of this specification utilizes a Bloom filter with a specific mapping method, under which a single private data corresponds to a position in the Bloom filter. On this basis, the first party performs homomorphic encryption on each element in the first array, and the second party uses homomorphic function operations to aggregate the element values ​​​​at each target position of the Bloom filter. The decryption result can be the number of shared data between the two parties, avoiding the leakage of additional information, thereby improving security in determining the number of shared data for protecting private data.

[0099] Figure 4 A schematic diagram illustrating an interactive method for determining the number of shared data for protecting privacy data according to another embodiment of the present invention is shown. The method can be based on Figure 1 In the implementation scenario shown, the first party performs obfuscation encryption processing on each element in the first array, and the second party selectively obtains m target encryption elements from the first party and aggregates the m target encryption elements, thereby avoiding leakage of additional information. Figure 4 As shown, the method for determining the number of shared data for protecting private data in this embodiment includes the following steps: Step 41: The first and second parties map their respective private data sets to m-bit Bloom filters, respectively obtaining a first and second m-bit array; wherein a single private data item corresponds to a position in the Bloom filter; Step 42: The first party performs obfuscation encryption on the elements at each position in the first array, obtaining a group of encrypted elements corresponding to each position; Step 43: The second party obtains m target encrypted elements from the first party based on the second array; wherein each target encrypted element is an encrypted element in the group of encrypted elements at the corresponding position; Step 44: The second party aggregates the m target encrypted elements to determine the number of shared data between the two parties' private data sets. The specific implementation of each of the above steps is described below.

[0100] First, in step 41, the first and second parties map their respective private data sets to m-bit Bloom filters, resulting in a first and second m-bit array, respectively. A single item of private data corresponds to a position in the Bloom filter. It should be understood that a Bloom filter is used to represent the entire set, not just one item of data within it.

[0101] In one example, the first party and the second party map their respective private data sets to an m-bit Bloom filter, including:

[0102] The first policy calculates a hash value for any private data in the first private data set using a hash function, where the hash value corresponds to a first position in a Bloom filter; the Bloom filter includes elements in m positions, and the initial value of the element in each position is 0;

[0103] The first party sets the value of an element at the first position corresponding to any private data in the Bloom filter to 1, to obtain a first array of m bits;

[0104] The second policy calculates a hash value for any private data in the second private data set using the hash function, where the hash value corresponds to a second position in the Bloom filter; the Bloom filter includes elements in m positions, and the initial value of the element in each position is 0;

[0105] The second party sets the value of an element at a second position corresponding to any private data in the Bloom filter to 1, to obtain a second array of m bits.

[0106] It can be understood that the first party and the second party use the same hash function in the mapping process. If the first party and the second party both have private data 1, then the value of the element corresponding to position 1 of private data 1 in the first array is 1, and the value of the element corresponding to position 1 of private data 1 in the second array is also 1.

[0107] Then, in step 42, the first party performs obfuscation encryption processing on the elements at each position in the first array to obtain an encrypted element group corresponding to each position. It is understandable that the encrypted element group contains at least one encrypted element.

[0108] In one example, the first party performs obfuscation encryption processing on elements at various positions in the first array, including:

[0109] The first party generates an encryption element group consisting of a first candidate value and a second candidate value for any position in the first array, wherein the first candidate value is the difference between 0 and a first random number, and the second candidate value is the difference between the element value at the position and the first random number.

[0110] It is understood that for the same position, the random number used to generate the first candidate value is the same as the random number used to generate the second candidate value; for different positions, the random numbers used to generate candidate values ​​are usually different. For example, if the random number corresponding to position 1 is a and the element value at position 1 is 1, then the first candidate value corresponding to position 1 is 0-a, and the second candidate value corresponding to position 1 is 1-a; if the random number corresponding to position 2 is b and the element value at position 2 is 0, then the first candidate value corresponding to position 2 is 0-b, and the second candidate value corresponding to position 2 is 0-b.

