A method for finding intersection of private sets based on multi-party conditional retrieval

Abstract

The present invention belongs to the field of data security technology, and specifically relates to a privacy set intersection method based on multi-party conditional retrieval, the method comprising: obtaining system parameters, calculating policy parameters according to the obtained system parameters; encrypting the calculated policy parameters; executing the PSI protocol on each server according to the encrypted policy parameters; finding the intersection of the privacy sets of each server according to the protocol result, obtaining the intersection result, and sending the intersection result to the client; the present invention not only enables the client to flexibly select the retrieval condition according to the data characteristics of the server, but also can protect the retrieval condition of the client and the specific characteristics of the retrieval, and is a PSI method for multi-party multi-feature retrieval.

Description

Technical Field

[0001] The present invention belongs to the technical field of data security, and in particular relates to a privacy set intersection method based on multi-party conditional retrieval. Background Art

[0002] The calculation of private set intersection (PSI) is a specific application problem in the field of secure multi-party computation. It not only has important theoretical significance but also has strong application value. As the privacy protection of user data has received more and more attention, research in this field aims to meet data convenience while minimizing privacy leakage. With the continuous development of the field of secure multi-party computation, PSI protocols based on various components and security protocols have emerged in an endless stream, such as PSI based on DH (Diffie-Hellman) key exchange, PSI based on Bloom filter, PSI based on OT protocol, PSI based on fully homomorphic encryption, etc. Among the above PSI protocols, the one-way PSI protocol is particularly valued, that is, only one party knows the calculation result of the intersection.

[0003] The traditional PSI protocol has strong practical significance, but it still has certain limitations and can only solve some of the simplest practical problems, such as calculating the actual effect of advertising, finding contacts, etc. Since the PSI protocol is generally only a data summary or the intersection between IDs, it is impossible to perform operations on the feature data itself. For example, Bank A does not have sufficient data to support which users can be the objects of its future loans, and hopes that credit reporting agency B can provide help. At this time, A wants to know which users are common users of B and C and meet the annual salary of more than 200,000. And A does not want B to know the specific search conditions and intersections, and B does not want A to get additional information that does not belong to it. In this scenario, the traditional PSI cannot meet this demand, and there is currently no known way to solve this problem. Summary of the invention

[0004] In order to solve the problems existing in the above-mentioned prior art, the present invention proposes a privacy set intersection method based on multi-party conditional retrieval, the method comprising: obtaining system parameters, calculating policy parameters according to the obtained system parameters; encrypting the calculated policy parameters; each server executes the PSI protocol according to the encrypted policy parameters; according to the protocol result, the privacy sets of each server are intersected to obtain the intersection result, and the intersection result is sent to the client.

[0005] Preferably, the obtained system parameters include client parameters and server parameters; the client parameters include: i c 、x ij c ; Server parameters include: yi s 、x ij s ; Among them, y i c represents the client secret share of the i-th feature comparison threshold, x ij c represents the client secret share of the i-th feature value in the j-th sample on the server, y i s represents the server secret share of the i-th feature comparison threshold, x ij s Represents the server secret share of the i-th eigenvalue in the j-th sample on the server.

[0006] Preferably, the process of calculating the policy parameters according to the acquired system parameters includes: the server S i Use the additive secret sharing strategy with client C to share parameters and obtain parameter y i =y i c +y i s and x ij =x ij c +x ij s ; The client and the server jointly use the security comparison protocol SecCom(.) to compare the parameter y i and x ij Calculate and get the parameter u ij1 ,u ij2 ; Set the parameter u ij1 Save on the client side, set the parameter u ij2 Save on the server i ; Among them, y i represents the threshold of the i-th feature proposed by the client, x ij represents the i-th feature value of the j-th feature on the server, u ij1 represents the client output share of the security comparison protocol output for the i-th feature in the j-th sample on the server, u ij2 Represents the server output share of the security comparison protocol output for the i-th feature in the j-th server sample.

