Common data number determination method, device and system for protecting privacy data

Abstract

The embodiment of the specification provides a common data number determination method, device and system for protecting privacy data, which is realized by secure multi-party computation, and the method comprises the following steps: a first party maps a privacy data set owned by the first party to a Bloom filter to obtain a first array of m bits; homomorphic encryption is performed on each element in the first array, and a first ciphertext array obtained by the encryption is sent to a second party; the second party determines k target positions of any privacy data owned by the second party in the Bloom filter, extracts encrypted elements of the k target positions in the first ciphertext array to obtain k encrypted values; homomorphic function operation is performed on the k encrypted values to obtain corresponding result ciphertexts; the homomorphic function operation is used for converging element values of the k target positions and performing random number masking on a convergence result; the result ciphertexts are sent to the first party; and the first party decrypts the result ciphertexts to determine a number of common data of the two parties. The security can be improved.

Description

TECHNICAL FIELD

[0001] One or more embodiments of the present specification relate to the field of computer, and particularly relate to a common data number determination method, device and system for protecting privacy data. BACKGROUND

[0002] In many current scenarios, the determination of the number of common data of two parties is involved, and the data of each party belongs to privacy data and cannot be exported. For example, each party holds a set, and needs to determine the size of the intersection set without exposing their own set. The number of common data can be used to determine the matching degree of the data of the two parties, the number of common customers, and other scenarios, which provides an evaluation for the two parties to continue cooperation. It can also be used for correlation analysis, such as joint analysis of the correlation between low-income families and dropouts by the social security agency and the Ministry of Education. Since the privacy data needs to be protected, secure multi-party computation needs to be used to achieve it.

[0003] In the prior art, in the process of determining the number of common data, some information of the privacy data of the party is leaked, so that the other party can infer the possible value of the privacy data.

[0004] Therefore, it is desirable to have an improved solution to improve security in the determination of the number of common data of the privacy data. SUMMARY

[0005] One or more embodiments of the present specification describe a common data number determination method, device and system for protecting privacy data, which can improve security in the determination of the number of common data of the privacy data.

[0006] In a first aspect, a common data number determination method for protecting privacy data is provided, and the method comprises:

[0007] The first party maps a first set of privacy data that it has to a Bloom filter of m bits to obtain a first array of m bits; wherein a single privacy data corresponds to k positions in the Bloom filter;

[0008] The first party homomorphically encrypts each element in the first array, and sends the first ciphertext array obtained by encryption to the second party;

[0009] The second party determines k target positions of any privacy data in a second set of privacy data that it has in the Bloom filter, extracts the encrypted elements of the k target positions in the first ciphertext array to obtain k encrypted values;

[0010] The second party performs homomorphic function operation on the k encrypted values to obtain a result ciphertext corresponding to the any privacy data; the homomorphic function operation is used to aggregate the element values of the k target positions, and the aggregation result is masked by a random number;

[0011] The second party sends the result ciphertext corresponding to each privacy data in the second privacy data set to the first party respectively;

[0012] The first party decrypts each result ciphertext, and determines the number of the common data of the two parties according to the statistical result of the predetermined value in each decrypted result.

[0013] In a possible implementation, the first party maps the first privacy data set possessed by the first party to a Bloom filter of m bits, including:

[0014] The first party calculates k hash values respectively through k hash functions for any privacy data in the first privacy data set, each hash value corresponding to a position in the Bloom filter; the Bloom filter includes m elements, and the initial values of the elements are all 0;

[0015] The element values of the k positions corresponding to any privacy data in the Bloom filter are set to 1 to obtain a first array of m bits.

[0016] In a possible implementation, the first party performs homomorphic encryption on each element in the first array, including:

[0017] The first party performs homomorphic encryption supporting homomorphism of addition on each element in the first array;

[0018] The second party performs homomorphic function operation on the k encrypted values, including:

[0019] The second party performs homomorphic summation on the k encrypted values to obtain a first ciphertext convergence result;

[0020] The second party homomorphic subtracts k from the first ciphertext convergence result to obtain a second ciphertext convergence result;

[0021] The second party homomorphic multiplies the second ciphertext convergence result by a random number to obtain the result ciphertext corresponding to the any privacy data.

[0022] In a possible implementation, the first party performs homomorphic encryption on each element in the first array, including:

[0023] The first party takes each element in the first array as a subtrahend respectively, takes 1 as a minuend, and obtains a processing value corresponding to each element respectively through subtraction operation;

[0024] The first party performs homomorphic encryption supporting homomorphism of addition on each processing value;

[0025] The second party performs homomorphic function operation on the k encrypted values, including:

[0026] The second party homomorphically sums the k encrypted values to obtain a third ciphertext aggregation result;

[0027] The second party homomorphically multiplies the third ciphertext aggregation result by a random number to obtain a result ciphertext corresponding to the any privacy data.

[0028] In a possible implementation, when the element values of the k target positions are all 1, the value of the decryption result is the predetermined value; when the element values of the k target positions are at least one 0, the value of the decryption result is a random value.

[0029] In a possible implementation, the predetermined value is 0.

[0030] In a second aspect, a common data number determination method for protecting privacy data is provided, and the method comprises the following steps.

[0031] The second party obtains a first ciphertext array from the first party; the first ciphertext array is obtained by the first party mapping a first privacy data set owned by the first party to an m-bit Bloom filter to obtain an m-bit first array, and then homomorphically encrypting each element in the first array, wherein a single privacy data corresponds to k positions in the Bloom filter;

[0032] The second party determines k target positions of any privacy data in a second privacy data set owned by the second party in the Bloom filter, extracts encrypted elements of the k target positions in the first ciphertext array to obtain k encrypted values;

[0033] The second party performs homomorphic function operation on the k encrypted values to obtain a result ciphertext corresponding to the any privacy data; the homomorphic function operation is used to aggregate element values of the k target positions and to mask the aggregation result with a random number;

[0034] The second party sends the result ciphertexts corresponding to each privacy data in the second privacy data set to the first party, so that the first party decrypts each result ciphertext and determines the number of common data between the two parties according to a statistical result of a predetermined value in each decryption result.