[0111] Next, at step 43, the second party obtains m target encrypted elements from the first party based on the second array; each target encrypted element is an encrypted element from the group of encrypted elements at the corresponding position. It will be appreciated that the second array contains m elements, i.e., m positions, and the second party obtains an encrypted element from the group of encrypted elements at the corresponding position based on the value of the element at each position in the second array.

[0112] Corresponding to the obfuscated encryption processing method in the aforementioned example, in one example, the second party obtains m target encryption elements from the first party according to the second array, including:

[0113] The first party transmits the first candidate value or the second candidate value as the target encryption element to the second party for any position in the first array by executing an oblivious transfer protocol with the second party; wherein the second party inputs a selection value, when the selection value is 1, the second party obtains the second candidate value, and when the selection value is 0, the second party obtains the first candidate value, and the selection value is the value of the element at the corresponding position in the second array.

[0114] In the embodiments of this specification, the above-mentioned oblivious transfer (OT) protocol can be replaced by the private information retrieval (PIR) protocol. OT and PIR are two cryptographic technologies with similar functions. In the OT protocol, there are two roles, sender and receiver. The sender has two or more data. The result of the execution of the protocol is: the receiver obtains a piece of data from the sender, but the sender cannot know which piece of data the receiver obtains. The PIR protocol has two roles, database server and user. The result of the execution of the protocol is: the user obtains a piece of data from the database, but the database server cannot know which piece of data the user obtains. The database server and user in the PIR protocol can correspond to the sender and receiver in the OT protocol respectively. Although OT and PIR have similar functions, they have different application scenarios, so there are significant differences in the protocol design. The appropriate protocol can be selected according to the specific application scenario.

[0115] Finally, in step 44, the second party aggregates the m target encrypted elements to obtain the number of shared data in the private data sets of both parties. It is understood that the aggregated result directly reflects the number of shared data between the two parties and does not leak additional information.

[0116] In one example, the second party obtains in advance from the first party the first random number corresponding to each position in the first array, which is a first value;

[0117] The second party performs aggregation processing on the m target encryption elements, including:

[0118] The second party sums the m target encryption elements to obtain a first summation result;

[0119] The second party adds the first summation result to the first value to obtain a second summation result as the number result of the shared data.

[0120] In this example, the first random number corresponding to each position can be generated completely randomly.

[0121] In one example, the first party predetermines that the sum of the first random numbers corresponding to the elements in the first array is a first value;

[0122] The second party performs aggregation processing on the m target encryption elements, including:

[0123] The second party sums the m target encryption elements to obtain a first summation result;

[0124] The method further comprises:

[0125] The second party sends the first summation result to the first party;

[0126] The first party adds the first summation result to the first value to obtain a second summation result as the number result of the shared data.

[0127] In this example, the first random number corresponding to each position can be generated completely randomly.

[0128] In one example, the second party obtains in advance from the first party that the sum of the first random numbers corresponding to the elements in the first array is 0;

[0129] The second party performs aggregation processing on the m target encryption elements, including:

[0130] The second party sums the m target encryption elements and obtains a first summation result as the number result of the shared data.

[0131] In this example, the first random numbers corresponding to each position must meet certain constraints on the basis of random generation, that is, the sum of the first random numbers corresponding to each element in the first array is 0.

[0132] According to the method provided in the embodiments of this specification, the first party and the second party first map their respective private data sets to an m-bit Bloom filter, obtaining a first array and a second array of m bits, respectively; wherein a single private data item corresponds to one position in the Bloom filter; then the first party performs obfuscation encryption processing on the elements at each position in the first array, obtaining a group of encrypted elements corresponding to each position; then the second party obtains m target encrypted elements from the first party based on the second array; wherein any target encrypted element comes from an encrypted element in the group of encrypted elements at the corresponding position; finally, the second party performs aggregation processing on the m target encrypted elements to obtain the number of shared data in the private data sets of both parties. As can be seen from the above, the embodiments of this specification utilize a Bloom filter with a specific mapping method, under which a single private data item corresponds to one position in the Bloom filter. On this basis, the first party performs obfuscation encryption processing on each element in the first array, and the second party selectively obtains m target encryption elements from the first party and aggregates the m target encryption elements. This allows the aggregation result to directly correspond to the number of shared data between the two parties, avoiding the leakage of additional information, thereby improving security in determining the number of shared data for protecting privacy data.