[0007] Furthermore, the parameter y is compared using the security comparison protocol SecCom(.) i and x ij The calculation process includes: client C calculates the client's intermediate parameter g1=y according to the client parameter i c -x ij c ; Server Si ,i∈{1,2} calculates the intermediate parameter g of the server according to the server parameters i2 =y i s -x ij s ; According to the client's intermediate parameters and the server's intermediate parameters, the client and the server jointly execute SecAddRes(g1,g i2 ) protocol, get the parameter u ij1 ,u ij2 SecAddRes(.) represents the secret sharing conversion protocol, g1 represents the difference between the client secret share of the i-th feature comparison threshold and the client secret share of the i-th feature value in the j-th sample on the server, g i2 Represents the difference between the server secret share of the ith feature comparison threshold and the server secret share of the ith feature value in the jth server sample.

[0008] Furthermore, the user end and the server end generate a Beaver triple vector γ = α * β, and |α| = |β| = |γ| = d i ; Share γ by adding secrets to get γ = γ1 + γ2; Save parameters α and γ1 to the client, and save parameters β and γ2 to the server S i The client calculates χ = (g1-γ1) / α based on the saved parameters; the server S i Use the public key pk i Encrypt β to get and will Sent to the client; the client uses the public key pk i Encrypt χ to get The client obtains and calculate Will The vector order is confused and sent to the server S i ; Server S i Decrypt the data sent by the client and get ServerS i According to the obtained u ij2 Further calculation of δ=(g i2 -γ2) / u ij2 , and sends the calculated δ to the client; after receiving the parameters sent by the server, the client calculates u ij1 =α+δ, and get the parameter u ij1 ; where γ represents the product value in the Beaver triple, α represents the first value in the Beaver triple, β represents the second value in the Beaver triple, and d irepresents the number of features on the server side, γ1 represents the client secret share of γ, γ2 represents the server secret share of γ, and χ and δ both represent the intermediate process values ​​in the calculation process.

[0009] Preferably, the process of encrypting the calculated policy parameters includes:

[0010] Step 1: The client uses the public key pk to ij1 ,i∈{1,2},j∈[1,|D i |] to encrypt and obtain the ciphertext [u ij1 ] pk ; Server S i Use public key pk to u ij2 ,i∈{1,2},j∈[1,|D i |] to encrypt and obtain the ciphertext [u ij2 ] pk ; Among them, |D i | represents the number of data in the dataset of the ith server, D i represents the dataset of the i-th server, i represents the index of the feature, and j represents the index of the sample;

[0011] Step 2: Client C sends [u ij1 ] pk Sent to the server S i ,i∈{1,2}; the server will [u ij1 ] pk with [u ij2 ] pk Add together to get [u ij1 +u ij2 ] pk =((r i +r i ′)·G,(u ij1 +u ij2 )·G+(r i +r i ′)·pk),j∈[1,|D i |].

[0012] Preferably, the process of each server executing the PSI protocol includes:

[0013] Step 1: The server S1 generates a random number a∈[1,N-1], calculates a·ID1 based on the generated random number, and sends the calculation result to the client C; ID1 represents the data set of the server S1, and N represents the order of the elliptic curve basis point;

[0014] Step 2: Client C generates a random number b∈[1,N-1], and calculates ab·ID1 and b·ID based on the generated random number and the data sent by the server.c ; Client C will b·ID c With its own data ID c Composition union M2:b·ID c ∪ID c ; and send ab·ID1 to the server S1; where ID c A dataset representing the client;

[0015] Step 3: The server S1 calculates the ID1 mask M1 based on the data sent by the receiving client, where M1:b -1 ·ab·ID1=b·ID1;

[0016] Step 4: Server S1 sends the mask M1:b·ID1 to server S2, and client C sends the ciphertext parameter [u 1j1 +u 1j2 ] pk Send to server S2;

[0017] Step 5: The server S2 combines its own data ID2 with M1 to form a new union mask M3: b·ID1∪ID2;

[0018] Step 6: The server S2 generates a random number e∈[1,N-1], and uses the mask M3 to calculate be·ID1∪e·ID2, and sends the calculation result to the client C; where ID2 represents the data set of the server S2;

[0019] Step 7: After receiving the data sent by the server S2, the client C generates a random number h∈[1,N-1], calculates beh·ID1∪eh·ID2 based on the generated random number, and sends the calculation result to the server S2;

[0020] Step 8: Server S2 uses beh·ID1∪eh·ID2 and inverse element e -1 Calculate the mask M4: bh·ID1∪h·ID2; and compare M4 with the corresponding ciphertext After being obfuscated, it is sent to the server S1.