[0035] In a possible implementation, the homomorphic function operation performed by the second party on the k encrypted values comprises:

[0036] The second party homomorphically sums the k encrypted values to obtain a first ciphertext aggregation result;

[0037] The second party homomorphically subtracts k from the first ciphertext aggregation result to obtain a second ciphertext aggregation result;

[0038] The second party homomorphically multiplies the second ciphertext aggregation result by a random number to obtain a result ciphertext corresponding to any privacy data.

[0039] In a possible implementation, the second party performs homomorphic function operation on the k encrypted values, including:

[0040] The second party performs homomorphic summation on the k encrypted values to obtain a third ciphertext aggregation result.

[0041] The second party homomorphically multiplies the third ciphertext aggregation result by a random number to obtain a result ciphertext corresponding to any privacy data.

[0042] In a third aspect, a common data number determination system for protecting privacy data is provided, and the system includes:

[0043] A first party is configured to map a first set of privacy data owned by the first party to an m-bit Bloom filter to obtain an m-bit first array, wherein a single privacy data corresponds to k positions in the Bloom filter; perform homomorphic encryption on each element in the first array, and send a first ciphertext array obtained by the encryption to a second party.

[0044] The second party is configured to determine k target positions of any privacy data in a second set of privacy data owned by the second party in the Bloom filter, extract encrypted elements of the k target positions in the first ciphertext array to obtain k encrypted values, perform homomorphic function operation on the k encrypted values to obtain a result ciphertext corresponding to the any privacy data, wherein the homomorphic function operation is configured to aggregate element values of the k target positions and perform random number masking on the aggregation result, and send the result ciphertext corresponding to each privacy data in the second set of privacy data to the first party.

[0045] The first party is further configured to decrypt each result ciphertext, and determine a number of common data of the two parties according to a statistical result of a predetermined value in each decrypted result.

[0046] In a fourth aspect, a common data number determination apparatus for protecting privacy data is provided, and the apparatus is arranged in a second party and includes:

[0047] An obtaining unit is configured to obtain a first ciphertext array from a first party, wherein the first ciphertext array is obtained by the first party as follows: mapping a first set of privacy data owned by the first party to an m-bit Bloom filter to obtain an m-bit first array, and performing homomorphic encryption on each element in the first array, wherein a single privacy data corresponds to k positions in the Bloom filter.

[0048] The extraction unit is configured to determine any privacy data in the second set of privacy data owned by the extraction unit at the k target positions in the Bloom filter, extract encrypted elements at the k target positions in the first array of ciphertexts obtained by the obtaining unit, and obtain k encrypted values;

[0049] The operation unit is configured to perform homomorphic function operation on the k encrypted values obtained by the extraction unit, and obtain result ciphertexts corresponding to the any privacy data; the homomorphic function operation is configured to aggregate element values at the k target positions and perform random number masking on the aggregated result.

[0050] The sending unit is configured to send the result ciphertexts corresponding to each privacy data in the second set of privacy data respectively to the first party, so that the first party decrypts each result ciphertext and determines the number of common data owned by both parties according to a statistical result of predetermined values in each decrypted result.

[0051] In a fifth aspect, a computer-readable storage medium is provided, and the computer-readable storage medium stores a computer program. When the computer program is executed in a computer, the computer program causes the computer to execute the method in the first aspect or the second aspect.

[0052] In a sixth aspect, a computing device is provided, and the computing device includes a memory and a processor. The memory stores executable code, and the processor executes the executable code to implement the method in the first aspect or the second aspect.

[0053] By the method, device and system provided in the embodiments of the present specification, first, the first party maps a first set of privacy data owned by the first party to a Bloom filter of m bits to obtain a first array of m bits; wherein a single privacy data corresponds to k positions in the Bloom filter; then the first party performs homomorphic encryption on each element in the first array, and sends a first array of ciphertexts obtained by encryption to the second party; then the second party determines any privacy data in a second set of privacy data owned by the second party at the k target positions in the Bloom filter, extracts encrypted elements at the k target positions in the first array of ciphertexts, and obtains k encrypted values; then the second party performs homomorphic function operation on the k encrypted values to obtain result ciphertexts corresponding to the any privacy data; the homomorphic function operation is configured to aggregate element values at the k target positions and perform random number masking on the aggregated result; the second party sends the result ciphertexts corresponding to each privacy data in the second set of privacy data respectively to the first party; finally, the first party decrypts each result ciphertext, and determines the number of common data owned by both parties according to a statistical result of predetermined values in each decrypted result. As can be seen from the above, by the way of aggregating Bloom filter element values and masking with random numbers, the embodiments of the present specification can make the decrypted result either a predetermined value or a random value, avoid the leakage of additional information, and thus can improve the security in the determination of the number of common data of the privacy data. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0055] Figure 1 A schematic diagram of an implementation scenario of an embodiment disclosed in this specification;

[0056] Figure 2 An interactive diagram illustrating a method for determining the number of shared data for protecting privacy data according to one embodiment;

[0057] Figure 3 A schematic diagram illustrating a mapping of a Bloom filter according to an embodiment is shown;

[0058] Figure 4 An interactive schematic diagram illustrating a method for determining the number of shared data for protecting privacy data according to another embodiment;

[0059] Figure 5 An interactive schematic diagram illustrating a method for determining the number of shared data for protecting privacy data according to another embodiment;

[0060] Figure 6 A schematic block diagram illustrating an apparatus for determining the number of shared data for protecting privacy data according to an embodiment;

[0061] Figure 7 A schematic block diagram shows a system for determining the number of shared data for protecting privacy data according to one embodiment. DETAILED DESCRIPTION

[0062] The solution provided in this specification is described below in conjunction with the accompanying drawings.