[0133] According to another embodiment, a system for determining the number of shared data for protecting privacy data is provided. The system is used to execute the method of the present invention. Figure 2 The method provided by the illustrated embodiment. Figure 5 FIG. 1 is a schematic block diagram of a system for determining the number of shared data for protecting privacy data according to an embodiment. Figure 5 As shown, the system 500 includes:

[0134] The first party 51 maps its first private data set to an m-bit Bloom filter to obtain an m-bit first array, where a single private data item corresponds to a position in the Bloom filter. The first party 51 performs homomorphic encryption on each element in the first array and sends the encrypted first ciphertext array to the second party 52.

[0135] The second party 52 is configured to determine a target position in the Bloom filter corresponding to each private data item in the second private data set, extract the encrypted elements at each target position in the first ciphertext array, and obtain each encrypted value; perform a homomorphic function operation on each encrypted value to obtain a result ciphertext corresponding to the number of shared data items between the two parties; the homomorphic function operation is used to aggregate the element values ​​at each target position; and send the result ciphertext to the first party 51;

[0136] The first party 51 is further configured to decrypt the result ciphertext to obtain the amount of data shared by both parties.

[0137] Optionally, as an embodiment, the first party 51 is specifically used to calculate a hash value for any privacy data in the first privacy data set through a hash function, and the hash value corresponds to a first position in the Bloom filter; the Bloom filter includes elements at m positions, and the initial value of the element at each position is 0; the value of the element at the first position corresponding to any privacy data in the Bloom filter is set to 1 to obtain a first array of m bits.

[0138] Furthermore, the second party 52 is specifically configured to calculate a hash value for any private data in the second private data set by using the hash function, where the hash value corresponds to a target position in the Bloom filter.

[0139] Optionally, as an embodiment, the first party 51 is specifically configured to perform homomorphic encryption supporting additive homomorphism on each element in the first array;

[0140] The second party 52 is specifically configured to perform homomorphic summation on each encrypted value to obtain the result ciphertext.

[0141] According to another embodiment, another system for determining the number of shared data for protecting privacy data is provided, wherein the system is used to execute the method of the present invention. Figure 4 The method provided in the embodiment shown. Figure 5 Schematic block diagram of a system for determining the number of shared data for protecting privacy data, the system 500 includes:

[0142] The first party 51 and the second party 52 are configured to map their respective private data sets to an m-bit Bloom filter, thereby obtaining a first array and a second array of m bits, respectively; wherein a single private data item corresponds to a position in the Bloom filter;

[0143] The first party 51 is further configured to perform obfuscation encryption processing on the elements at each position in the first array to obtain an encrypted element group corresponding to each position;

[0144] The second party 52 is further used to obtain m target encryption elements from the first party 51 according to the second array; wherein any target encryption element comes from an encryption element in the encryption element group at the corresponding position; and the m target encryption elements are aggregated to obtain the number of common data in the private data sets of both parties.

[0145] Optionally, as an embodiment, the first party 51 is specifically configured to calculate a hash value for any private data in the first private data set using a hash function, where the hash value corresponds to a first position in a Bloom filter; the Bloom filter includes elements in m positions, and the initial value of the element in each position is 0; the value of the element in the first position corresponding to any private data in the Bloom filter is set to 1, thereby obtaining an m-bit first array;

[0146] The second party 52 is specifically configured to calculate a hash value for any private data in the second private data set it possesses through the hash function, where the hash value corresponds to a second position in the Bloom filter; the Bloom filter includes elements at m positions, and the initial value of the element at each position is 0; the value of the element at the second position corresponding to any private data in the Bloom filter is set to 1, thereby obtaining a second array of m bits.