[0021] Furthermore, the corresponding ciphertext Includes: Ciphertext [u ij1 +u ij2 ] pk The first part is (r i +r i ′)·G, according to the first part (r i +r i ′)·G calculates homomorphic addition operation, and the formula of homomorphic addition operation is:

[0022] (r i +ri ′)pk2=(r i +r i ′)·sk2·G

[0023] The ciphertext [u ij1 +u ij2 ] pk The second part subtracts the homomorphic addition formula to get the corresponding ciphertext The formula is:

[0024]

[0025] where r i With r i ′ represents the random number used for encryption, pk2 represents the public key of the server S2, sk2 represents the private key of the server S2, and G represents the elliptic curve base point.

[0026] Preferably, the process of finding the intersection of the privacy sets of each server according to the protocol result includes:

[0027] Step 1: Client C calculates mask M5:bh·ID using mask M2 and h c ∪h·ID c ; The client C sends the mask M5 and the index corresponding to the mask to the server S1; where index represents the index;

[0028] Step 2: Server S1 finds the intersection of mask M2 and mask M5; if the index in the intersection appears twice, server S1 will encrypt the ciphertext Decrypt and get the decrypted plaintext u ij1 +u ij2 ; If v = u ij1 +u ij2 And i∈{1,2}, then the data corresponding to the index is the intersection of the three parties and satisfies the search condition p, and index is returned; v represents the decrypted plaintext that satisfies the search condition p;

[0029] Step 3: Client C finds the ID that meets the conditions based on the returned index cindex ,index∈[1,|D c |]; where ID cindex Indicates the index-th data of the client.

[0030] Beneficial effects of the present invention:

[0031] The present invention not only enables the client to flexibly select search conditions according to the data characteristics of the server, but also protects the search conditions of the client and the specific characteristics of the search. It is a PSI method for multi-party and multi-characteristic retrieval. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 It is a flow chart of the calculation retrieval parameters of the present invention;

[0033] Figure 2 A flow chart of encryption policy parameters for each party of the present invention;

[0034] Figure 3 A PSI protocol flow chart is provided for each party of the present invention;

[0035] Figure 4 A flow chart of the intersection result obtained by the client of the present invention. DETAILED DESCRIPTION

[0036] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0037] A privacy set intersection method based on multi-party conditional retrieval, the method comprising: obtaining system parameters, calculating policy parameters according to the obtained system parameters; encrypting the calculated policy parameters; executing the PSI protocol on each server according to the encrypted policy parameters; and finding the intersection of the privacy sets of each server according to the protocol result to obtain the intersection result, and sending the intersection result to the client.

[0038] The system parameters obtained include client parameters and server parameters; client parameters include: i c and x ij c ; Server parameters include: y i s and x ij s ; Among them, y i c represents the client secret share of the i-th feature comparison threshold, x ij c represents the client secret share of the i-th feature value in the j-th sample on the server, y i s represents the server secret share of the i-th feature comparison threshold, x ij s Represents the server secret share of the i-th eigenvalue in the j-th sample on the server.

[0039] The process of calculating the policy parameters based on the obtained system parameters includes: iUse the additive secret sharing strategy with client C to share parameters and obtain parameter y i =y i c +y i s and x ij =x ij c +x ij s ; The client and the server jointly use the security comparison protocol SecCom(.) to compare the parameter y i and x ij Calculate and get the parameter u ij1 ,u ij2 ; Set the parameter u ij1 Save on the client side, set the parameter u ij2 Save on the server i ; Among them, y i represents the threshold of the i-th feature proposed by the client, x ij represents the i-th feature value of the j-th feature on the server, u ij1 represents the client output share of the security comparison protocol output for the i-th feature in the j-th sample on the server, u ij2 Represents the server output share of the security comparison protocol output for the i-th feature in the j-th server sample.

