A method and system for finding intersections of multi-party conditional privacy-preserving sets against collusion attacks

Abstract

The present invention belongs to the technical field of data security, and specifically relates to a method and system for multi-party conditional privacy protection set intersection against collusion attacks, wherein a client performs conditional privacy protection set intersection operations with multiple service ends simultaneously, and the client obtains an intersection satisfying the conditions proposed by the client. The method comprises: obtaining system parameters; the client performs a security retrieval protocol with each service end respectively to obtain security policy parameters; the client further performs a multi-party conditional privacy protection set intersection protocol against collusion attacks with all service ends through the security policy parameters until the client obtains an intersection satisfying the conditions proposed by the client; in the present invention, if the number of participating parties is m, the multi-party conditional privacy protection set intersection protocol against collusion attacks of the present invention can resist m-1 collusion attacks.

Description

Technical Field

[0001] The present invention belongs to the technical field of data security, and in particular relates to a method and system for finding the intersection of multi-party conditional privacy protection sets that are resistant to collusion attacks. Background Art

[0002] The calculation of private set intersection (PSI) is a specific application problem in the field of secure multi-party computation. It not only has important theoretical significance but also has strong application value. The PSI protocol allows two parties to have their own sets C and S, respectively, the client and the server. When the PSI protocol is executed, both parties or only the client obtains the intersection of the two parties C∩S, without leaking any other information. The conditional private set intersection (CPSI) protocol is a variant of the traditional PSI protocol. It requires that the final output of the protocol is the intersection of the two parties. At the same time, the corresponding features of the intersection must meet a specific condition proposed by the client, and the server cannot know the specific information of the condition. It is conceivable that in real application scenarios, in addition to the two-party intersection, there must be multi-party intersection application scenarios. At the same time, in the multi-party intersection scenario, any number of participants may collude to obtain certain data that they should not have obtained. Summary of the invention

[0003] In order to solve the problems existing in the above prior art, the present invention proposes a method and system for finding the intersection of multiple conditional privacy protection sets against collusion attacks. The client performs conditional privacy protection set intersection operations with multiple servers at the same time, and the client obtains the intersection that meets the conditions proposed by the client. The method specifically includes the following steps:

[0004] Get system parameters;

[0005] The client performs security retrieval protocols with each server to obtain security policy parameters;

[0006] The client and all servers further execute the multi-party conditional privacy protection set intersection protocol against collusion attacks through security policy parameters until the client obtains the intersection that satisfies the conditions proposed by the client.

[0007] Furthermore, obtaining system parameters includes:

[0008] ServerS k Get the additive homomorphic encryption key pair (pk k ,sk k ), k∈{1,2,…,m-1};

[0009] Client C obtains the additive homomorphic encryption key pair (pk0, sk0);

[0010] The public keys of the server and client are published in the system, and the master public key

[0011] The identifier dataset of client C is ServerS k The identifier dataset is

[0012]

[0013] Furthermore, the client obtains the intersection that satisfies the conditions proposed by the client, including:

[0014] When the client performs a security retrieval protocol with each server, the client C sends a request to the kth server S k Propose a condition k ;

[0015] After the security retrieval protocol is executed, the kth server S k Generate security policy parameters with client C and server S k The security policy parameters are expressed as Indicates the server S k The security policy parameters of the ith sample, Indicates the server S k The number of samples; the security policy parameters of client C are expressed as Represents the security policy parameters of the i-th sample of the client;

[0016] when When represents the kth server S k The i-th data meets the condition ρ proposed by the client k ,when It represents the kth server S k The i-th data does not meet the condition ρ proposed by the client k ;

[0017] When at least t servers in the system meet the condition ρ proposed by the client k When , the client's representation is used as the output of the multi-party privacy-preserving intersection protocol;

[0018] Here, m is a positive integer greater than or equal to 3.