[0147] Optionally, as an embodiment, the first party 51 is specifically configured to generate, for any position in the first array, an encryption element group consisting of a first candidate value and a second candidate value, where the first candidate value is the difference between 0 and the first random number, and the second candidate value is the difference between the element value at the position and the first random number;

[0148] The first party 51 is specifically used to transfer the first candidate value or the second candidate value as the target encryption element to the second party 52 for any position in the first array by executing an oblivious transfer protocol with the second party 52; wherein, the second party 52 inputs a selection value, when the selection value is 1, the second party 52 obtains the second candidate value, and when the selection value is 0, the second party 52 obtains the first candidate value, and the selection value is the value of the element at the corresponding position of the second array.

[0149] Furthermore, the second party 52 obtains in advance from the first party the sum of the first random numbers corresponding to the respective positions in the first array as a first value;

[0150] The second party 52 is specifically configured to sum the m target encryption elements to obtain a first summation result; and add the first summation result to the first value to obtain a second summation result as the number result of the shared data.

[0151] Furthermore, the first party 51 predetermines that the sum of the first random numbers corresponding to the elements in the first array is a first value;

[0152] The second party 52 is specifically configured to sum the m target encryption elements to obtain a first summation result;

[0153] The second party 52 is further configured to send the first summation result to the first party 51;

[0154] The first party 51 is further configured to add the first summation result to the first value to obtain a second summation result as the number result of the shared data.

[0155] Furthermore, the second party 52 obtains in advance from the first party 51 the sum of the first random numbers corresponding to the elements in the first array, which is 0;

[0156] The second party 52 is specifically configured to sum the m target encryption elements and obtain a first summation result as the number result of the shared data.

[0157] According to another embodiment, there is also provided a computer readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute a combination of Figure 2 or Figure 4 The method described.

[0158] According to another embodiment, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the system realizes the combination of Figure 2 or Figure 4The method described.

[0159] Those skilled in the art will appreciate that, in one or more of the above examples, the functions described herein may be implemented using hardware, software, firmware, or any combination thereof. When implemented using software, these functions may be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0160] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent replacements, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for determining the number of shared data for protecting privacy data, the method comprising: The first party maps its first private data set to an m-bit Bloom filter to obtain an m-bit first array; wherein a single private data item corresponds to a position in the Bloom filter; The first party performs homomorphic encryption on each element in the first array, and sends the encrypted first ciphertext array to the second party; The second party determines a target position in the Bloom filter corresponding to each private data item in the second private data set, extracts the encrypted element at each target position in the first ciphertext array, and obtains each encrypted value; The second party performs a homomorphic function operation on each encrypted value to obtain a result ciphertext corresponding to the number of data shared by both parties; the homomorphic function operation is used to aggregate the element values ​​at each target position; The second party sends the result ciphertext to the first party; The first party decrypts the result ciphertext to obtain the amount of data shared by both parties.

2. The method according to claim 1, wherein The first party maps a first private data set it has to an m-bit Bloom filter, including: The first party calculates a hash value for any private data in the first private data set using a hash function, where the hash value corresponds to a first position in a Bloom filter; the Bloom filter includes elements in m positions, and the initial value of the element in each position is 0; The value of an element at the first position corresponding to any private data in the Bloom filter is set to 1 to obtain a first array of m bits.

3. The method according to claim 2, wherein: The second party determines a target position in the Bloom filter corresponding to each private data item in the second private data set, including: The second party calculates a hash value for any private data in the second private data set using the hash function, where the hash value corresponds to a target position in the Bloom filter.