[0040] The parameter y is compared using the security comparison protocol SecCom(.) i and x ij The calculation process includes: client C calculates the client's intermediate parameter g1=y according to the client parameter i c -x ij c ; Server S i ,i∈{1,2} calculates the intermediate parameter g of the server according to the server parameters i2 =y i s -x ij s ; According to the client's intermediate parameters and the server's intermediate parameters, the client and the server jointly execute SecAddRes(g1,g i2 ) protocol, get the parameter u ij1 ,u ij2 SecAddRes(.) represents the secret sharing conversion protocol, g1 represents the difference between the client secret share of the i-th feature comparison threshold and the client secret share of the i-th feature value in the j-th sample on the server, g i2 Represents the difference between the server secret share of the ith feature comparison threshold and the server secret share of the ith feature value in the jth server sample.

[0041] Execute SecAddRes(g1,g i2 The process of the protocol includes: the user end and the server end generate a Beaver triple vector γ = α * β, and |α| = |β| = |γ| = d i ; Share γ by adding secrets to get γ = γ1 + γ2; Save parameters α and γ1 to the client, and save parameters β and γ2 to the server S i The client calculates χ = (g1-γ1) / α based on the saved parameters; the server S i Use the public key pk i Encrypt β to get and will Sent to the client; the client uses the public key pk i Encrypt χ to get The client obtains and calculate Will The vector order is confused and sent to the server S i ; Server S i Decrypt the data sent by the client and get ServerS i According to the obtained u ij2 Further calculation of δ=(g i2 -γ2) / u ij2 , and sends the calculated δ to the client; after receiving the parameters sent by the server, the client calculates u ij1 =α+δ, and get the parameter u ij1 ; where γ represents the product value in the Beaver triple, α represents the first value in the Beaver triple, β represents the second value in the Beaver triple, and d i represents the number of features on the server side, γ1 represents the client secret share of γ, γ2 represents the server secret share of γ, and χ and δ both represent the intermediate process values ​​in the calculation process.

[0042] This example is a three-party private set intersection, the client is C and the server is S i ,i∈{1,2}, G is the Nth-order base point on the elliptic curve, is the elliptic curve point group. Server S i The public and private key pair is (sk i ,pk i ),in The server's total public key pk = pk1 + pk2. Assume that the data id of each party ∈ {0,1} * , which can be equivalently calculated as the elliptic curve point ID∈G. S i Data features Fi The characteristic number of i , then the server data can be expressed as Since the retrieval strategy is aimed at the server data, in this PSI protocol, the client data only involves the intersection operation of the data id, so the client data can be simply expressed as D c =ID ck ,k∈[1,|D c |] is enough. Client C targets S i Features F i Formulate a search strategy p (p is a i Confidential), and use the server data D to calculate i Each piece of data (ID ij ,x ij )’s strategy parameters (u ij1 ,u ij2 ),i∈{1,2},j∈[1,|D i |]. Among them, Saved by the client, By the server S i Save. By the secure size comparison protocol, the client gives the verification parameters If v=u ij1 +u ij2 Representative ID ij The corresponding feature data x ij Satisfies the retrieval strategy p, otherwise the retrieval strategy p is not satisfied.