[0063] Figure 1 This is a schematic diagram of an implementation scenario of an embodiment disclosed in this specification. This implementation scenario involves determining the number of shared data for protecting private data, and is used to determine the number of shared data between a first private data set owned by a first party and a second private data set owned by a second party. Figure 1 As shown, the scenario where two parties determine the amount of shared data involves parties A and B, also referred to as the first and second parties, or parties A and B. Each party can be implemented as any device, platform, server, or device cluster with computing and processing capabilities. Both parties must jointly determine the amount of shared data while protecting data privacy.

[0064] Party A holds a set X = {x1, x2...} of n1 private data items, and Party B holds a set Y = {y1, y2...} of n2 private data items. Without exposing each set, the size of the intersection of X and Y is calculated, thereby jointly determining the number of shared data items. For example, if set X = {Xiaoming, Xiaohong, Xiaogang} and set Y = {Xiaoming, Xiaohong, Xiaoyun, Xiaolan}, the size of their intersection is 2.

[0065] In this embodiment, secure multi-party computation is used to determine the amount of shared data that protects private data. This solution is used by two parties, each of which has a private set as input, denoted as X and Y. The two parties want to calculate the size of the intersection of their sets, X∩Y, without revealing the private data contained in their respective sets. In other words, the private data outside the intersection of either party's sets is not disclosed.

[0066] It is understandable that private data can be any data that is not convenient to be made public, including but not limited to data representing the user's personal information, or business secrets, etc.

[0067] Secure multi-party computation, also known as multi-party secure computing, is a method in which multiple parties jointly calculate the result of a function without disclosing the input data of each party in the function, and the result of the calculation is made public to one or more of the parties.

[0068] The embodiments of this specification provide solutions for improving security in determining the number of shared data for protecting private data.

[0069] Figure 2 A schematic diagram illustrating an interactive method for determining the number of shared data for protecting privacy data according to an embodiment of the present invention is shown. The method can be based on Figure 1 The implementation scenario shown in Figure 2As shown, the common data number determination method for protecting privacy data in the embodiment includes the following steps: step 21, the first party maps a first privacy data set owned by the first party to an m-bit Bloom filter to obtain an m-bit first array; wherein a single privacy data corresponds to k positions in the Bloom filter; step 22, the first party homomorphically encrypts each element in the first array, and sends the first ciphertext array obtained by the encryption to the second party; step 23, the second party determines k target positions of any privacy data in a second privacy data set owned by the second party in the Bloom filter, extracts the encrypted elements of the k target positions in the first ciphertext array to obtain k encrypted values; step 24, the second party performs homomorphic function operation on the k encrypted values to obtain the result ciphertext corresponding to the any privacy data; the homomorphic function operation is used to converge the element values of the k target positions, and the convergence result is masked by a random number; step 25, the second party sends the result ciphertext corresponding to each privacy data in the second privacy data set to the first party; step 26, the first party decrypts each result ciphertext, and determines the number of common data of the two parties according to the statistical result of the predetermined values in each decrypted result. The specific execution mode of each of the above steps is described below.

[0070] Firstly, in step 21, the first party maps a first privacy data set owned by the first party to an m-bit Bloom filter to obtain an m-bit first array; wherein a single privacy data corresponds to k positions in the Bloom filter. It can be understood that the Bloom filter is used to represent the entire set, not just one data in the set.

[0071] In one example, the first party maps a first privacy data set owned by the first party to an m-bit Bloom filter, including:

[0072] The first party calculates k hash values for any privacy data in the first privacy data set by k hash functions respectively, each hash value corresponding to a position in the Bloom filter; the Bloom filter includes m elements, and the initial values of the elements are all 0;

[0073] The element values of the k positions corresponding to any privacy data in the Bloom filter are set to 1 to obtain an m-bit first array.

[0074] It can be understood that the above k hash functions are usually different, and accordingly, the k positions obtained by the k hash functions for any privacy data are also different.

[0075] Figure 3 A mapping schematic diagram of a Bloom filter according to one embodiment is shown. Referring to Figure 3, the privacy data 1 represents any privacy data in the first privacy data set, the value of k is 3, the k hash functions are hash function 1, hash function 2 and hash function 3 respectively, the Bloom filter is an array, which includes m elements, and the initial values of the elements are all 0. The data in the set can be mapped to the Bloom filter in the same way. Taking the privacy data 1 as an example, through the above hash function 1, hash function 2 and hash function 3, the three positions obtained are position 0, position 6 and position 12, and the element values of the three positions are set to 1. This is the mapping process for the privacy data 1. The same way can be used to map other privacy data in the set to the Bloom filter. The Bloom filter after the mapping can represent the entire set. Whether a data exists in the set can be determined by whether the element value corresponding to the data in the Bloom filter is 1.

[0076] Then in step 22, the first party homomorphically encrypts each element in the first array and sends the first ciphertext array obtained by the encryption to the second party. It can be understood that the first party can directly homomorphically encrypt each element in the first array, or first perform a preset processing on each element in the first array and then homomorphically encrypt the processing value obtained.

[0077] Homomorphic encryption: Compared with ordinary encryption, homomorphic encryption has the property of homomorphism, that is, the calculation can be performed on the data in the encrypted state. For example, the homomorphic encryption ciphertext E(a) of a and the homomorphic encryption ciphertext E(b) of b are subjected to certain operation, and the ciphertext E(a+b) of a+b can be obtained, and a, b or a+b is not leaked during the operation process, and the decryption key is not needed. The operation can be called homomorphic addition operation.

[0078] In one example, the first party homomorphically encrypts each element in the first array, including:

[0079] The first party homomorphically encrypts each element in the first array to support homomorphism of addition.

[0080] In this example, the homomorphic addition operation can be performed on the ciphertext obtained by the homomorphic encryption to realize the convergence of the element values.