4. The method according to claim 1, wherein The first party performs homomorphic encryption on each element in the first array, including: The first party performs homomorphic encryption supporting additive homomorphism on each element in the first array; The second party performs a homomorphic function operation on each encrypted value, including: The second party performs homomorphic summation on each encrypted value to obtain the result ciphertext.

5. A method for determining the number of shared data for protecting privacy data, the method comprising: The first party and the second party map their respective private data sets to an m-bit Bloom filter, obtaining a first array and a second array of m bits, respectively; wherein a single private data item corresponds to a position in the Bloom filter; The first party performs obfuscation encryption processing on the elements at each position in the first array to obtain encrypted element groups corresponding to each position; The second party obtains m target encryption elements from the first party according to the second array; wherein any target encryption element is an encryption element from the encryption element group at the corresponding position; The second party performs aggregation processing on the m target encryption elements to obtain a result of the number of common data in the private data sets of both parties.

6. The method according to claim 5, wherein: The first party and the second party map their respective private data sets to an m-bit Bloom filter, including: The first policy calculates a hash value for any private data in the first private data set using a hash function, where the hash value corresponds to a first position in a Bloom filter; the Bloom filter includes elements in m positions, and the initial value of the element in each position is 0; The first party sets the value of an element at the first position corresponding to any private data in the Bloom filter to 1, to obtain a first array of m bits; The second policy calculates a hash value for any private data in the second private data set using the hash function, where the hash value corresponds to a second position in the Bloom filter; the Bloom filter includes elements in m positions, and the initial value of the element in each position is 0; The second party sets the value of an element at a second position corresponding to any private data in the Bloom filter to 1, to obtain a second array of m bits.

7. The method according to claim 5, wherein: The first party performs obfuscation encryption processing on the elements at each position in the first array, including: The first party generates, for any position in the first array, an encryption element group consisting of a first candidate value and a second candidate value, where the first candidate value is the difference between 0 and the first random number, and the second candidate value is the difference between the element value at the position and the first random number; The second party obtains m target encryption elements from the first party according to the second array, including: The first party transmits the first candidate value or the second candidate value as the target encryption element to the second party for any position in the first array by executing an oblivious transfer protocol with the second party; wherein the second party inputs a selection value, when the selection value is 1, the second party obtains the second candidate value, and when the selection value is 0, the second party obtains the first candidate value, and the selection value is the value of the element at the corresponding position in the second array.

8. The method of claim 7, wherein: The second party obtains in advance from the first party the first random number corresponding to each position in the first array, which is a first value; The second party performs aggregation processing on the m target encryption elements, including: The second party sums the m target encryption elements to obtain a first summation result; The second party adds the first summation result to the first value to obtain a second summation result as the number result of the shared data.

9. The method of claim 7, wherein: The first party predetermines that the sum of the first random numbers corresponding to the elements in the first array is a first value; The second party performs aggregation processing on the m target encryption elements, including: The second party sums the m target encryption elements to obtain a first summation result; The method further comprises: The second party sends the first summation result to the first party; The first party adds the first summation result to the first value to obtain a second summation result as the number result of the shared data.

10. The method of claim 7, wherein: The second party obtains in advance from the first party the first random numbers corresponding to the elements in the first array, which is 0; The second party performs aggregation processing on the m target encryption elements, including: The second party sums the m target encryption elements and obtains a first summation result as the number result of the shared data.

11. A system for determining the number of shared data for protecting privacy data, the system comprising: The first party maps its first private data set to an m-bit Bloom filter to obtain an m-bit first array, where a single private data item corresponds to a position in the Bloom filter; performs homomorphic encryption on each element in the first array, and sends the encrypted first ciphertext array to the second party; The second party determines a target location in the Bloom filter corresponding to each private data item in the second private data set, extracts the encrypted elements at each target location in the first ciphertext array, and obtains each encrypted value; performs a homomorphic function operation on each encrypted value to obtain a resultant ciphertext corresponding to the number of shared data items; the homomorphic function operation is used to aggregate the element values ​​at each target location; and sends the resultant ciphertext to the first party; The first party is further configured to decrypt the result ciphertext to obtain the amount of data shared by both parties.