[0019] Furthermore, when the system includes a client C and two servers, the client and all servers further perform a multi-party conditional privacy protection set intersection protocol against collusion attacks through security policy parameters, including:

[0020] Client C uses the master public key pk to encrypt the security policy parameters obtained after executing the security retrieval protocol with server S1 and server S2 Get the ciphertext and And the ciphertext Send to servers S1 and S2 respectively;

[0021] The servers S1 and S2 use the master public key pk to encrypt the security policy parameters obtained after executing the security retrieval protocol with the client C. and Get the ciphertext and make

[0022] Server S1 uses hash function H:{0,1} * →G map dataset identifier Go to the cyclic group G of order p and select a random number Calculation Mask Server S1 will With [μ 1 ] pk Composed of two-tuple sets Send it to client C; the client chooses a random number calculate Random confusion Send it to the server S1.

[0023] Server S2 generates a set of tuples in the same way as server S1. And send it to the server S1;

[0024] Server S1 calculate get After confusing it, the server S1 sends and To server S2;

[0025] Server S2 calculate get After confusing it, the server S2 changes its encrypted share from the ciphertext [μ 1 ] pk With [μ 2 ] pk Subtract it from the client C and the server S1, so that both parties can decrypt it; the server C will Send to client C;

[0026] Client C selects a random number calculate Then the encrypted share is removed from the ciphertext [μ 1 ] pk With [μ 2 ] pk Subtract it from the server, so that the server S1 can decrypt it alone; the client C will After being obfuscated, it is sent to the server S1;

[0027] Client C calculates the mask and Then randomly swap the corresponding positions of the two masks. Send to server S2;

[0028] Server-side S2 calculation Then send it to the server S1;

[0029] Server-side S1 calculation Traversal If its elements are in The mask part of appears twice, and the server S1 decrypts the corresponding ciphertext. The number of times the decryption result is 1 is greater than or equal to t, that is, the number of servers that meet the conditions proposed by the client is greater than or equal to t. Then the index i of its element is sent to the client, and the corresponding client identifier c i This is the protocol output result;

[0030] Among them, t∈{1,2}.

[0031] The present invention also proposes a multi-party conditional privacy protection set intersection system that resists collusion attacks, including a client and multiple servers;

[0032] Client C uses the master public key pk to encrypt the security policy parameters obtained after executing the security retrieval protocol with server S1 and server S2 Get the ciphertext and And the ciphertext Send to servers S1 and S2 respectively;

[0033] The servers S1 and S2 use the master public key pk to encrypt the security policy parameters obtained after executing the security retrieval protocol with the client C. and Get the ciphertext and make

[0034] Server S1 uses hash function H:{0,1} * →G map dataset identifier Go to the cyclic group G of order p and select a random number Calculation Mask Server S1 will With [μ 1 ] pk Composed of two-tuple sets Send it to client C; the client chooses a random number calculate Random confusion Send it to the server S1.

[0035] Server S2 generates a set of tuples in the same way as server S1. And send it to the server S1;

[0036] Server S1 calculate get After confusing it, the server S1 sends and To server S2;

[0037] Server S2 calculate get After confusing it, the server S2 changes its encrypted share from the ciphertext [μ 1 ] pk With [μ 2 ] pk Subtract it from the client C and the server S1, so that both parties can decrypt it; the server C will Send to client C;

[0038] Client C selects a random number calculate Then the encrypted share is removed from the ciphertext [μ 1 ] pk With [μ 2 ] pk Subtract it from the server, so that the server S1 can decrypt it alone; the client C will After being obfuscated, it is sent to the server S1;

[0039] Client C calculates the mask and Then randomly swap the corresponding positions of the two masks. Send to server S2;

[0040] Server-side S2 calculation Then send it to the server S1;

[0041] Server-side S1 calculation Traversal If its elements are in The mask part of appears twice, and the server S1 decrypts the corresponding ciphertext. The number of times the decryption result is 1 is greater than or equal to t, that is, the number of servers that meet the conditions proposed by the client is greater than or equal to t. Then the index i of its element is sent to the client, and the corresponding client identifier c i This is the protocol output result;

[0042] Among them, t∈{1,2}.