[0081] In one example, the first party homomorphically encrypts each element in the first array, including:

[0082] The first party takes each element in the first array as a subtrahend and takes 1 as a minuend to obtain a processing value corresponding to each element through subtraction operation;

[0083] The first party homomorphically encrypts each processing value to support homomorphism of addition.

[0084] In this example, when the element value is 1, the processing value is 0; and when the element value is 0, the processing value is 1. Subsequently, homomorphic addition operation can be performed on the ciphertext obtained by homomorphic encryption, and the aggregation of the element values is indirectly realized through the aggregation of the processing values.

[0085] Then in step 23, the second party determines the k target positions of any privacy data in the second privacy data set in the Bloom filter, extracts the encrypted elements at the k target positions in the first ciphertext array, and obtains k encrypted values. It can be understood that the second party can adopt the same mapping manner as the first party to determine the k target positions.

[0086] In one example, the second party calculates k hash values for any privacy data in the second privacy data set through k hash functions respectively, each hash value corresponding to a position in the Bloom filter, thereby obtaining the k target positions.

[0087] It can be understood that after obtaining the k target positions, the second party does not reset the element values of the corresponding positions in the Bloom filter, but only extracts the encrypted elements at the k target positions in the first ciphertext array to obtain k encrypted values.

[0088] In step 24, the second party performs homomorphic function operation on the k encrypted values to obtain the result ciphertext corresponding to the any privacy data; and the homomorphic function operation is used to aggregate the element values of the k target positions and to mask the aggregation result by a random number. It can be understood that through the random number masking manner, the leakage of additional information can be avoided.

[0089] In the embodiments of the present specification, the specific operation content of the above homomorphic function operation is also related to the meaning represented by the encrypted value, that is, whether the first party directly performs homomorphic encryption supporting additive homomorphism on each element in the first array to obtain the encrypted value, or performs preset processing on each element in the first array and then performs homomorphic encryption supporting additive homomorphism on the processing value to obtain the encrypted value. The above preset processing manner is not unique, the preset processing performed by the first party is a plaintext operation, the homomorphic function operation performed by the second party is a ciphertext operation, and both of them achieve a total operation target. Part of the total operation can be realized by plaintext operation, and the other part of the total operation can be realized by ciphertext operation. There are many possible ways to split the total operation.

[0090] In one example, the first party performs homomorphic encryption supporting additive homomorphism on each element in the first array;

[0091] The second party performs homomorphic function operation on the k encrypted values, including:

[0092] The second party homomorphically sums the k encrypted values to obtain a first ciphertext aggregation result;

[0093] The second party homomorphically subtracts k from the first ciphertext aggregation result to obtain a second ciphertext aggregation result;

[0094] The second party homomorphically multiplies the second ciphertext aggregation result by a random number to obtain a result ciphertext corresponding to the any privacy data.

[0095] In one example, the first party obtains a processing value corresponding to each element in the first array by taking each element in the first array as a minuend and taking 1 as a subtrahend through a subtraction operation; and the first party homomorphically encrypts each processing value in a homomorphic manner supporting addition;

[0096] The second party performs a homomorphic function operation on the k encrypted values, including:

[0097] The second party homomorphically sums the k encrypted values to obtain a third ciphertext aggregation result;

[0098] The second party homomorphically multiplies the third ciphertext aggregation result by a random number to obtain a result ciphertext corresponding to the any privacy data.

[0099] In step 25, the second party sends the result ciphertext corresponding to each privacy data in the second privacy data set to the first party. It can be understood that each privacy data in the second privacy data set corresponds to a result ciphertext, and the number of result ciphertexts is the same as the number of privacy data included in the second privacy data set.

[0100] For example, the second privacy data set includes privacy data 1, privacy data 2 and privacy data 3, privacy data 1 corresponds to result ciphertext 1, privacy data 2 corresponds to result ciphertext 2, and privacy data 3 corresponds to result ciphertext 3, and the second party sends result ciphertext 1, result ciphertext 2 and result ciphertext 3 to the first party.

[0101] Finally, in step 26, the first party decrypts each result ciphertext, and determines the number of common data between the two parties according to the statistical result of the predetermined value in each decrypted result. It can be understood that for the common data between the two parties, the element values of the k target positions are all 1, and the corresponding decrypted result is the predetermined value.

[0102] In one example, when the element values of the k target positions are all 1, the value of the decrypted result is the predetermined value; when the element values of the k target positions are at least one 0, the value of the decrypted result is a random value.

[0103] In one example, the predetermined value is 0.

[0104] It can be understood that in the multiplication operation, the result of 0 multiplied by a random number is still 0, and the result of a non-0 integer multiplied by a random number is a random value.

[0105] By the method provided by the embodiment of the present specification, first, the first party maps the first privacy data set it has to an m-bit Bloom filter to obtain an m-bit first array; wherein a single privacy data corresponds to k positions in the Bloom filter; then the first party homomorphically encrypts each element in the first array and sends the first ciphertext array obtained by the encryption to the second party; then the second party determines any privacy data in the second privacy data set it has in k target positions in the Bloom filter, extracts the encrypted elements of the k target positions in the first ciphertext array to obtain k encrypted values; then the second party performs homomorphic function operation on the k encrypted values to obtain the result ciphertext corresponding to the any privacy data; the homomorphic function operation is used to converge the element values of the k target positions and to mask the convergence result with a random number; the second party sends the result ciphertext corresponding to each privacy data in the second privacy data set to the first party; finally, the first party decrypts each result ciphertext and determines the number of common data of the two parties according to the statistical result of the predetermined values in each decrypted result. As can be seen from the above, by converging the Bloom filter element values and masking them with a random number, the embodiment of the present specification can make the decrypted result either a predetermined value or a random value, avoiding the leakage of additional information, thereby improving the security in the determination of the number of common data of the privacy data.