12. The system of claim 11, wherein: The first party is specifically used to calculate a hash value for any private data in the first private data set through a hash function, where the hash value corresponds to a first position in a Bloom filter; the Bloom filter includes elements in m positions, and the initial value of the element in each position is 0; the value of the element in the first position corresponding to any private data in the Bloom filter is set to 1, thereby obtaining a first array of m bits.

13. The system of claim 12, wherein: The second party is specifically configured to calculate a hash value using the hash function for any private data in the second private data set, where the hash value corresponds to a target position in the Bloom filter.

14. The system of claim 11, wherein: The first party is specifically configured to perform homomorphic encryption supporting additive homomorphism on each element in the first array; The second party is specifically used to perform homomorphic summation on each encrypted value to obtain the result ciphertext.

15. A system for determining the number of shared data for protecting privacy data, the system comprising: The first party and the second party are configured to map their respective private data sets to an m-bit Bloom filter, thereby obtaining a first array and a second array of m bits, respectively; wherein a single item of private data corresponds to a position in the Bloom filter; The first party is further configured to perform obfuscation encryption processing on the elements at each position in the first array to obtain encrypted element groups corresponding to each position; The second party is further used to obtain m target encryption elements from the first party based on the second array; wherein any target encryption element comes from an encryption element in the encryption element group at the corresponding position; and the m target encryption elements are aggregated to obtain the number of common data in the private data sets of both parties.

16. The system of claim 15, wherein: The first party is specifically configured to calculate a hash value for any private data in the first private data set using a hash function, where the hash value corresponds to a first position in a Bloom filter; the Bloom filter includes elements in m positions, and the initial value of the element in each position is 0; and the value of the element in the first position corresponding to any private data in the Bloom filter is set to 1, thereby obtaining a first array of m bits; The second party is specifically used to calculate a hash value for any private data in the second private data set it has through the hash function, and the hash value corresponds to a second position in the Bloom filter; the Bloom filter includes elements in m positions, and the initial value of the element in each position is 0; the value of the element in the second position corresponding to any private data in the Bloom filter is set to 1, so as to obtain a second array of m bits.

17. The system of claim 15, wherein: The first party is specifically configured to generate, for any position in the first array, an encryption element group consisting of a first candidate value and a second candidate value, where the first candidate value is the difference between 0 and the first random number, and the second candidate value is the difference between the element value at the position and the first random number; The first party is specifically used to transfer the first candidate value or the second candidate value as the target encryption element to the second party for any position in the first array by executing an oblivious transfer protocol with the second party; wherein the second party inputs a selection value, when the selection value is 1, the second party obtains the second candidate value, and when the selection value is 0, the second party obtains the first candidate value, and the selection value is the value of the element at the corresponding position in the second array.

18. The system of claim 17, wherein: The second party obtains in advance from the first party the first random number corresponding to each position in the first array, which is a first value; The second party is specifically used to sum the m target encryption elements to obtain a first summation result; add the first summation result to the first value to obtain a second summation result as the number result of the shared data.

19. The system of claim 17, wherein: The first party predetermines that the sum of the first random numbers corresponding to the elements in the first array is a first value; The second party is specifically configured to sum the m target encryption elements to obtain a first summation result; The second party is further configured to send the first summation result to the first party; The first party is further configured to add the first summation result to the first value to obtain a second summation result as the number result of the shared data.

20. The system of claim 17, wherein: The second party obtains in advance from the first party the first random numbers corresponding to the elements in the first array, which is 0; The second party is specifically configured to sum the m target encryption elements and obtain a first summation result as the number result of the shared data.

21. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 10.

22. A computing device comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method according to any one of claims 1 to 10 is implemented.

Images