[0043] For the server S i ,i∈{1,2}, client C gives the feature vector y according to p i ,|y i |=d i For S i Each piece of data corresponds to x ij ,j∈[1,|D i |],(u ij1 ,u ij2 ) is calculated as follows: Figure 1 First, the server S i Use addition secret sharing with client C to make y i =y i c +y i s 、x ij =x ij c +x ij s .y i c ,x ijc Saved by the client, y i s ,x ij s The server saves the data. Then the client C and the server S i Joint implementation of the security comparison protocol SecCom (y i ,x ij ), SecCom(y i ,x ij The specific execution process of ) is as follows. Client C calculates g1 = y i c -x ij c , server S i ,i∈{1,2}calculate g i2 =y i s -x ij s Then the client C and the server S i Execute SecAddRes(g1,g i2 ) protocol, and calculate u from the protocol ij1 ,u ij2 . Where u ij1 Saved by client C, u ij2 By the server S i save. SecAddRes(g1,g i2 The specific process of ) is as follows: Generate the Beaver triple vector γ=α*β in advance, |α|=|β|=|γ|=d i , and share γ through addition secret to get γ = γ1 + γ2. Among them, α, γ1 are saved by the client, β, γ2 are saved by the server S i Save. Client C calculates χ = (g1-γ1) / α. Server S i Use the public key pk i Encrypt β to get Sent to client C. C uses the public key pk i Encrypt χ to get And further calculate Will The vector order confusion is sent to the server S i Server S i Decrypted S i Further calculation of δ=(g i2 -γ2) / u ij2 , and sends δ to client C. C calculates u ij1 =α+δ.

[0044] Client C uses pk to uij1 ,i∈{1,2},j∈[1,|D i |] to encrypt the ciphertext [u ij1 ] pk The encryption process is as follows: Figure 2 . Random Selection [u ij1 ] pk =(r i ·G,u ij1 ·G+r i ·pk). Server S i Use pk to u respectively ij2 ,i∈{1,2},j∈[1,|D i |] to encrypt the ciphertext [u ij2 ] pk The encryption process is randomly selected. [u ij2 ] pk =(r i ′·G,u ij2 ·G+r i ′·pk).

[0045] Client C will [u ij1 ] pk Sent to the server S i ,i∈{1,2}. i Will [u ij1 ] pk with [u ij2 ] pk Add together to get [u ij1 +u ij2 ] pk =((r i +r i ′)·G,(u ij1 +u ij2 )·G+(r i +r i ′)·pk),j∈[1,|D i |].

[0046] Specific PSI protocols include Figure 3 , the server S1 generates a random number a∈[1,N-1], calculates a·ID1, and sends it to the client C. C generates a random number b∈[1,N-1], calculates ab·ID1, b·ID c C sends ab·ID1 to the server S1. The server S1 calculates the mask M1 of D1, where M1:b -1 ·ab·ID1=b·ID1. Client C converts b·ID c With its own data ID cComposition union M2:b·ID c ∪ID c The server S1 sends the mask M1:b·ID1 to the server S2, and the client C sends the corresponding [u 1j1 +u 1j2 ] pk Sent to server S2.

[0047] The server S2 combines ID2 and M1 into a new union mask M3: b·ID1∪ID2. ij1 +u ij2 ] pk The first part is (r i +r i ′)·G, we can calculate (r i +r i ′)pk2=(r i +r i ′)·sk2·G, subtract the above formula from the second part of the ciphertext, and we can get

[0048] The server S2 generates a random number e∈[1,N-1], and uses the mask M3 to calculate be·ID1∪e·ID2, and sends it to the client C. The client generates a random number h∈[1,N-1], calculates beh·ID1∪eh·ID2, and sends it to the server S2. The server S2 uses beh·ID1∪eh·ID2 and the inverse element e -1 Calculate the mask M4: bh·ID1∪h·ID2. And compare M4 with the corresponding ciphertext After being obfuscated, it is sent to the server S1.

[0049] Client C calculates mask M5 using mask M2 and h: bh·ID c ∪h·ID c Client C sends the corresponding index to server S1. Server S1 finds the intersection of M2 and M5, such as Figure 4 If an index appears twice in the intersection, the server S1 decrypts the corresponding Get u ij1 +u ij2 If v = u ij1 +u ij2 , i∈{1,2} (whether both equations are satisfied or only one of them is satisfied depends on the application scenario), then the data corresponding to the index is the intersection of the three parties and satisfies the search condition p, and the index is returned.