[0106] Figure 4 An interaction diagram of a method for determining the number of common data of privacy data according to another embodiment is shown, which is illustrated by taking an example of the first party directly homomorphically encrypting each element in the first array, and the method is relative to Figure 2 The embodiment shown adopts a specific homomorphic function operation to realize the convergence of element values and the masking with a random number. As Figure 4 The method for determining the number of common data of privacy data in the embodiment includes the following steps: step 41, the first party encodes its set into a Bloom filter; step 42, the first party sends the homomorphically encrypted Bloom filter to the second party; step 43, the second party takes out k encrypted elements corresponding to each element of its set from the encrypted Bloom filter of the first party; step 44, the second party homomorphically sums the k encrypted elements, then homomorphically subtracts k, and finally homomorphically multiplies a random number to obtain the result ciphertext corresponding to the element; step 45, the second party sends the result ciphertext corresponding to each element to the first party; step 46, the first party decrypts all the result ciphertexts it receives to obtain each decrypted result, and counts the number of decrypted results as 0 as the intersection size. The specific execution mode of each step is described below.

[0107] Firstly, in step 41, the first party encodes its set into a Bloom filter. It can be understood that the Bloom filter is the aforementioned first array.

[0108] The encoding process can include: calculating k hash values for each element of the set, and setting the element of the Bloom filter corresponding to the hash value to 1. The Bloom filter is an array, and all elements are initially 0.

[0109] Then, in step 42, the first party sends the homomorphically encrypted Bloom filter to the second party. It can be understood that the elements of the Bloom filter are not processed and are directly homomorphically encrypted.

[0110] Specifically, a homomorphic encryption supporting additive homomorphism is used.

[0111] Next, in step 43, the second party takes out k encrypted elements corresponding to each element of its set from the encrypted Bloom filter of the first party. It can be understood that each element can correspond to k encrypted elements.

[0112] For example, the second party calculates k hash values for each element of its set, and takes out k encrypted elements corresponding to the k hash values from the encrypted Bloom filter of the first party.

[0113] Again, in step 44, the second party homomorphically sums the k encrypted elements, homomorphically subtracts k, and finally homomorphically multiplies by a random number to obtain the result ciphertext corresponding to the element. It can be understood that the operation of the second party involves homomorphic addition, homomorphic subtraction, and homomorphic multiplication.

[0114] The support for additive homomorphism operation means support for multiplicative homomorphism operation of ciphertext and plaintext.

[0115] Again, in step 45, the second party sends the result ciphertext corresponding to each element to the first party. It can be understood that the above result ciphertext has been aggregated with respect to the element value, and the aggregated result has been masked with a random number.

[0116] Finally, in step 46, the first party decrypts all the result ciphertexts it receives to obtain the decryption results, and counts the number of decryption results that are 0 as the size of the intersection. It can be understood that the size of the intersection is the number of common data.

[0117] Figure 5 An interaction diagram of a method for determining the number of common data of private data is shown according to another embodiment, which is illustrated by an example that the first party first performs a preset processing on each element in the first array, and then homomorphically encrypts the processed value, and the method is relative to Figure 2The illustrated embodiment employs a particular homomorphic function operation to achieve both the aggregation of element values and the masking of random numbers. As Figure 5 The illustrated embodiment of the common data number determination method for protecting privacy data includes the following steps: step 51, the first party encodes its set as a Bloom filter; step 52, the first party subtracts 1 from each element of its Bloom filter, homomorphically encrypts the processed Bloom filter, and sends the encrypted Bloom filter to the second party; step 53, the second party takes out k encrypted elements corresponding to each element of its set from the encrypted Bloom filter sent by the first party; step 54, the second party homomorphically sums the k encrypted elements and then homomorphically multiplies the result by a random number to obtain the result ciphertext corresponding to the element; step 55, the second party sends the result ciphertext corresponding to each element to the first party; and step 56, the first party decrypts all the received result ciphertexts, obtains the decrypted results, and counts the number of decrypted results that are 0 as the size of the intersection. The specific execution manner of each of the above steps is described below.

[0118] First, in step 51, the first party encodes its set as a Bloom filter. It can be understood that the Bloom filter is the aforementioned first array.

[0119] The encoding process can include calculating k hash values for each element of the set and setting the elements of the Bloom filter corresponding to the hash values to 1. The Bloom filter is an array, and all elements are initially 0.

[0120] Then, in step 52, the first party subtracts 1 from each element of its Bloom filter, homomorphically encrypts the processed Bloom filter, and sends the encrypted Bloom filter to the second party. It can be understood that the first party first performs a preset processing on each element in the Bloom filter, and then homomorphically encrypts the processed value.

[0121] The processed Bloom filter has element values of 1 changed to 0 and 0 changed to 1 compared with the original Bloom filter.

[0122] Specifically, a homomorphic encryption supporting additive homomorphism is used.

[0123] Next, in step 53, the second party takes out k encrypted elements corresponding to each element of its set from the encrypted Bloom filter sent by the first party. It can be understood that each element can correspond to k encrypted elements.

[0124] For example, the second party calculates k hash values for each element of its set, and takes out k encrypted elements corresponding to the k hash values from the encrypted Bloom filter sent by the first party.

[0125] In step 54, the second party homomorphically sums the k encrypted elements and then homomorphically multiplies the result by a random number to obtain the result ciphertext corresponding to the element. It can be understood that the operation of the second party involves homomorphic addition and homomorphic multiplication.

[0126] wherein the addition homomorphic operation is supported, meaning that the multiplication homomorphic operation of the ciphertext and the plaintext is supported.

[0127] In step 55, the second party sends the result ciphertext corresponding to each element to the first party. It can be understood that the result ciphertext is aggregated with the element value, and the aggregation result is masked with a random number.

[0128] Finally, in step 56, the first party decrypts all the result ciphertexts received, obtains the decryption results, and counts the number of decryption results as 0 as the intersection size. It can be understood that the intersection size is the number of common data between the two parties.