[0043] The present invention also provides a computer-readable storage medium on which a computer program is stored. The computer program is executed by a processor to implement a multi-party conditional privacy protection set intersection method that is resistant to collusion attacks.

[0044] The present invention also provides a computer device, including a processor and a memory, wherein the memory is used to store the computer device; the processor is connected to the memory, and the processor is used to execute the computer program stored in the memory, so that the computer device can implement a multi-party conditional privacy protection set intersection method that is resistant to collusion attacks.

[0045] In the present invention, if the number of participants is m, then the multi-party conditional privacy-preserving set intersection protocol resistant to collusion attacks of the present invention can resist m-1 collusion attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 This is an overall flow chart of a method for finding intersections of multi-party conditional privacy-preserving sets against collusion attacks according to the present invention;

[0047] Figure 2 Formal process of the security retrieval protocol of the present invention;

[0048] Figure 3 The present invention discloses a formal process for the intersection method of multi-party conditional privacy-preserving sets that is resistant to collusion attacks. DETAILED DESCRIPTION

[0049] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0050] The present invention proposes a method for finding the intersection of multiple conditional privacy protection sets against collusion attacks. The client performs conditional privacy protection set intersection operations with multiple servers at the same time, and the client obtains the intersection that meets the conditions proposed by the client. The method specifically includes the following steps:

[0051] Get system parameters;

[0052] The client performs security retrieval protocols with each server to obtain security policy parameters;

[0053] The client and all servers further execute the multi-party conditional privacy protection set intersection protocol against collusion attacks through security policy parameters until the client obtains the intersection that satisfies the conditions proposed by the client.

[0054] In this embodiment, the present invention is described by taking the scenario of three-party conditional privacy protection intersection as an example. The present invention can be naturally extended to m parties. k The additive homomorphic encryption key pairs with client C are (pk k ,sk k ), k∈{1,2} and (pk0,sk0). Assume that the public keys of the server and the client have been made public, and the master public key Here pk = pk0 + pk1 + pk2. The identifier data set of client C is ServerS k The identifier dataset is

[0055] Client C sends a request to each server S k Propose a condition k , execute secure retrieval protocols such as Figure 2 After the security retrieval protocol is executed, S k Generate security policy parameters with C respectively and if represent Satisfy the conditions ρ proposed by the client k ,if It represents The condition ρ proposed by the client is not met k Only when there are t servers in the intersection that meet the conditions can it be used as the output of the multi-party privacy protection intersection protocol. t can be negotiated by all parties or directly specified by the client. Here, the value range of t is {1,2}. When the number of servers in the system is m-1, that is, there are m parties including the client, the value range of t is {1,2,…,m-1}. The weight of t can be negotiated by all parties or specified by the client.

[0056] Each party formally starts the multi-party conditional privacy-preserving set intersection protocol through the generated security policy parameters, such as Figure 3 .

[0057] Client C uses the master public key pk to encrypt the security policy parameters obtained after executing the security retrieval protocol with server S1 and server S2 Get the ciphertext and And the ciphertext Sent to servers S1 and S2 respectively.

[0058] The servers S1 and S2 use the master public key pk to encrypt the security policy parameters obtained after executing the security retrieval protocol with the client C. and Get the ciphertext and make

[0059] S1 passes through the hash function H:{0,1} * →G map dataset identifier to the cyclic group G of order p, and then select a random number Calculation Mask S1 With [μ 1 ] pk Composed of two-tuple sets Will Sent to client C.

[0060] Client chooses random number calculate Then randomly mix Will Sent to server S1.

[0061] Server S2 selection Generate a set of two-tuples in the same way as server S1 Then Sent to server S1.

[0062] Server S1 calculate Further Then confuse it. S1 sends and To server S2.

[0063] Server S2 Utilization calculate Then further get Will After the obfuscation, the server S2 changes its encrypted share from the ciphertext [μ 1 ] pk With [μ 2 ] pk Subtract it from the client, so that both the client and the server S1 can decrypt it. Sent to client C.