[0050] Client C finds the ID that meets the conditions based on the returned index. cindex ,index∈[1,|D c|]; where ID cindex Indicates the index-th data of the client.

[0051] The above embodiments further illustrate the purpose, technical solutions and advantages of the present invention in detail. It should be understood that the above embodiments are only preferred implementation modes of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made to the present invention within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A privacy set intersection method based on multi-party conditional retrieval, characterized in that: include: Obtain system parameters, calculate policy parameters based on the obtained system parameters; encrypt the calculated policy parameters; each server executes the PSI protocol based on the encrypted policy parameters; find the intersection of the privacy sets of each server based on the protocol results, obtain the intersection result, and send the intersection result to the client; The system parameters obtained include client parameters and server parameters; client parameters include: i c and x ij c ; Server parameters include: y i s and x ij s ; Among them, y i c represents the client secret share of the i-th feature comparison threshold, x ij c represents the client secret share of the i-th feature value in the j-th sample on the server, y i s represents the server secret share of the i-th feature comparison threshold, x ij s The server secret share representing the i-th feature value in the j-th sample on the server; The process of calculating the policy parameters based on the obtained system parameters includes: i Use the additive secret sharing strategy with client C to share parameters and obtain parameter y i =y i c +y i s and x ij =x ij c +x ij s ; The client and the server jointly use the security comparison protocol SecCom(.) to compare the parameter y i and x ij Calculate and get the parameter u ij1 ,u ij2 ; Set the parameter u ij1 Save on the client side, set the parameter u ij2 Save on the server i ; Among them, y i represents the threshold of the i-th feature proposed by the client, x ij represents the i-th feature value of the j-th feature on the server, u ij1 represents the client output share of the security comparison protocol output for the i-th feature in the j-th sample on the server, u ij2 represents the server output share of the security comparison protocol output for the i-th feature in the j-th server sample; The process of encrypting the calculated policy parameters includes: Step 1: The client uses the public key pk to ij1 ,i∈{1,2},j∈[1,|D i |] to encrypt and obtain the ciphertext [u ij1 ] pk ; Server S i Use public key pk to u ij2 ,i∈{1,2},j∈[1,|D i |] to encrypt and get the ciphertext [u ij2 ] pk ; Among them, |D i | represents the number of data in the dataset of the ith server, D i represents the dataset of the i-th server, i represents the index of the feature, and j represents the index of the sample; Step 2: Client C sends the ciphertext [u ij1 ] pk Sent to the server S i ,i∈{1,2}; the server sends the ciphertext [u ij1 ] pk With the ciphertext [u ij2 ] pk Add the encrypted ciphertext parameters [u ij1 +u ij2 ] pk ; The process of each server executing the PSI protocol includes: Step 1: The server S1 generates a random number a∈[1,N-1], calculates a·ID1 based on the generated random number, and sends the calculation result to the client C; ID1 represents the data set of the server S1, and N represents the order of the elliptic curve basis point; Step 2: Client C generates a random number b∈[1,N-1], and calculates ab·ID1 and b·ID based on the generated random number and the data sent by the server. c ; Client C will b·ID c With ID c Composition union M2:b·ID c ∪ID c ; and send ab·ID1 to the server S1; where ID c A dataset representing the client; Step 3: The server S1 calculates the ID1 mask M1 based on the data sent by the receiving client, where M1:b -1 ab ID1 = b ID1; Step 4: Server S1 sends the mask M1:b·ID1 to server S2, and client C sends the ciphertext parameter [u 1j1 +u 1j2 ] pk Send to server S2; Step 5: The server S2 combines ID2 and M1 to form a new union mask M3: b·ID1∪ID2; Step 6: The server S2 generates a random number e∈[1,N-1], and uses the mask M3 to calculate be·ID1∪e·ID2, and sends the calculation result to the client C; where ID2 represents the data set of the server S2; Step 7: After receiving the data sent by the server S2, the client C generates a random number h∈[1,N-1], performs a union operation on the generated random number, i.e., beh·ID1∪eh·ID2; and sends the result of the union operation to the server S2; Step 8: The server S2 uses the result of the set operation beh·ID1∪eh·ID2 and the inverse element e -1 Calculate the mask M4: bh·ID1∪h·ID2; and compare M4 with the corresponding ciphertext After being obfuscated, it is sent to the server S1; The process of finding the intersection of the privacy sets of each server according to the protocol results includes: Step 1: Client C calculates mask M5:bh·ID using mask M2 and h c ∪h·ID c ; The client C sends the mask M5 and the index corresponding to the mask M5 to the server S1; where index represents the index; Step 2: Server S1 finds the intersection of mask M2 and mask M5; if the index in the intersection appears twice, server S1 will encrypt the ciphertext Decrypt and get the decrypted plaintext u ij1 +u ij2 ; If v = u ij1 +u ij2 And i∈{1,2}, then the data corresponding to the index is the intersection of the three parties and satisfies the search condition p, and index is returned; v represents the decrypted plaintext that satisfies the search condition p; Step 3: Client C finds the ID that meets the conditions based on the returned index cindex ,index∈[1,|D c |]; where ID cindex Indicates the index-th data of the client.