[0129] According to another aspect, embodiments also provide a common data number determination device for protecting private data, which is arranged at the second party, and is used to perform the actions performed by the second party in the method provided by the embodiments. Figure 6 A schematic block diagram of a common data number determination device for protecting private data according to an embodiment is shown. As shown in the figure, the device 600 includes: Figure 6

[0130] The acquisition unit 61 is configured to acquire a first ciphertext array from the first party; the first ciphertext array is obtained by mapping a first private data set owned by the first party to an m-bit Bloom filter, obtaining an m-bit first array, and then performing homomorphic encryption on each element in the first array, wherein a single private data corresponds to k positions in the Bloom filter.

[0131] The extraction unit 62 is configured to determine any private data in a second private data set owned by the second party at the k target positions in the Bloom filter, extract the encrypted elements of the k target positions in the first ciphertext array acquired by the acquisition unit 61, and obtain k encrypted values.

[0132] The operation unit 63 is configured to perform a homomorphic function operation on the k encrypted values obtained by the extraction unit 62, and obtain a result ciphertext corresponding to the any private data; the homomorphic function operation is used to aggregate the element values of the k target positions and mask the aggregation result with a random number.

[0133] The sending unit 64 is configured to send the result ciphertext corresponding to each private data in the second private data set obtained by the operation unit 63 to the first party; so that the first party decrypts each result ciphertext, and determines the number of common data between the two parties according to the statistical result of the predetermined value in each decryption result.

[0134] Optionally, as an embodiment, the operation unit 63 includes:

[0135] ​a first summation subunit configured to homomorphically sum the k encrypted values to obtain a first ciphertext aggregation result;

[0136] a subtraction subunit configured to homomorphically subtract k from the first ciphertext aggregation result obtained by the first summation subunit to obtain a second ciphertext aggregation result;

[0137] a first multiplication subunit configured to homomorphically multiply the second ciphertext aggregation result obtained by the subtraction subunit by a random number to obtain the result ciphertext corresponding to the any private data.

[0138] Optionally, as one embodiment, the operation unit 63 comprises:

[0139] a second summation subunit configured to homomorphically sum the k encrypted values to obtain a third ciphertext aggregation result;

[0140] a second multiplication subunit configured to homomorphically multiply the third ciphertext aggregation result obtained by the second summation subunit by a random number to obtain the result ciphertext corresponding to the any private data.

[0141] By the device provided by the embodiments of the present specification, first, the acquisition unit 61 of the second party acquires the first ciphertext array from the first party; then the extraction unit 62 determines any private data in the second private data set possessed by the extraction unit 61 in the k target positions in the Bloom filter, extracts the encrypted elements in the k target positions in the first ciphertext array acquired by the acquisition unit 61 to obtain k encrypted values; then the operation unit 63 performs homomorphic function operation on the k encrypted values to obtain the result ciphertext corresponding to the any private data; the homomorphic function operation is used to aggregate the element values in the k target positions and to mask the aggregation result with a random number; finally, the sending unit 64 sends the result ciphertext corresponding to each private data in the second private data set to the first party; so that the first party decrypts each result ciphertext, and determines the number of common data of the two parties according to the statistical result of the predetermined values in each decrypted result. As can be seen from the above, by the way of aggregating the Bloom filter element values and then masking with a random number, the embodiments of the present specification can make the decrypted result either a predetermined value or a random value, avoiding the leakage of additional information, thereby being able to improve the security in the determination of the number of common data of the private data.

[0142] According to another aspect, embodiments also provide a system for determining the number of common data of private data, which is configured to perform the method provided by the embodiments of the present specification. Figure 7 A schematic block diagram of a system for determining the number of common data of private data according to one embodiment is shown. As shown in the figure, the system 700 comprises: Figure 7

[0143] ​The first party 71 is configured to map a first privacy data set owned by the first party 71 to an m-bit Bloom filter to obtain an m-bit first array, wherein a single privacy data corresponds to k positions in the Bloom filter; homomorphically encrypt each element in the first array, and send the first ciphertext array obtained by the encryption to the second party 72;

[0144] The second party 72 is configured to determine k target positions of any privacy data in a second privacy data set owned by the second party 72 in the Bloom filter, extract encrypted elements of the k target positions in the first ciphertext array to obtain k encrypted values; perform homomorphic function operation on the k encrypted values to obtain a result ciphertext corresponding to the any privacy data; the homomorphic function operation is configured to aggregate element values of the k target positions and perform random number masking on the aggregation result; and send the result ciphertext corresponding to each privacy data in the second privacy data set to the first party 71.

[0145] The first party 71 is further configured to decrypt each result ciphertext, and determine the number of common data of the two parties according to a statistical result of a predetermined value in each decrypted result.

[0146] Optionally, as an embodiment, the first party 71 is specifically configured to calculate k hash values respectively by k hash functions for any privacy data in the first privacy data set, and each hash value corresponds to a position in the Bloom filter; the Bloom filter includes m elements, and initial values of the elements are all 0; and the values of the elements of the k positions corresponding to any privacy data in the Bloom filter are set to 1 to obtain the m-bit first array.

[0147] Optionally, as an embodiment, the first party 71 is specifically configured to perform homomorphic encryption supporting homomorphism of addition on each element in the first array.

[0148] The second party 72 is specifically configured to perform homomorphic summation on the k encrypted values to obtain a first ciphertext aggregation result; perform homomorphic subtraction of k on the first ciphertext aggregation result to obtain a second ciphertext aggregation result; and perform homomorphic multiplication of a random number on the second ciphertext aggregation result to obtain the result ciphertext corresponding to the any privacy data.

[0149] Optionally, as an embodiment, the first party 71 is specifically configured to take each element in the first array as a minuend and take 1 as a subtrahend to obtain a processing value corresponding to each element by subtraction operation; and perform homomorphic encryption supporting homomorphism of addition on each processing value.