[0064] Client C selects a random number calculate Then the encrypted share is removed from the ciphertext [μ 1 ] pk With [μ 2 ] pk Subtract it from the server, so that the server S1 can decrypt it alone. Client C will After confusion Sent to server S1.

[0065] Client C calculates the mask and Then randomly swap and The corresponding position of Sent to server S2.

[0066] Server-side S2 calculation Then Sent to server S1.

[0067] Server S1 further calculates Traversal if The elements in The mask part of appears twice, and the server S1 decrypts the corresponding ciphertext. The number of times the decryption result is 1 is ≥t, that is, the number of servers that meet the conditions proposed by the client is greater than or equal to t. Then the index i of its element is sent to the client, and the corresponding client identifier c i This is the protocol output result.

[0068] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for finding intersections of multi-party conditional privacy-preserving sets against collusion attacks, characterized in that: The client performs conditional privacy protection set intersection operations with multiple servers at the same time, and the client obtains the intersection that meets the conditions set by the client, which specifically includes the following steps: Get system parameters; The client performs security retrieval protocols with each server to obtain security policy parameters; The client and all servers further execute the anti-collusion attack multi-party conditional privacy protection set intersection protocol through security policy parameters until the client obtains the intersection that meets the conditions proposed by the client. All parties formally start the multi-party conditional privacy protection set intersection protocol through the generated security policy parameters, including: Client C uses the master public key pk to encrypt the security policy parameters obtained after executing the security retrieval protocol with server S1 and server S2 Get the ciphertext and And the ciphertext Send to servers S1 and S2 respectively; The servers S1 and S2 use the master public key pk to encrypt the security policy parameters obtained after executing the security retrieval protocol with the client C. and Get the ciphertext and make S1 passes through the hash function H:{0,1} * →G map dataset identifier to the cyclic group G of order p, and then select a random number Calculation Mask S1 With [μ 1 ] pk Composed of two-tuple sets Will Send to client C; Client chooses random number calculate Then randomly mix Will Send to server S1; Server S2 selection Generate a set of two-tuples in the same way as server S1 Then Send to server S1; Server S1 calculate Further Then confuse it; S1 sends and To server S2; Server S2 Utilization calculate Then further get Will After the obfuscation, the server S2 changes its encrypted share from the ciphertext [μ 1 ] pk With [μ 2 ] pk Subtract it from the client and the server S1, so that both the client and the server S1 can decrypt it; The server will Send to client C; Client C selects a random number calculate Then the encrypted share is removed from the ciphertext [μ 1 ] pk With [μ 2 ] pk Subtract it from the , so that the server S1 can decrypt alone; Client C will After confusion Send to server S1; Client C calculates the mask and Then randomly swap and The corresponding position of Send to server S2; Server-side S2 calculation Then Send to server S1; Server S1 further calculates Traversal if The elements in The mask part of appears twice, and the server S1 decrypts the corresponding ciphertext. The number of times the decryption result is 1 is ≥t, that is, the number of servers that meet the conditions proposed by the client is greater than or equal to t. Then the index i of its element is sent to the client, and the corresponding client identifier c i That is the output result of the protocol, where t∈{1,2}.

2. According to the method of claim 1, the method is characterized in that: Obtaining system parameters includes: ServerS k Get the additive homomorphic encryption key pair (pk k ,sk k ), k∈{1,2,…,m-1}; Client C obtains the additive homomorphic encryption key pair (pk0, sk0); The public keys of the server and the client are published in the system, and the master public key The identifier dataset of client C is ServerS k The identifier dataset is 3. According to the method of claim 1, the method is characterized in that: The client obtains the intersection that satisfies the conditions proposed by the client, including: When the client performs a security retrieval protocol with each server, the client C sends a request to the kth server S k Propose a condition k ; After the security retrieval protocol is executed, the kth server S k Generate security policy parameters with client C and server S k The security policy parameters are expressed as Indicates the server S k The security policy parameters of the ith sample, Indicates the server S k The number of samples; the security policy parameters of client C are expressed as Represents the security policy parameters of the i-th sample of the client; when When represents the kth server S k The i-th data meets the condition ρ proposed by the client k ,when It represents the kth server S k The i-th data does not meet the condition ρ proposed by the client k ; When at least t servers in the system meet the condition ρ proposed by the client k When , the client's representation is used as the output of the multi-party privacy-preserving intersection protocol; Wherein, m is a positive integer greater than or equal to 3.