2. According to claim 1, a privacy set intersection method based on multi-party conditional retrieval is characterized in that: The parameter y is compared using the security comparison protocol SecCom(.) i and x ij The calculation process includes: client C calculates the client's intermediate parameter g1=y according to the client parameter i c -x ij c ; Server S i ,i∈{1,2} calculates the intermediate parameter g of the server according to the server parameters i2 =y i s -x ij s ; According to the client's intermediate parameters and the server's intermediate parameters, the client and the server jointly execute SecAddRes(g1,g i2 ) protocol, get the parameter u ij1 ,u ij2 SecAddRes(.) represents the secret sharing conversion protocol, g1 represents the difference between the client secret share of the i-th feature comparison threshold and the client secret share of the i-th feature value in the j-th sample on the server, g i2 Represents the difference between the server secret share of the ith feature comparison threshold and the server secret share of the ith feature value in the jth server sample.

3. According to claim 2, a privacy set intersection method based on multi-party conditional retrieval is characterized in that: Execute SecAddRes(g1,g i2 The process of the protocol includes: the user end and the server end generate a Beaver triple vector γ = α * β, and |α| = |β| = |γ| = d i ; Share γ by adding secrets to get γ = γ1 + γ2; Save parameters α and γ1 to the client, and save parameters β and γ2 to the server S i The client calculates χ = (g1-γ1) / α based on the saved parameters; the server S i Use the public key pk i Encrypt β to get and will Sent to the client; the client uses the public key pk i Encrypt χ to get The client obtains and calculate Will The vector order is confused and sent to the server S i ; Server S i Decrypt the data sent by the client and get ServerS i According to the obtained u ij2 Further calculation of δ=(g i2 -γ2) / u ij2 , and sends the calculated δ to the client; after receiving the parameters sent by the server, the client calculates u ij1 =α+δ, and get the parameter u ij1 ; where γ represents the product value in the Beaver triple, α represents the first value in the Beaver triple, β represents the second value in the Beaver triple, and d i represents the number of features on the server side, γ1 represents the client secret share of γ, γ2 represents the server secret share of γ, and χ and δ represent the intermediate process values ​​in the calculation process.

4. According to claim 1, a privacy set intersection method based on multi-party conditional retrieval is characterized in that: The corresponding ciphertext Includes: Ciphertext [u ij1 +u ij2 ] pk The first part is (r i +r i ′)·G, according to the first part (r i +r i ′)·G calculates homomorphic addition operation, and the formula of homomorphic addition operation is: (r i +r i ′)pk2=(r i +r i ′)·sk2·G The ciphertext [u ij1 +u ij2 ] pk The second part subtracts the homomorphic addition operation formula to obtain the corresponding ciphertext The formula is: where r i With r i ′ represents the random number used for encryption, pk2 represents the public key of the server S2, sk2 represents the private key of the server S2, and G represents the elliptic curve base point.

Images