[0150] The second party 72 is specifically configured to perform homomorphic summation on the k encrypted values to obtain a third ciphertext aggregation result; and perform homomorphic multiplication of a random number on the third ciphertext aggregation result to obtain the result ciphertext corresponding to the any privacy data.

[0151] Optionally, as an embodiment, when the element values of the k target positions are all 1, the decryption result takes the predetermined value; when the element values of the k target positions at least have one 0, the decryption result takes a random value.

[0152] Optionally, as an embodiment, the predetermined value is 0.

[0153] Through the system provided by the embodiments of the present specification, first, the first party 71 maps the first privacy data set it has to the m-bit Bloom filter to obtain the first array of m bits; wherein a single privacy data corresponds to k positions in the Bloom filter; then the first party 71 homomorphically encrypts each element in the first array, and sends the first ciphertext array obtained by encryption to the second party; then the second party 72 determines the k target positions of any privacy data in the second privacy data set it has in the Bloom filter, extracts the encrypted elements of the k target positions in the first ciphertext array to obtain k encrypted values; then the second party 72 performs homomorphic function operation on the k encrypted values to obtain the result ciphertext corresponding to the any privacy data; the homomorphic function operation is used to converge the element values of the k target positions, and to perform random number masking on the converged result; the second party 72 sends the result ciphertext corresponding to each privacy data in the second privacy data set to the first party; finally, the first party 71 decrypts each result ciphertext, and determines the number of common data of the two parties according to the statistical result of the predetermined values in each decryption result. As can be seen from the above, through the way of converging the Bloom filter element values and then masking with random numbers, the embodiments of the present specification can make the decryption result either a predetermined value or a random value, avoiding the leakage of additional information, thereby being able to improve the security in the determination of the number of common data of the privacy data.

[0154] According to another aspect, embodiments also provide a computer readable storage medium having stored thereon a computer program which, when executed in a computer, causes the computer to carry out the method described in connection with Figure 2 , Figure 4 or Figure 5 .

[0155] According to yet another aspect, embodiments also provide a computing device comprising a memory and a processor, the memory having stored thereon executable code that, when executed by the processor, facilitates performing the methods described in connection with Figure 2 , Figure 4 or Figure 5 .

[0156] Those skilled in the art should be aware that, in the above one or more examples, the functions described in the present application can be implemented in hardware, software, firmware or any combination thereof. When implemented in software, the functions can be stored in a computer readable medium or transmitted as one or more instructions or codes on a computer readable medium.

[0157] The above detailed description has further explained the purpose, technical solutions and beneficial effects of the present application. It should be understood that the above description is only a specific embodiment of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made on the basis of the technical solutions of the present application shall be included in the protection scope of the present application.

Claims

1. A method for determining the number of shared data for protecting privacy data, the method comprising: The first party maps a first set of private data to an m-bit Bloom filter to obtain an m-bit first array; wherein a single item of private data corresponds to k positions in the Bloom filter; The first party performs homomorphic encryption on each element in the first array, and sends the encrypted first ciphertext array to the second party; The second party determines k target positions of any private data in the second private data set in the Bloom filter, extracts the encrypted elements of the k target positions in the first ciphertext array, and obtains k encrypted values; The second party performs a homomorphic function operation on the k encrypted values ​​to obtain a result ciphertext corresponding to any private data; the homomorphic function operation is used to aggregate the element values ​​of the k target positions, and the aggregated result is masked with a random number; The second party sends the result ciphertext corresponding to each private data in the second private data set to the first party; The first party decrypts each result ciphertext, and each decryption result obtained is a predetermined value or a random value. The amount of data shared by both parties is determined based on the statistical results of the predetermined values ​​in each decryption result.

2. The method according to claim 1, wherein The first party maps a first private data set it has to an m-bit Bloom filter, including: The first party calculates k hash values ​​for any private data in the first private data set using k hash functions, each hash value corresponding to a position in a Bloom filter; the Bloom filter includes m elements, and the initial value of each element is 0; The values ​​of the elements at k positions corresponding to any private data in the Bloom filter are set to 1 to obtain a first array of m bits.

3. The method according to claim 1, wherein The first party performs homomorphic encryption on each element in the first array, including: The first party performs homomorphic encryption supporting additive homomorphism on each element in the first array; The second party performs a homomorphic function operation on the k encrypted values, including: The second party performs homomorphic summation on the k encrypted values ​​to obtain a first ciphertext aggregation result; The second party homomorphically subtracts k from the first ciphertext aggregation result to obtain a second ciphertext aggregation result; The second party homomorphically multiplies the second ciphertext aggregation result by a random number to obtain a result ciphertext corresponding to any private data.

4. The method according to claim 1, wherein The first party performs homomorphic encryption on each element in the first array, including: The first party uses each element in the first array as a subtrahend and 1 as the minuend to obtain a processing value corresponding to each element through a subtraction operation; The first party performs homomorphic encryption supporting additive homomorphism on each processed value; The second party performs a homomorphic function operation on the k encrypted values, including: The second party performs homomorphic summation on the k encrypted values ​​to obtain a third ciphertext aggregation result; The second party homomorphically multiplies the third ciphertext aggregation result by a random number to obtain a result ciphertext corresponding to any private data.

5. The method according to claim 1, wherein When the element values ​​of the k target positions are all 1, the value of the decryption result is the predetermined value; when at least one of the element values ​​of the k target positions is 0, the value of the decryption result is a random value.

6. The method of claim 1, wherein: The predetermined value is 0.

7. A method for determining the number of shared data for protecting privacy data, the method comprising: The second party obtains the first ciphertext array from the first party; The first ciphertext array is obtained by mapping the first private data set owned by the first party to an m-bit Bloom filter to obtain an m-bit first array, and then performing homomorphic encryption on each element in the first array, where a single private data item corresponds to k positions in the Bloom filter; The second party determines k target positions of any private data in the second private data set in the Bloom filter, extracts the encrypted elements of the k target positions in the first ciphertext array, and obtains k encrypted values; The second party performs a homomorphic function operation on the k encrypted values ​​to obtain a result ciphertext corresponding to any private data; the homomorphic function operation is used to aggregate the element values ​​of the k target positions, and the aggregated result is masked with a random number; The second party sends the result ciphertext corresponding to each private data in the second private data set to the first party; so that the first party decrypts each result ciphertext, and each decryption result obtained is a predetermined value or a random value. The amount of shared data between the two parties is determined based on the statistical results of the predetermined values ​​in each decryption result.