4. A multi-party conditional privacy-preserving set intersection system that resists collusion attacks, characterized in that: Including client and multiple servers; Client C uses the master public key pk to encrypt the security policy parameters obtained after executing the security retrieval protocol with server S1 and server S2 Get the ciphertext and And the ciphertext Send to servers S1 and S2 respectively; The servers S1 and S2 use the master public key pk to encrypt the security policy parameters obtained after executing the security retrieval protocol with the client C. and Get the ciphertext and make Server S1 uses hash function H:{0,1} * →G map dataset identifier Go to the cyclic group G of order p and select a random number Calculation Mask Server S1 will With [μ 1 ] pk Composed of two-tuple sets Send it to client C; the client chooses a random number calculate Random confusion Send it to the server S 1； Server S2 generates a set of tuples in the same way as server S1. And send it to the server S1; Server S1 calculate get After confusing it, the server S1 sends and To server S2; Server S2 calculate get After confusing it, the server S2 changes its encrypted share from the ciphertext [μ 1 ] pk With [μ 2 ] pk Subtract it from the client C and the server S1, so that both parties can decrypt it; the server C will Send to client C; Client C selects a random number calculate Then the encrypted share is removed from the ciphertext [μ 1 ] pk With [μ 2 ] pk Subtract it from the server, so that the server S1 can decrypt it alone; the client C will After being obfuscated, it is sent to the server S1; Client C calculates the mask and Then randomly swap the corresponding positions of the two masks. Send to server S2; Server-side S2 calculation Then send it to the server S1; Server-side S1 calculation Traversal If its elements are in The mask part of appears twice, and the server S1 decrypts the corresponding ciphertext. The number of times the decryption result is 1 is greater than or equal to t, that is, the number of servers that meet the conditions proposed by the client is greater than or equal to t. Then the index i of its element is sent to the client, and the corresponding client identifier c i This is the protocol output result; Among them, t∈{1,2}.

5. According to the multi-party conditional privacy protection set intersection system against collusion attacks as described in claim 4, it is characterized in that: The master public key pk is expressed as Among them, (pk k ,sk k ) is the server S k The key pair of client C and server S is: k The key pairs are all encrypted homomorphically using additive encryption.

6. According to the multi-party conditional privacy protection set intersection system against collusion attacks as claimed in claim 4, it is characterized in that: The process of determining whether the current decryption result is 1 includes: When the client performs a security retrieval protocol with each server, the client C sends a k Propose a condition k ; After the secure retrieval protocol is executed, each client S k The security policy parameters are generated by C respectively, and the security policy parameters of the i-th client are expressed as: when When represents the server S k The i-th sample satisfies the condition ρ proposed by the client k ,when It represents the server S k The i-th sample does not satisfy the condition ρ proposed by the client k ; When more than t servers in the system meet the conditions ρ proposed by the client k When the client identifier c i As the output of the multi-party privacy-preserving intersection protocol; Wherein, m is a positive integer greater than or equal to 3.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: The computer program is executed by a processor to implement the multi-party conditional privacy protection set intersection method against collusion attacks as described in any one of claims 1 to 3.

8. A computer device comprising a processor and a memory, characterized in that: The memory is used to store computer equipment; the processor is connected to the memory, and the processor is used to execute the computer program stored in the memory, so that the computer equipment implements the multi-party conditional privacy protection set intersection method against collusion attacks as described in any one of claims 1 to 3.

Images