8. The method of claim 7, wherein: The second party performs a homomorphic function operation on the k encrypted values, including: The second party performs homomorphic summation on the k encrypted values ​​to obtain a first ciphertext aggregation result; The second party homomorphically subtracts k from the first ciphertext aggregation result to obtain a second ciphertext aggregation result; The second party homomorphically multiplies the second ciphertext aggregation result by a random number to obtain a result ciphertext corresponding to any private data.

9. The method of claim 7, wherein: The second party performs a homomorphic function operation on the k encrypted values, including: The second party performs homomorphic summation on the k encrypted values ​​to obtain a third ciphertext aggregation result; The second party homomorphically multiplies the third ciphertext aggregation result by a random number to obtain a result ciphertext corresponding to any private data.

10. A system for determining the number of shared data for protecting privacy data, the system comprising: The first party maps its first private data set to an m-bit Bloom filter to obtain an m-bit first array, where a single private data item corresponds to k positions in the Bloom filter; performs homomorphic encryption on each element in the first array, and sends the encrypted first ciphertext array to the second party; The second party is configured to determine k target positions in the Bloom filter for any private data in the second private data set, extract the encrypted elements at these k target positions in the first ciphertext array, and obtain k encrypted values; perform a homomorphic function operation on the k encrypted values ​​to obtain a result ciphertext corresponding to the any private data; the homomorphic function operation is used to aggregate the element values ​​at the k target positions, and random number masking is performed on the aggregated result; and the result ciphertext corresponding to each private data in the second private data set is sent to the first party; The first party is further configured to decrypt each result ciphertext, and each decryption result obtained is a predetermined value or a random value. The amount of data shared by both parties is determined based on the statistical results of the predetermined values ​​in each decryption result.

11. The system of claim 10, wherein: The first party is specifically used to calculate k hash values ​​for any private data in the first private data set through k hash functions, where each hash value corresponds to a position in a Bloom filter; the Bloom filter includes m elements, and the initial values ​​of the elements are all 0; the values ​​of the elements in the k positions corresponding to any private data in the Bloom filter are set to 1, thereby obtaining a first array of m bits.

12. The system of claim 10, wherein: The first party is specifically configured to perform homomorphic encryption supporting additive homomorphism on each element in the first array; The second party is specifically used to homomorphically sum the k encrypted values ​​to obtain a first ciphertext aggregation result; homomorphically subtract k from the first ciphertext aggregation result to obtain a second ciphertext aggregation result; and homomorphically multiply the second ciphertext aggregation result by a random number to obtain a result ciphertext corresponding to any private data.

13. The system of claim 10, wherein: The first party is specifically configured to use each element in the first array as a subtrahend and 1 as the minuend, obtain a processing value corresponding to each element through a subtraction operation, and perform homomorphic encryption supporting additive homomorphism on each processing value; The second party is specifically used to homomorphically sum the k encrypted values ​​to obtain a third ciphertext aggregation result; and homomorphically multiply the third ciphertext aggregation result by a random number to obtain a result ciphertext corresponding to any private data.

14. The system of claim 10, wherein: When the element values ​​of the k target positions are all 1, the value of the decryption result is the predetermined value; when at least one of the element values ​​of the k target positions is 0, the value of the decryption result is a random value.

15. The system of claim 10, wherein: The predetermined value is 0.

16. A device for determining the number of shared data for protecting privacy data, the device being provided at a second party, comprising: an acquiring unit, configured to acquire a first ciphertext array from a first party; The first ciphertext array is obtained by mapping the first private data set owned by the first party to an m-bit Bloom filter to obtain an m-bit first array, and then performing homomorphic encryption on each element in the first array, where a single private data item corresponds to k positions in the Bloom filter; an extraction unit, configured to determine k target positions of any private data in the second private data set in the Bloom filter, extract encrypted elements of the k target positions in the first ciphertext array obtained by the acquisition unit, and obtain k encrypted values; an operation unit, configured to perform a homomorphic function operation on the k encrypted values ​​obtained by the extraction unit to obtain a result ciphertext corresponding to any private data; the homomorphic function operation is used to aggregate the element values ​​of the k target positions and to mask the aggregated result with a random number; a sending unit, configured to send to the first party the result ciphertexts corresponding to the respective private data in the second private data set obtained by the computing unit; so that the first party decrypts the result ciphertexts, and the decryption results obtained are predetermined values ​​or random values; and the amount of shared data between the two parties is determined based on the statistical results of the predetermined values ​​in the decryption results.

17. The apparatus of claim 16, wherein: The computing unit includes: A first summing subunit, configured to perform homomorphic summation on the k encrypted values ​​to obtain a first ciphertext aggregation result; a subtraction subunit, configured to homomorphically subtract k from the first ciphertext aggregation result obtained by the first summation subunit to obtain a second ciphertext aggregation result; The first multiplication subunit is used to homomorphically multiply the second ciphertext aggregation result obtained by the subtraction subunit by a random number to obtain a result ciphertext corresponding to any private data.

18. The apparatus of claim 16, wherein: The computing unit includes: A second summing subunit is configured to perform homomorphic summation on the k encrypted values ​​to obtain a third ciphertext aggregation result; The second multiplication subunit is used to homomorphically multiply the third ciphertext aggregation result obtained by the second summation subunit by a random number to obtain a result ciphertext corresponding to any private data.

19. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 9.

20. A computing device comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method according to any one of claims 1 to 9 is implemented.

Images